Data has become an economic factor that plays an integral part of production for digital goods and services in today’s digital economy. Just like an automaker can’t produce new models without sufficient financial backing, businesses require strong data governance practices and management systems in order to compete globally in today’s global marketplace.
Data analytics tools are an essential element of online businesses that operate online, as they provide useful insight into your target audience’s habits, such as what they search for or the length of time spent per page. With this knowledge in hand, marketers can develop more efficient marketing strategies for their company.
Establish a comprehensive policy regarding the collection and storage of personal data. This policy must outline its purpose and scope – how the collected information will be used, by whom and any restrictions due to law. Furthermore, this document should contain details on how individuals can request access and have such requests evaluated.
Under the PDPO, personal data refers to any information that can be associated with an individual, whether directly or indirectly. It also applies to legal entities like companies and organisations; whether any one fits this definition will depend on factors like legal activities undertaken and data collected by it.
Transferring personal data overseas must meet several requirements under the Personal Data Protection Ordinance, in addition to fulfilling Hong Kong’s six core data obligations. These measures include making sure data collected for lawful and reasonable purposes is not excessive in relation to its purpose, and providing a PICS in respect of personal data being transferred. Additionally, they must consider whether a PICS is necessary when using personal data in any other manner. Most data users can fulfill their obligations under the PDPO with regards to transfers by fulfilling both requirements. However, in some instances it may be necessary to look at alternative solutions; one such being using a legally-binding contract or another legal mechanism to transfer personal data overseas. As this would mean no PICS is needed and data transfer issues may not arise, this should not be considered the default approach; as always it’s wise to discuss all options with your DPO before making decisions based on these arrangements.