Collection, storage and transfer of data in Hong Kong

In what circumstances can personal data be collected, stored and processed?

Personal data can be collected only for lawful purposes that are directly related to a data user’s function or activity. The personal data that is collected must not exceed that which is necessary for such purpose or a directly related purpose.

Are there any limitations or restrictions on the period for which an organisation may (or must) retain records?

Data users should retain personal data for no longer than is necessary to fulfil the original collection purpose or a directly related purpose, unless any deletion of the personal data is prohibited by law or it is in the public interest for the personal data to be retained (eg, historical interest).