Section 33 PDPO restricting cross-border transfer of personal data to places outside Hong Kong has been enacted in 1995 but is the only PDPO section not yet brought into force (over 28 years). Section 33 would prohibit transfer to a place outside Hong Kong unless: PCPD has specified the place as having data protection law substantially similar to PDPO; data user has reasonable grounds to believe transferred data will be afforded such protection; data subject has consented in writing; data user has reasonable grounds to believe transfer is for avoidance or mitigation of adverse action against data subject; data is exempt under Part 8. PCPD has issued Guidance on Personal Data Protection in Cross-border Data Transfer 2014 + revised 2022 recommending data users voluntarily comply with Section 33 standards: assess legal regime of destination, use Recommended Model Contractual Clauses (RMCCs) issued by PCPD 2022 (subject to subject + transferor to transferee + agent to agent), assess accountability + redress mechanism + onward transfer. Coordination with mainland China PIPL (verified separately) under Greater Bay Area: Standard Contract for Cross-border Transfer Pilot in GBA (2024) for HK-mainland transfers, alleviating CAC Standard Contract requirement for participating organisations. Coord with APEC CBPR + Global CBPR Forum (verified separately). HK PDPO Section 33 not in force + PCPD 2022 Cross-Border Guidance + RMCCs + GBA Standard Contract Pilot + China PIPL + APEC CBPR coordination applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.