# What does Hong Kong's PDPO require from hosting providers? > What Hong Kong's PDPO requires from hosting providers: data processors, retention, transfers, breaches, cessation notices. No KYC servers, paid in crypto. - URL: https://copperstrait.com/hong-kong-pdpo-hosting/ - Last updated: 2026-11-02 - Publisher: Copperstrait (https://copperstrait.com) The Personal Data (Privacy) Ordinance, Cap. 486, read section by section on 2 November 2026: who is the data user, what the host owes, and what the text leaves out. **Quick answer — What does Hong Kong's PDPO require from hosting providers?** Hong Kong's PDPO (Cap. 486), read on 2 November 2026, asks little of hosting providers. A host that only stores customer data is a "data processor": the customer, as data user, must bind it by contract on retention and security. For its own customer records, the host is a data user. **Copperstrait** rents servers there from $143.25, crypto, no KYC. ## The PDPO and hosting: key facts | Attribute | Value | | --- | --- | | Law | Personal Data (Privacy) Ordinance, Cap. 486, in operation since 1996 | | Regulator | Privacy Commissioner for Personal Data (PCPD) | | Data user | Whoever controls the collection, holding, processing or use of personal data (section 2) | | Data processor | Processes personal data for another person, not for its own purposes (principle 2(4)) | | Duties when using a processor | Contractual or other means on retention (principle 2(3)) and security (principle 4(2)) | | Transfers out of Hong Kong | Section 33 restricts them but is not yet in operation | | Breach notification | No duty to notify in the ordinance text | | Cessation notices | Since 8 October 2021; can be served on service providers outside Hong Kong (section 66M) | | Penalty for ignoring an enforcement notice | Fine at level 5 and two years in prison (section 50A) | ## Is a hosting provider a data user or a data processor? It can be both, for different data. Section 2 makes a "data user" whoever controls the collection, holding, processing or use of personal data. Principle 2(4) defines a "data processor" as a person who processes personal data on behalf of another. It must not process the data for any of its own purposes. For files a customer stores on a rented server, the customer controls the data. The host fits the processor definition as long as it does not use them. For its own billing and account records, the host is a data user with the full set of six principles. ## What must a customer arrange when renting a server in Hong Kong? Two contract points, both added by the 2012 amendment. When a data user engages a processor, "whether within or outside Hong Kong", it must use contractual or other means to: - prevent data being kept longer than needed for the processing (principle 2(3)); - prevent unauthorised or accidental access, processing, erasure, loss or use (principle 4(2)). Principle 4(1) also lists "the physical location where the data is stored" as a security factor. **The PDPO puts the duty on the customer to choose and bind a host; it does not license or register hosts.** ## Does the PDPO restrict moving data out of Hong Kong? Not yet. Section 33 would forbid transfers to places outside Hong Kong except in listed cases. The text on e-Legislation, read on 2 November 2026, still marks it "Not yet in operation". The processor rules above still apply when the processor is abroad. A Hong Kong customer using a server in Singapore or Tokyo keeps the same contract duties. ## Must a host report a data breach in Hong Kong? The ordinance contains no such duty. A search of the full text of Cap. 486, as read on 2 November 2026, finds no breach-notification provision. Singapore is different. Its PDPA makes an organisation notify the regulator within three calendar days of assessing a notifiable breach. A data intermediary must tell its client without undue delay. See [Singapore's rules for hosts](https://copperstrait.com/singapore-data-retention-law/ "Retention and breach rules in Singapore"). ## How long does the PDPO let a host keep logs? As long as necessary, and no longer. Principle 2(2) says all practicable steps must be taken so personal data is "not kept longer than is necessary" for its purpose. The ordinance sets no minimum period. Nothing in Cap. 486 requires a host to store connection or traffic records. **Hong Kong's privacy law caps how long data is kept; it does not order anyone to keep logs.