Schedule 1 DPP2 Accuracy and Retention Principle requires all practicable steps shall be taken to ensure that personal data is accurate having regard to the purpose for which it is to be used, and is not kept longer than is necessary for the fulfilment of the purpose. If a data user engages a data processor whether within or outside Hong Kong to process personal data on its behalf, the data user must adopt contractual or other means to prevent personal data being kept longer than necessary by the processor. PDPO Section 26 imposes specific duty to erase personal data no longer required for the purpose for which it was collected, unless legal exemption applies. Operationalised through: data accuracy verification on intake + periodic refresh, retention schedule per category aligned to lawful purpose, statutory or regulatory retention overrides (e.g. SFO record-keeping, IRO tax records, employment compensation ordinance, AML legislation), processor contracts with retention + deletion clauses, secure deletion + destruction certificates, archival vs. operational separation, data inventory + register, periodic retention review + erasure. HK PDPO DPP2 + accuracy + retention + Section 26 erasure + records applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.