What is a data breach notification letter?
It is a formal letter informing people, or a regulator, that their personal data may have been exposed in a security incident, along with what the company is doing about it.
Data, Privacy & Compliance
Data Breach Notification Letter
Generate a data breach notification letter for customers, employees or the PCPD, reflecting Hong Kong's currently voluntary approach to breach notification under the PDPO.
- Create a customer data breach notification letter
Create a data breach notification letter from [Company Name] to affected customers, explaining what personal data was involved in the breach and what steps are being taken, consistent with PCPD guidance.
- Create a regulator data breach notification letter
Create a data breach notification letter from [Company Name] to the Office of the Privacy Commissioner for Personal Data (PCPD), reporting a breach affecting [Number] individuals and the company's response.
- Create an employee data breach notification letter
Create a data breach notification letter from [Company Name] to affected employees, explaining what personal data was exposed and what support is being offered.
Data Breach Notification Letter Generator (Hong Kong)
A data breach notification letter formally informs people, or a regulator, that their personal data may have been exposed in a security incident, along with what the company is doing about it. This free Hong Kong generator produces letters to customers, to the Office of the Privacy Commissioner for Personal Data (PCPD), and to employees. As of 2026, the Personal Data (Privacy) Ordinance (PDPO) does not impose a general mandatory breach notification duty, so notifying the PCPD and affected individuals is currently voluntary and follows the PCPD's published guidance on data breach handling, although reform proposals to introduce a mandatory duty have been discussed. It is designed for Hong Kong businesses responding to a suspected or confirmed data breach who want to follow good practice even without a strict legal deadline. The generator lets you describe what happened, what data was involved, remediation steps, and support offered to those affected. Use it to communicate clearly and consistently with the PCPD's guidance.
Frequently asked questions
Is a business legally required to notify a breach in Hong Kong?
As of 2026, the PDPO does not impose a general mandatory notification duty, so notifying the PCPD and affected individuals is voluntary, though the PCPD strongly encourages it as good practice.
What should a customer notification letter include?
It should explain what happened, what personal data was involved, what the company is doing in response, and what steps the customer can take to protect themselves.
How is a PCPD notification different from a customer letter?
A PCPD notification is typically more detailed and technical, covering the cause of the breach, the number of people affected, and remediation steps taken, following the PCPD's data breach notification guidance.
How quickly should a breach be reported in Hong Kong?
There is no statutory deadline, but PCPD guidance recommends notifying as soon as practicable after discovering the breach, since prompt notification is viewed favourably.
Should employees be notified the same way as customers?
Employee data breaches are often treated similarly to customer breaches, but the letter may also need to reference internal HR support and reporting channels.