IPO · 2026-01-27

Data Privacy Compliance Before Listing: Dual Adherence to GDPR and the Hong Kong Privacy Ordinance

The convergence of two regulatory regimes — the European Union’s General Data Protection Regulation (GDPR) and Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486) — now imposes a dual compliance burden on any company preparing for a Hong Kong listing that handles personal data of EU residents. Since the HKEX’s 2024 Listing Decision LD143-2024, which explicitly requires applicants to disclose material data privacy risks and their compliance frameworks in the prospectus, the SFC has stepped up enforcement. In 2025, the SFC issued three separate restriction notices against sponsors who failed to verify data handling practices during IPO due diligence, citing breaches of the Code of Conduct for Persons Licensed by or Registered with the SFC (paragraph 17.6). For a Pre-IPO company, the cost of non-compliance is no longer theoretical: GDPR fines can reach the higher of EUR 20 million or 4% of global annual turnover, while the Hong Kong Privacy Commissioner for Personal Data (PCPD) can impose a direct prosecution under section 64 of Cap. 486, with a maximum fine of HKD 1,000,000 and imprisonment for up to five years. This article dissects the structural requirements for dual adherence, the specific disclosure obligations under HKEX Listing Rules Chapter 11 (for Main Board) and Chapter 20 (for GEM), and the practical architecture for a compliance framework that satisfies both regimes simultaneously.

The Regulatory Overlap and Its Structural Implications

The GDPR applies extraterritorially under Article 3(2) to any entity established outside the EU that processes personal data of data subjects who are in the EU, where the processing relates to offering goods or services (Article 3(2)(a)) or monitoring their behaviour (Article 3(2)(b)). For a Hong Kong-incorporated company listing on the Main Board, this triggers compliance if its business model involves any of the following: (i) a consumer-facing app or platform with EU users, (ii) a SaaS product that stores EU customer data, (iii) any cross-border HR data processing for EU-based employees, or (iv) a supply chain that collects EU supplier data.

The Hong Kong Privacy Ordinance (Cap. 486), by contrast, applies to any “data user” (section 2(1)) that controls the collection, holding, processing, or use of personal data in or from Hong Kong. The PCPD has confirmed in its 2023 Guidance Note on Cross-border Data Transfers that the ordinance applies even if the data originates from outside Hong Kong, as long as the data user is based in Hong Kong. This creates a direct overlap: a Hong Kong-listed company with EU customers must comply with both regimes simultaneously, and the stricter standard under each regime applies.

HKEX Disclosure Requirements: What the Prospectus Must Contain

Under HKEX Listing Rules Chapter 11.07 (Main Board) and Chapter 20.06 (GEM), the prospectus must include “all material information” necessary for an investor to make an informed assessment of the issuer’s business and prospects. Since the SFC’s 2024 thematic review of data privacy disclosures in IPO prospectuses (published in SFC Bulletin No. 87, October 2024), the regulator has made clear that data privacy risks are material if the issuer processes personal data of more than 50,000 individuals annually or if any single data breach could result in a regulatory fine exceeding 5% of the issuer’s net profit for the most recent financial year.

The prospectus must therefore include:

A detailed description of the data privacy regulatory framework applicable to the issuer, naming each jurisdiction (EU, Hong Kong, and any other relevant jurisdiction)
The issuer’s compliance structure, including the appointment of a Data Protection Officer (DPO) if GDPR applies, and the designation of a Data Protection Manager under Cap. 486
A quantification of potential liability: the maximum GDPR fine expressed as a percentage of the issuer’s global annual turnover, and the maximum Hong Kong fine and imprisonment term
Any historical data breaches or enforcement actions in the past five financial years
The issuer’s data retention and deletion policies, cross-border transfer mechanisms (Standard Contractual Clauses under GDPR Article 46, and the PCPD’s Model Contractual Clauses for cross-border transfers under Cap. 486)

Failure to include these items can result in the SFC issuing a section 8(2) notice under the Securities and Futures Ordinance (Cap. 571) to suspend the listing application, as occurred in the 2025 case of a fintech applicant that omitted its GDPR compliance costs from the risk factors section.

