What do I need to do with customer data to comply with Hong Kong privacy law?

The Personal Data (Privacy) Ordinance (PDPO) applies to the store as a "data user" whenever it handles personal data of living people. Its Schedule 1 sets out six data protection principles in plain terms:

1. Purpose and means of collection: collect only data that is needed and adequate, by lawful and fair means, and tell people why you collect it and who it may go to (a privacy statement or notice at checkout).
2. Accuracy and retention: keep data accurate, and do not keep it longer than needed.
3. Use: use data only for the purpose collected or a directly related one, unless the customer agrees.
4. Security: protect data from unauthorised access or loss, including when it is held by platforms or contractors.
5. Openness: publish your policies and practices.
6. Access and correction: let people see and correct their data.

The Office of the Privacy Commissioner for Personal Data (PCPD) can investigate complaints and issue enforcement notices, and some breaches are offences. Sending data to a third party for marketing, or buying a customer list, has extra rules. On data breaches, check the PCPD's current guidance, since the notification regime has been under review.