Popular articles
Can I use information from public registers or search engines to send promotional materials?
Yes, you can use public register data for marketing in Hong Kong, BUT only if you obtain the users’ consent. This applies even for personal data that is publicly available. Here’s what startups, SMEs, and marketers need to know about Hong Kong’s Personal Data (Privacy) Ordinance (PDPO).
- What Is Direct Marketing?
Direct marketing refers to promotional communications targeting specific individuals, including:
- Emails or SMS offering products/services
- Cold calls soliciting donations
- Mail addressed to a named person
Even if that person is not referred to by name, the promotion will be seen as direct marketing if it specifically selects and contacts a person using their personal data.
Under PDPO Section 35C, these activities are strictly regulated regardless of how you obtain the contact details — including from publicly available information.
- What Is Personal Data?
The PDPO defines personal data as any information that can identify a living individual, such as:
- Names with contact details (email/phone)
- Professional profiles from public registries
- Digital footprints that reveal identity when combined
Crucially, the data source (public/private) doesn’t affect its classification under Hong Kong law.
- Using Publicly Available Information: Is It Still Personal Data?
Yes. Information from these common sources still requires PDPO compliance:
✔️ Company registry listings
✔️ Professional directories
✔️ Social media or search engine results
The key difference is that, while you may access this data, using it for marketing triggers consent requirements under Hong Kong statute.
- Penalties for Non-Compliance
Using someone’s personal data without following the PDPO provisions is a criminal offence. Violating PDPO rules can result in:
- Fines up to HKD 500,000
- For serious offences, imprisonment for up to 3 years
- Reputational damage, particularly harmful for SMEs
Learn how to use AI tools to mitigate risks in our guide to Hong Kong’s data breach regulations
- What Steps Must You Take Before Using Personal Data for Direct Marketing?
Per section 53C of the PDPO, here is the compliance checklist:
- Inform the individual: Disclose your intent to use their data for marketing
- Obtain explicit consent: Opt-in must be voluntary and documented
- First-use notice: Send a reminder before initial contact
- Provide opt-out: Include unsubscribe mechanisms in all communications, free of charge
Need help navigating this issue? Check out Ask.Legal — our AI-powered legal assistant is ready to help 24/7.
