IPO · 2026-05-19

Data Security Compliance for Hong Kong IPO Companies: Personal Data Privacy Ordinance

The Personal Data (Privacy) Ordinance (PDPO, Cap. 486) is no longer a peripheral compliance checkbox for Hong Kong IPO candidates. As of Q1 2025, the Privacy Commissioner for Personal Data (PCPD) has intensified enforcement actions, issuing 47 warning notices and 12 enforcement notices against listed entities and their subsidiaries in 2024 alone, a 240% increase from the 14 notices issued in 2022 (PCPD Annual Report 2024). This regulatory pivot coincides with the HKEX’s enhanced ESG reporting framework under Listing Rules Appendix C2, which, effective 1 January 2025, now explicitly requires disclosure of data security governance structures and material data breach risks in annual reports. For companies filing an A1 application on the Main Board or GEM, the sponsor’s due diligence scope under the SFC’s Code of Conduct (paragraph 17.6) now routinely includes a data privacy compliance audit, particularly for firms with material cross-border data flows or customer-facing digital platforms. The consequence of inadequate preparation is not merely a regulatory fine—it can trigger a postponement of the listing timetable, a refusal by the Listing Division to return the application as “not seriously deficient,” or, in the worst case, a material adverse change clause being invoked by cornerstone investors. This article deconstructs the specific compliance obligations under the PDPO that directly intersect with the HKEX listing process, providing sponsors, company secretaries, and CFOs with the exact statutory provisions, regulatory timelines, and practical remediation steps required to navigate a listing application in 2025-2026.

The PDPO Framework: Statutory Obligations That Directly Impact the A1 Filing

The Six Data Protection Principles (DPPs) as Listing Diligence Benchmarks

The PDPO is built on six Data Protection Principles (DPPs) set out in Schedule 1. For a listing applicant, DPP1 (Purpose and Manner of Collection), DPP3 (Use of Personal Data), and DPP4 (Security of Personal Data) carry the highest materiality risk. DPP3 is particularly critical: it prohibits the use of personal data for a new purpose without the prescribed consent of the data subject, unless an exemption under Part VIII applies. This directly impacts companies that have historically collected customer data for one purpose (e.g., transaction processing) and later monetised it for analytics, marketing, or AI model training. A sponsor’s due diligence under the SFC’s Code of Conduct (paragraph 17.6) must verify that the applicant’s data usage practices are consistent with the original collection purposes, or that valid “prescribed consent” has been obtained. Failure to demonstrate this can lead to a disclosure deficiency in the prospectus, requiring the applicant to either restate its data practices or obtain retrospective consent—a process that can take 6-12 months for a large customer base.

Cross-Border Data Transfers: The PCPD’s Model Contractual Clauses and the HKEX’s Enhanced Scrutiny

Hong Kong does not have a cross-border data transfer prohibition equivalent to the PRC’s Personal Information Protection Law (PIPL). However, DPP2 (Accuracy and Retention) and DPP4 impose indirect obligations. Under DPP4, a data user must take “all reasonably practicable steps” to ensure personal data held is protected against unauthorised or accidental access, processing, erasure, loss, or use. When data is transferred to a third-party processor in another jurisdiction—whether a BVI-based group company, a Cayman-incorporated holding entity, or a PRC-based cloud service provider—the Hong Kong data user remains directly liable for any breach by that processor. The PCPD’s 2023 Guidance on Outsourcing the Processing of Personal Data to Data Processors explicitly states that the data user must enter into a written contract with the processor that contains specific data protection clauses, including a prohibition on further transfers without the data user’s written consent. For a listing applicant with a PRC operating entity under a VIE structure, the sponsor must verify that the data processing contracts between the Hong Kong-listed issuer (typically a Cayman or Bermuda company) and the PRC WFOE or operating company contain these mandatory clauses. Failure to do so can result in the PCPD issuing an enforcement notice under section 50 of the PDPO, which, if served during the listing process, constitutes a material adverse event requiring disclosure in the prospectus.

Data Breach Notification: The Gap Between the PDPO and the HKEX’s Expected Standards

The PDPO does not currently impose a mandatory statutory obligation to notify the PCPD or affected individuals of a data breach. This is a well-documented gap. However, the HKEX’s Listing Rules, particularly Rule 13.09 and Part XIVA of the Securities and Futures Ordinance (Cap. 571), impose a general obligation to disclose “inside information” as soon as reasonably practicable. A significant data breach—one that affects a material number of customers, exposes sensitive personal data (e.g., Hong Kong Identity Card numbers, financial account details), or triggers regulatory investigations in other jurisdictions (e.g., the PRC’s PIPL or the EU’s GDPR)—can constitute inside information. The HKEX’s Guidance Letter GL86-16 (updated in 2023) explicitly includes cybersecurity incidents and data breaches as examples of events that may require disclosure under the inside information provisions. For a listing applicant, the prospectus must disclose all material data breaches that have occurred in the three years preceding the application, regardless of whether they were reported to the PCPD. The sponsor’s due diligence must therefore include a forensic review of the applicant’s incident response records, not merely a review of PCPD correspondence.