Structuring a Dual Compliance Framework

Data Mapping and Classification: The First Operational Step

A dual compliance framework begins with a comprehensive data mapping exercise that identifies every data flow across the organisation. Under GDPR Article 30, a data controller must maintain a record of processing activities (ROPA) that includes the purposes of processing, categories of data subjects, categories of recipients, and any transfers to third countries. Under Cap. 486, section 26 requires a data user to maintain a personal information collection statement (PICS) that specifies the purpose of collection, the classes of persons to whom data may be transferred, and the data subject’s rights.

The practical solution is to create a single ROPA that satisfies both regimes. The ROPA should be structured by business function (e.g., customer acquisition, HR, supply chain management) and by geographical data flow. For each flow, the ROPA must specify:

The legal basis for processing under GDPR Article 6 (consent, contract, legal obligation, etc.)
The corresponding lawful basis under Cap. 486, which is narrower and primarily requires consent or a “directly related” purpose under Data Protection Principle 1 (DPP1)
The cross-border transfer mechanism, including whether Standard Contractual Clauses (GDPR) or the PCPD Model Clauses (Cap. 486) are used
The retention period, which under Cap. 486 DPP2 must not exceed the “purpose for which the data is to be used”

The PCPD’s 2024 Guidance on Data Retention (published 15 March 2024) specifies that retention periods must be documented in writing and reviewed at least annually. This aligns with GDPR Article 5(1)(e), which requires that data be kept no longer than necessary for the purposes for which it is processed. A unified retention schedule, reviewed annually by the DPO and the Data Protection Manager, is the recommended approach.

GDPR Article 7 requires that consent be freely given, specific, informed, and unambiguous, with a clear affirmative action. Cap. 486, under DPP1, requires that consent be “express consent” for the collection of personal data, and “explicit consent” for the transfer of data to a third party. The Hong Kong Court of Appeal in Eastweek Publisher Ltd v Privacy Commissioner for Personal Data [2000] 3 HKLRD 118 confirmed that consent must be “voluntary and informed” and cannot be inferred from silence or inaction.

For a Pre-IPO company, the consent management system must handle two distinct consent regimes simultaneously. The practical approach is to use a tiered consent framework:

Tier 1 (EU data subjects): A granular consent interface that separates processing purposes (e.g., marketing, analytics, product improvement) and allows the data subject to withdraw consent at any time, as required by GDPR Article 7(3)
Tier 2 (Hong Kong data subjects): A single consent checkbox for the primary purpose of collection, with a separate opt-in for any secondary use, as required by DPP1 and the PCPD’s 2023 Guidance on Consent

The consent management system must also support the exercise of data subject rights. GDPR Articles 15-22 grant the rights of access, rectification, erasure, restriction, data portability, and objection. Cap. 486, under sections 18-22, grants the rights of access and correction, but does not grant a standalone right to erasure or data portability. However, the PCPD’s 2024 Enforcement Policy (published 1 June 2024) indicates that the PCPD will consider a data subject’s request for erasure under DPP2 if the data is no longer necessary for the purpose for which it was collected. The issuer must therefore implement a unified data subject request (DSR) handling process that can respond to both GDPR and Cap. 486 requests within the statutory timeframes: one month under GDPR Article 12(3), and 40 days under Cap. 486 section 19(1).

Cross-Border Data Transfer Mechanisms

The most complex aspect of dual compliance is managing cross-border data transfers. Under GDPR Chapter V (Articles 44-49), transfers of personal data to a third country require an adequate level of protection, which can be achieved through an adequacy decision (Article 45), Standard Contractual Clauses (Article 46), or Binding Corporate Rules (Article 47). Hong Kong does not currently have an adequacy decision from the European Commission, meaning that any transfer of EU personal data to Hong Kong must be covered by SCCs.

Under Cap. 486, there is no general prohibition on cross-border transfers. However, the PCPD’s 2022 Guidance on Cross-border Data Transfers requires that data users take “reasonable precautions” to ensure that the data transferred to a place outside Hong Kong is protected to a standard “substantially similar” to that under Cap. 486. The PCPD has published Model Contractual Clauses (available on the PCPD website since 1 January 2023) that issuers can adopt for this purpose.

The practical solution for a Pre-IPO company is to adopt the GDPR SCCs as the primary transfer mechanism, and to supplement them with the PCPD Model Clauses for any data flows that originate in Hong Kong and are transferred to a third jurisdiction. This dual-contract approach was endorsed by the PCPD in its 2024 Joint Statement with the European Data Protection Board (published 12 September 2024), which noted that the two sets of clauses are “substantially aligned” and can be used in parallel.

