Schedule 1 DPP5 Openness Principle requires a data user to take all practicable steps to ensure that a person can ascertain the data user policies and practices in relation to personal data, the kinds of personal data held, and the main purposes for which personal data held by the data user are or are to be used. Operationalised through Privacy Policy Statement (PPS) published in a place easily accessible to data subjects (typically website footer, mobile app settings, customer service + lobby notices). PCPD recommends PPS components: identity + contact of data user, kinds of data + purposes + transferees, security measures + retention, DAR + DCR procedures + contact, complaints procedure, cross-border transfer (best practice), use of cookies + tracking (best practice), use of AI + automated decision-making (PCPD 2024 Generative AI guidance). PPS distinct from PICS: PPS is the organisation-wide policy publication, PICS is the point-of-collection notice. Best practice: PPS reviewed annually + after significant change, version-controlled with effective date, available in multiple languages (English + Traditional Chinese + Simplified Chinese for HK + PRC market), accessibility AA. HK PDPO DPP5 + PPS + transparency + accessibility + bilingual applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.