Data protection and privacy legislation is observed, which for Hong Kong means the privacy ordinance for personal data (Cap. 486) and above all its fourth data protection principle, which concerns the security of personal data. Offshore data centres may be used for hosting, but transactions of important data occur in onshore data centres with proper controls; section 33 of the Ordinance on cross-border transfer, though not yet in operation, and the Privacy Commissioner's guidance on cross-border data transfer are referred to where applicable; and the B/D requires providers to seek its approval before information leaves the Hong Kong SAR.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.