In this course · 5 of 8
Course 5
Customers, data and payments
8 lessons · 8 min
- 1What does the Trade Descriptions Ordinance require of online product listings?
- 2Is there a cooling-off period for online purchases in Hong Kong?
- 3What product safety rules apply to consumer goods sold online in Hong Kong?
- 4What do I need to do with customer data to comply with Hong Kong privacy law?
- 5Do I need consent to send marketing emails or WhatsApp messages in Hong Kong?
- 6How do Stripe, PayPal and other payment gateways work for a Hong Kong online store?
- 7How can an online company open a bank account in Hong Kong?
- 8Can an online store sell gift cards or store credit without a licence?
The short answer
Tell customers how their data will be used for marketing and obtain consent before using it, and stop when a customer opts out, free of charge. Breaches can be criminal offences, with higher penalties where data is passed on for gain.
Using customer data for direct marketing is regulated by Part 6A of the PDPO, and electronic messages are also covered by the Unsolicited Electronic Messages Ordinance.
PDPO: before first using a person's data for direct marketing, the store must tell the customer what kinds of data it will use, the kinds of goods or services it will market and how to give consent, and must obtain the customer's consent. Customers can opt out at any time, and the store must stop using their data for marketing without charge. The first marketing contact must also remind the person of the right to opt out.
Penalties: PCPD and legal information sources report a maximum of a HK$500,000 fine and three years' imprisonment for ordinary breaches, and HK$1 million and five years where personal data is provided to others for gain.
Electronic messages: emails, SMS and similar messages must carry sender identification and a working unsubscribe facility, and must respect do-not-call registers. The Office of the Communications Authority administers that Ordinance.
Keep a list of opt-outs and apply it before every campaign.
Legal basis and sources
The law
- Personal Data (Privacy) Ordinance (Cap. 486), Part 6A
- Unsolicited Electronic Messages Ordinance (Cap. 593)
General information for business owners, not legal, tax or professional advice. Rules change, so check the sources or ask a licensed professional before you act.
Was this lesson useful?
Upvote it and it moves up for the next reader who asks.