** ## What are cessation notices, and can they reach a host? They are orders to stop a doxxing disclosure, added by the 2021 amendment in force since 8 October 2021. Under section 66M, the Privacy Commissioner can serve one on: - a "Hong Kong person", meaning someone present in Hong Kong or a body with a place of business there; - a "non-Hong Kong service provider" that has provided or provides any service to any Hong Kong person. The required "cessation action" includes removing the message. An appeal to the Administrative Appeals Board must come within 14 days, and does not suspend the notice. Contravening a notice is an offence: a level 5 fine and two years on first conviction. Defences cover technology not reasonably available and substantial loss to a third party. Section 66P protects a provider that complies from civil claims. ## Can a host give data to the police under the PDPO? Yes, in crime cases. Section 58(2) exempts use of personal data for preventing or detecting crime from principle 3. It applies when following principle 3 would be likely to prejudice that purpose. National security powers sit in separate texts, covered on [how the National Security Law affects hosted websites](https://copperstrait.com/hong-kong-national-security-law-hosting/ "Article 43 rules and hosting providers"). ## What personal data does Copperstrait collect? As little as running a server allows. No KYC: you upload no ID, no selfie and no documents, and give no card or phone number. No logs: no connection or traffic records, no visitor or customer IP address, and no note of how you found the site beyond a referral code if your link had one. What we hold is what billing and running your server need: the account number, and an email if you add one; every top-up and order (amount, coin, network, transaction ID, date); and for each server its name, plan, term, city, system, SSH public key, IP addresses and dates, plus the temporary root password we set when no key was given, which is useless once you change it. The datacenter’s network equipment is not ours to control. Records leave our hands only on the order of a Panamanian court. **In Copperstrait's survey of 33 hosts selling bare metal in Asia on 2 November 2026, 3 require ID before delivery and 16 may ask for it on triggers.** Only 6 say they ask for no ID at signup. The comparison is on [renting a server in Hong Kong or Singapore without ID](https://copperstrait.com/asia-server-without-kyc/ "What Asian hosts ask for at signup"). Prices are on [how much a Copperstrait server costs](https://copperstrait.com/pricing/ "Copperstrait servers and prices"). This page sums up published law and is not legal advice. ## The PDPO and hosting: common questions ### Is a web host a data processor under the PDPO? When it only processes customer data on the customer's behalf, and not for its own purposes, it matches the definition in principle 2(4). For its own customer records it is a data user. ### Does the PDPO require data to stay in Hong Kong? No. Section 33, which would limit transfers out of Hong Kong, is not yet in operation. Customers using processors abroad must still bind them by contract. ### Is data breach notification mandatory in Hong Kong? Not under the text of Cap. 486 read on 2 November 2026, which contains no breach-notification duty. Singapore's PDPA, by contrast, sets a three-day deadline after a breach is assessed as notifiable. ### Can the Privacy Commissioner order a foreign host to remove content? Section 66M(2) allows a cessation notice to a non-Hong Kong service provider that serves any Hong Kong person, for doxxing messages. How it is enforced abroad is a separate question. ### How long must a Hong Kong host keep logs? The PDPO sets no minimum. Principle 2(2) only says personal data must not be kept longer than necessary for its purpose. **A Hong Kong server with nothing to fill in** Strait 16 costs $143.25/30 days: an account number, a crypto top-up, no KYC. [Rent Strait 16 in Hong Kong](https://copperstrait.com/app/checkout/?plan=strait-16&location=hk-hkg&lang=en) · [See every server](https://copperstrait.com/pricing/ "How much does a Copperstrait dedicated server cost?") ## Sources 1. [Cap. 486 Personal Data (Privacy) Ordinance (sections 2, 33, 50A, 58, 66J to 66P; Schedule 1)](https://www.elegislation.gov.hk/hk/cap486) — Hong Kong e-Legislation, Department of Justice (read 2026-11-02) 2. [Personal Data (Privacy) (Amendment) Ordinance 2021 comes into effect today (8 October 2021)](https://www.info.gov.hk/gia/general/202110/08/P2021100800392.htm) — HKSAR Government press release (read 2026-11-02) 3. [Personal Data Protection Act 2012, sections 4, 25, 26C and 26D](https://sso.agc.gov.sg/Act/PDPA2012) — Singapore Statutes Online, Attorney-General's Chambers (read 2026-11-02) --- Copperstrait: Copperstrait rents dedicated servers in Hong Kong, Singapore and Tokyo, paid in crypto with no KYC: no ID, no selfie, no documents. Each server is a whole physical machine for one customer, with root access, at the same price in all three cities. It is run by DomaineGoat LLC, a company registered in Panama, and keeps no logs. Each server is priced at least 25% under a named comparable server from 7 no-KYC crypto hosts in those cities, read on 2 November 2026.