Country-specific guidance Current

PDPO principles for collecting and using client data

What DPP1 and DPP3 each actually require.

Collecting a client's personal data and later using it are governed by two separate principles under the Personal Data (Privacy) Ordinance, not one blanket rule. This guide sets out what each requires. It is general information, not legal or compliance advice.

Action plan

1 Collect only what's necessary, lawfully and fairly DPP1 sets the standard for what and how you collect, at the point of collection.

Data Protection Principle 1 requires that personal data only be collected for a lawful purpose directly related to a function or activity of your firm, that collection be adequate but not excessive for that purpose, and that the means of collection be lawful and fair. Where you collect directly from the individual, tell them whether providing the data is mandatory or voluntary, the purpose of collection, who may receive it, and how they can access or correct it.

  • Collect personal data only for a purpose directly related to a genuine firm function
  • Avoid collecting more than is adequate for that specific purpose
  • Tell the individual the purpose of collection and their access and correction rights

Done when: Client data collection is limited to what's necessary for a stated, lawful purpose, with the individual told what that purpose is

PCPD: the Personal Data (Privacy) Ordinance at a glance
2 Don't use client data for a new purpose without consent DPP3 is about what happens after collection, not the collection step itself.

Data Protection Principle 3 prevents personal data collected for one purpose being used for a new, unrelated purpose without the data subject's express and voluntary consent. If your firm wants to use a client's data for something beyond what it was originally collected for, such as marketing an unrelated service, get that consent first rather than assuming the original collection covers it.

  • Match each use of client data back to the purpose it was originally collected for
  • Get express, voluntary consent before using data for a new, unrelated purpose
  • Treat silence or non-response as not constituting consent

Done when: Client data is only used for its original purpose, or a new purpose covered by express consent

3 Tell clients plainly what you're collecting and why Being told matters as much as the collection being technically lawful.

Build the DPP1 disclosure, purpose, mandatory-or-voluntary status, likely recipients, and access and correction rights, into your standard client-facing intake material, rather than treating it as a one-off legal notice nobody reads. Plain language here does more for compliance than dense legal wording few clients actually engage with.

  • Put DPP1's required disclosures into plain-language client intake material
  • Repeat the disclosure at each point new personal data categories are collected
  • Avoid dense legal wording that clients are unlikely to actually read

Done when: Client-facing intake material plainly discloses what's collected, why, and the client's access and correction rights

See requesting identity documents from an individual client