PDPO Compliance
REQUIRED
Personal Data (Privacy) Ordinance governs personal data handling. Lighter than GDPR. Appoint a Privacy Compliance Officer and implement a privacy notice.
Regional Deep Dive/APAC
Tax & Regulatory // Hong Kong
Entity type: Private Company Limited by Shares
Core Compliance
Profits Tax
8.25–16.5%
Two-tiered: 8.25% on first HK$2M profit, 16.5% above. No capital gains tax.
VAT / GST
0%
No VAT or GST. One of HK's most significant commercial advantages.
Salaries Tax
Max 15%
Employee income tax capped at 15% — employer and employee tax burden is low.
Regulatory Vectors
watch
SFC Licensing (if fintech)
CONDITIONAL
Securities and Futures Commission licensing is required for any investment, fund management, or securities-related activities. Rigorous process.
Entity Setup
1–5 days
HK company incorporation via Companies Registry. Requires a local registered address and company secretary.
Data Residency
NOT MANDATED
No data localisation requirement. HK is a free port for data flows. Mainland China segregation is commercially important but not legally mandated from HK's side.
Key Legislation
Personal Data (Privacy) Ordinance (PDPO)
Data protection obligations for organisations handling personal data.
Securities and Futures Ordinance (SFO)
Governs regulated financial activities in HK.
Cybersecurity Law (HK reference)
No standalone HK cybersecurity law — exposure is through PDPO and sector-specific regulations.
Entry Recommendation
HK is one of the most business-friendly jurisdictions globally. No VAT, low profit tax, and fast incorporation. Primary complexity is for FSI-adjacent products requiring SFC licensing.
Regulatory Flashpoints — Evidence Base
Primary regulatory flashpoint
confidence 40PDPO rules on data use and direct marketing consent.
Needs human review