Ordinance
4notify Hong Kong · Government Gazette
OFFICIAL · PCPD · Cap. 486
Ordinance No
ORD-HK-005
Date
2026-05-27
Status
In force
Category
Privacy

PCPD, the Personal Data (Privacy) Ordinance and consent: the permission framework for transactional and direct-marketing delivery

The Office of the Privacy Commissioner for Personal Data (PCPD) enforces the Personal Data (Privacy) Ordinance (Cap. 486). For direct marketing, sections 35A to 35M require prescribed information, an explicit unambiguous-consent step and a clear opt-out — and the OFCA-operated Do-Not-Call registers under Cap. 593 cover voice and fax. 4notify records the lawful basis on every envelope and verifies consent at the API edge on every send.

EmailSMSWebhook
Preamble

Whereas, by virtue of the Personal Data (Privacy) Ordinance (Cap. 486) and the Unsolicited Electronic Messages Ordinance (Cap. 593), it is hereby ordained concerning consent management for electronic delivery to Hong Kong recipients.

Statutory basis
Personal Data (Privacy) Ordinance (Cap. 486)

Data-protection principles, the rights of the data subject and the powers of the Privacy Commissioner under sections 35A-35M for direct marketing.

Unsolicited Electronic Messages Ordinance (Cap. 593)

Restrictions on commercial electronic messages, the unsubscribe facility and the Do-Not-Call registers operated by OFCA.

PCPD Guidance on Direct Marketing

Prescribed information, the consent step ("opt-in" rather than "opt-out") and the recipient's right to require the trader to cease using personal data in direct marketing.

Implementation
01

Lawful basis per envelope

Every envelope carries one of the Cap. 486 lawful bases (consent under s.35E, contract, legal obligation or legitimate interest); the basis is pinned to the template registration.

02

Direct-marketing consent verification

On commercial messages the section 35E consent is verified at envelope level; deliveries without permission are blocked at the API edge.

03

Suppression in under 24 hours

Cease-to-use requests propagate within 24 hours across 4notify; the suppression list updates on all five mobile networks and the email gateway.

04

Breach-notification webhook

Any envelope-level incident triggers a webhook to the Data Protection Officer in under one hour, supporting the practice direction of the PCPD on data-breach notification.

Delivery envelope
json
{
  "event": "delivery.consent_envelope",
  "controller_id": "HK-DC-12345",
  "lawful_basis": "consent",
  "consent": {
    "record": "PCPD-2026-001234",
    "consent_date": "2025-09-14",
    "opt_out_link_present": true
  },
  "delivery": { "channel": "email", "template": "promo_v2" },
  "suppression_check": "passed"
}
Sample message
EmailSubject: We have updated your marketing preference

Dear customer, From today your direct-marketing permission is withdrawn. You will no longer receive promotional emails — but you will still receive transactional notices (order confirmations, delivery alerts). To exercise your other rights under Cap. 486: [email protected]

Compliance checklist
  • Data-user record under Cap. 486 maintained
  • Data-protection officer configured
  • Section 35E consent retained per commercial delivery
  • Breach-notification webhook reachable
The 4notify difference

4notify is the only A2P provider that retains the Cap. 486 lawful basis on every envelope, propagates cease-to-use requests in under 24 hours across all five Hong Kong mobile networks, and triggers a PCPD-aligned breach-notification webhook on every incident.

Frequently asked questions
Does the consent requirement apply to SMS too?

Yes — section 35E of Cap. 486 covers direct marketing through any channel that carries personal data: SMS, email, voice, fax. Every channel needs a valid lawful basis.

And if the controller has not registered as a data user?

4notify blocks the commercial delivery at the API edge until a valid PCPD record is in place; transactional delivery on a contractual basis remains available.

Published
4notify Department of Operations
2026-05-27 · ORD-HK-005

Start free

14 days, no card. English-speaking support on weekdays.

Other entries in this edition