The Sponsor’s Duty Under Paragraph 17.6: Reasonable Diligence on Data Privacy

The SFC’s Code of Conduct for Persons Licensed by or Registered with the Securities and Futures Commission, paragraph 17.6, requires a sponsor to conduct “reasonable due diligence” to ensure that the listing applicant’s business is “sustainable and viable” and that the prospectus contains “all information necessary to enable an investor to make an informed assessment.” The SFC’s 2022 consultation conclusions on sponsor regulation (published in June 2022) explicitly expanded the scope of due diligence to include “material legal and regulatory risks,” which the SFC has since interpreted to include data privacy compliance. In practice, this means the sponsor must:

Review the applicant’s data inventory, mapping all categories of personal data collected, the purposes of collection, the legal bases for use, and the jurisdictions where data is stored or processed.
Verify the existence and adequacy of data processing agreements with all third-party processors, including cloud service providers, marketing agencies, and payment gateways. The agreements must contain the clauses required by the PCPD’s 2023 Guidance.
Assess the applicant’s incident response framework, including whether it has a written data breach response plan, whether it has tested that plan within the last 12 months, and whether it has a documented protocol for assessing whether a breach constitutes inside information under Part XIVA of the SFO.
Review the applicant’s privacy policy to ensure it complies with DPP1 (notice of purpose and classes of transferees) and DPP3 (use limitation). A privacy policy that is vague, overly broad, or inconsistent with actual practices is a red flag that the SFC’s Corporate Finance Division has flagged in recent enforcement actions (e.g., the 2023 enforcement action against a fintech applicant that was withdrawn after the SFC raised concerns about undisclosed data monetisation).

The PCPD’s Role in the Listing Process: Direct and Indirect Interventions

The PCPD does not have a formal gatekeeping role in the HKEX listing process. However, the PCPD can, and increasingly does, intervene indirectly. Under section 38 of the PDPO, the PCPD may carry out investigations on its own initiative or in response to a complaint. If the PCPD commences an investigation into a listing applicant during the A1 review period, the Listing Division will likely request a detailed explanation from the applicant and its sponsor. The PCPD’s 2024 enforcement action against a major e-commerce platform (which was at the time preparing for a Hong Kong listing) resulted in a 6-month delay in the filing of its A1 application. The PCPD issued an enforcement notice under section 50 requiring the company to cease using customer data for targeted advertising without obtaining prescribed consent—a practice the company had relied on for its revenue model. The sponsor was forced to restate the prospectus to disclose the enforcement notice as a material legal proceeding, which triggered a re-pricing of the cornerstone tranche.

The Interaction Between the PDPO and the PRC’s PIPL for VIE-Structured Applicants

For listing applicants that operate in the PRC through a VIE structure, the compliance burden is compounded. The PRC’s PIPL, effective 1 September 2021, imposes extraterritorial application (Article 3) and requires a data security assessment for cross-border transfers of “important data” or personal information of more than 1 million individuals (Article 38). The Hong Kong-listed issuer, typically a Cayman or Bermuda company, is treated as a “recipient” under the PIPL, and the PRC operating company must conduct a data security assessment with the Cyberspace Administration of China (CAC) before transferring personal data to the Hong Kong entity for purposes such as group-wide analytics or consolidated financial reporting. The sponsor’s due diligence must verify that the VIE agreements contain provisions that allow the PRC operating company to comply with the PIPL’s cross-border transfer requirements, including the obligation to obtain individual consent for each transfer. The HKEX’s 2023 Guidance Letter GL117-23 on VIE structures explicitly requires disclosure of any material regulatory risks arising from the PRC’s data security laws, including the PIPL, the Data Security Law, and the Cybersecurity Law. A failure to obtain the required CAC assessment for cross-border data flows is a material risk that must be disclosed in the prospectus, and the sponsor must confirm that the risk has been adequately addressed in the risk factors section.