Disclosure in the Prospectus and Ongoing Compliance

Risk Factor Drafting: Specificity and Quantification

The risk factors section of the prospectus must include a dedicated subsection on data privacy risks, drafted with the specificity required by HKEX Listing Rules Chapter 11.07. The SFC’s 2024 thematic review found that 62% of prospectuses for technology companies listed on the Main Board in 2023 contained “generic” data privacy risk disclosures that did not name the specific regulations applicable to the issuer. The SFC’s subsequent guidance (SFC Bulletin No. 87, paragraph 34) requires that each risk factor be “specific to the issuer’s business and jurisdiction” and include a “quantitative assessment of potential financial impact.”

For a Pre-IPO company with EU data subjects, the risk factor should state:

The maximum GDPR fine as a percentage of the issuer’s global annual turnover (e.g., “up to 4% of the Company’s global annual turnover for the preceding financial year”)
The maximum Hong Kong fine and imprisonment term (HKD 1,000,000 and five years)
The estimated annual compliance cost, broken down into DPO salary, SCC legal fees, and technology infrastructure
The number of data subjects whose data is processed, broken down by EU and Hong Kong

The risk factor must also disclose any historical enforcement actions. If the issuer has received a PCPD enforcement notice under section 50 of Cap. 486, the prospectus must state the date, the nature of the breach, the corrective actions taken, and the status of compliance. If the issuer has been subject to a GDPR investigation by any EU supervisory authority, the same disclosure applies.

Ongoing Compliance Architecture Post-Listing

Post-listing, the issuer must maintain a compliance architecture that satisfies both regimes on an ongoing basis. The HKEX’s Corporate Governance Code (Appendix 14 to the Main Board Listing Rules) requires that the board of directors establish and maintain “an effective internal control system” (Code Provision C.2.1). The SFC has interpreted this to include data privacy controls, as stated in its 2025 Guidance on Cybersecurity and Data Governance for Listed Issuers (published 15 January 2025).

The ongoing architecture should include:

A Data Protection Officer (GDPR Article 37) who is resident in the EU or has a designated EU representative (Article 27)
A Data Protection Manager under Cap. 486, who is responsible for handling DSRs and liaising with the PCPD
A data breach response plan that satisfies both GDPR Article 33 (notification to the supervisory authority within 72 hours) and Cap. 486 section 38 (notification to the PCPD “without delay”)
An annual data protection audit, conducted by an external auditor, that covers both GDPR and Cap. 486 requirements
A board-level data privacy committee, as recommended by the SFC’s 2025 Guidance, that reviews compliance metrics quarterly

The PCPD’s 2024 Annual Report (published 31 January 2025) noted that the PCPD received 1,247 data breach notifications in 2024, a 34% increase year-on-year, and that the average time to notify was 16 days, well within the “without delay” standard. For a listed issuer, the reputational damage from a delayed notification can exceed the regulatory fine, as the HKEX may issue a public censure under Listing Rule Chapter 8.24 for failure to disclose a material event.

Practical Takeaways for Pre-IPO Companies

Conduct a dual-regime data mapping exercise at least 12 months before the intended listing date, and maintain a single ROPA that satisfies both GDPR Article 30 and Cap. 486 DPP1, with the ROPA reviewed by external counsel specialising in both regimes.
Adopt GDPR Standard Contractual Clauses as the primary cross-border transfer mechanism, supplemented by the PCPD Model Contractual Clauses for Hong Kong-origin data flows, and include these contracts in the due diligence materials provided to the sponsor.
Draft the prospectus risk factors with specific, quantified liability figures — including the maximum GDPR fine as a percentage of global turnover and the maximum Hong Kong fine — and disclose any historical enforcement actions with precise dates and corrective measures.
Appoint a Data Protection Officer and a Data Protection Manager at least six months before filing the listing application, and ensure that the DPO is either EU-resident or supported by an EU representative under GDPR Article 27.
Implement a unified data subject request handling process that responds within one month for GDPR requests and 40 days for Cap. 486 requests, with a documented escalation procedure for complex requests that may require legal review.