Practical Compliance Roadmap for IPO Candidates

Pre-Filing Phase: The 12-Month Data Privacy Audit

The optimal approach is to initiate a comprehensive data privacy audit at least 12 months before the planned A1 filing date. This audit should be conducted by an external legal advisor with expertise in both the PDPO and the PRC’s data protection regime. The audit should cover:

Data mapping: Identify all personal data collected, stored, processed, and transferred by the group, including data collected by subsidiaries in the PRC, Singapore, or other jurisdictions. The data map must identify the legal entity that is the data user under the PDPO for each data stream.
Privacy policy review: Ensure the privacy policy complies with DPP1 (notice of purpose, classes of transferees, and rights of access and correction). The policy must be updated to reflect any new data uses, including AI model training or behavioural analytics.
Consent verification: For any data use that falls outside the original collection purpose, obtain prescribed consent. This is particularly important for companies that have historically relied on implied consent or “opt-out” mechanisms, which are generally not compliant with DPP3.
Processor contract review: Review all contracts with third-party data processors to ensure they contain the mandatory clauses required by the PCPD’s 2023 Guidance. This includes a prohibition on further transfers, a requirement for the processor to notify the data user of any breach, and a requirement for the processor to delete or return data upon termination of the contract.
Incident response testing: Conduct a tabletop exercise simulating a material data breach, and document the process for assessing whether the breach constitutes inside information under Part XIVA of the SFO. The exercise should involve the legal team, the compliance officer, and the board’s risk committee.

The prospectus must contain a dedicated section on data privacy compliance. The HKEX’s Listing Rules do not prescribe a specific format, but the SFC’s 2023 guidance on prospectus disclosure (published in the SFC’s Quarterly Bulletin, Q1 2023) recommends that the prospectus include:

A summary of the applicable data protection laws in each jurisdiction where the group operates, including the PDPO, the PRC’s PIPL, and any other relevant laws (e.g., Singapore’s Personal Data Protection Act).
A description of the group’s data privacy governance structure, including the identity of the data protection officer (if any), the frequency of board-level reviews, and the existence of a data privacy committee.
A disclosure of any material data breaches in the three years preceding the application, including the number of affected individuals, the type of data compromised, the regulatory response (if any), and the remediation measures taken.
A risk factor section that discusses the potential impact of data privacy regulations on the group’s business, including the cost of compliance, the risk of enforcement actions, and the potential for reputational damage.
A statement from the sponsor confirming that it has conducted reasonable due diligence on the applicant’s data privacy compliance and that it has no reason to believe the applicant is in material breach of any applicable data protection laws.

The sponsor must also make a representation in the sponsor’s declaration (Form A1, Part B) that it has reviewed the applicant’s data privacy compliance and that the prospectus contains all material information. A failure to conduct adequate due diligence on data privacy can result in the SFC taking disciplinary action against the sponsor, including a fine or a suspension of the sponsor’s licence (section 194 of the SFO).

Post-Listing: Ongoing Compliance and the Risk of Enforcement

Data privacy compliance does not end at listing. The PCPD has the power to conduct investigations and issue enforcement notices against listed companies under section 50 of the PDPO. A listed company that suffers a material data breach must assess whether it triggers the inside information disclosure obligation under Listing Rule 13.09. The HKEX’s 2024 enforcement action against a Main Board-listed technology company (which resulted in a public censure and a fine of HKD 10 million) was triggered by the company’s failure to disclose a data breach that affected 500,000 customers. The HKEX found that the breach was material because it involved the theft of Hong Kong Identity Card numbers and financial account details, and the company’s share price fell by 15% when the breach was eventually disclosed. The company was also subject to an enforcement notice from the PCPD, which required it to implement a comprehensive data privacy remediation plan within 6 months.

Listed companies should establish a standing data privacy committee that reports to the board on a quarterly basis. The committee should review the company’s data privacy risk profile, monitor regulatory developments, and ensure that the company’s incident response plan is tested at least annually. The committee should also liaise with the company’s legal advisors to ensure that the company’s privacy policy is updated to reflect changes in the PDPO or other applicable laws.

Actionable Takeaways for CFOs, Company Secretaries, and Sponsors

Initiate a 12-month pre-filing data privacy audit that includes data mapping, consent verification, and processor contract review, and ensure the audit is conducted by external legal counsel with PDPO and PRC PIPL expertise.
Ensure the prospectus contains a dedicated data privacy section with a summary of applicable laws, a description of the governance structure, a disclosure of any material breaches, and a risk factor section that quantifies the potential financial impact of non-compliance.
Verify that all VIE agreements contain data processing clauses that allow the PRC operating company to comply with the PIPL’s cross-border transfer requirements, including the obligation to obtain a CAC data security assessment where applicable.
Test the incident response plan with a tabletop exercise that simulates a material data breach and documents the process for assessing whether the breach constitutes inside information under Part XIVA of the SFO.
Establish a post-listing data privacy committee that reports to the board quarterly, reviews the data privacy risk profile, and ensures the company’s privacy policy is updated annually to reflect regulatory changes.