Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Privacy Commissioner for Personal Data (PCPD), Hongkong – 0 % · 7 cases
What for?
by topicWho?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 2 | – |
| 2023 | 2 | – |
| 2024 | 1 | – |
| 2025 | 1 | – |
| 2026 | 1 | – |
7 cases
23 Apr 2026 Yau Yat Chuen Garden City Club LimitedRansomware via remote maintenance access: enforcement notice against private club Order
In a ransomware attack on the membership management system of Yau Yat Chuen Garden City Club Limited, a private, non-profit recreational club, reported on 31 October 2025, data of 9,045 current and former members and supplementary card holders were affected, including identity card or passport numbers. The attacker exploited a known vulnerability in outdated remote access software of the external service provider and reached the server, which had been left logged in, without further authentication; antivirus software and firewall were outdated, and personal data had been kept longer than necessary. In its investigation report published on 23 April 2026 the PCPD (Privacy Commissioner for Personal Data, Hong Kong's data protection authority) found breaches of DPP 4(1) and DPP 2(2) and served an enforcement notice.
Service providers' remote maintenance access belongs in an organisation's own security concept: current software, additional authentication and no servers left permanently logged in.
Service providers' remote access, patch management and retention periods
- Authority / court
- Privacy Commissioner for Personal Data (PCPD), Hongkong
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Personal Data (Privacy) Ordinance, Data Protection Principles 4(1) und 2(2); Enforcement Notice
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Other
- Published
- 23 Apr 2026
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
21 Aug 2025 Kwong's Art Jewellery Trading Company Limited, My Jewelry Management LimitedJewellery companies: data of around 79,400 people stolen – enforcement notices Order
At Kwong's Art Jewellery Trading Company Limited and its retail subsidiary My Jewelry Management Limited, which run their IT systems jointly, an attacker (reported in November 2024) obtained the credentials of an administrator account by brute force, exfiltrated the database and deleted it; around 79,400 individuals were affected, including customers and current and former employees. In its report published on 21 August 2025 the PCPD (Privacy Commissioner for Personal Data, Hong Kong's data protection authority) found breaches of DPP 4(1), among other things because the account of a departed employee had not been deleted in time, server operating systems were outdated and security policies and security assessments were lacking. Both companies were served enforcement notices to remedy the deficiencies and prevent further contraventions.
Delete the accounts of departing staff immediately, keep servers up to date and protect administrator access against brute-force attacks.
Access management for leavers, patch management and protection of administrator accounts
- Authority / court
- Privacy Commissioner for Personal Data (PCPD), Hongkong
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Personal Data (Privacy) Ordinance, Data Protection Principle 4(1); Enforcement Notices
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Published
- 21 Aug 2025
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
2 Apr 2024 a Hong Kong state-owned technology park companyRansomware at technology park company: PCPD finds breaches and serves enforcement notice Order
After a ransomware attack in August 2023 on the technology park company, which is wholly owned by the Hong Kong government, data of 13,632 individuals were affected; data samples appeared on the dark web. On 2 April 2024 the PCPD (Privacy Commissioner for Personal Data, Hong Kong's data protection authority) found breaches of the data security duty (DPP 4(1)) and the retention limit (DPP 2(2)): brute-force attacks went undetected, remote access ran without multi-factor authentication, security audits were insufficient, the security policy lacked specificity, and data of 5,292 unsuccessful job applicants and former employees had been kept beyond the retention period. By enforcement notice, the company must among other things introduce multi-factor authentication, commission independent security audits every year and delete data held beyond the retention periods.
Multi-factor authentication for remote access and consistent deletion once retention periods expire limit both the damage and the liability in a cyberattack.
Ransomware, multi-factor authentication for remote access and retention periods
- Authority / court
- Privacy Commissioner for Personal Data (PCPD), Hongkong
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Personal Data (Privacy) Ordinance (Cap. 486), Data Protection Principles 4(1) und 2(2); Enforcement Notice nach s. 50(1)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Public sector
- Published
- 2 Apr 2024
Checked against the official source on 7 Oct 2026 · Company name anonymised since 2 Apr 2026 · Direct link
Report an error
21 Dec 2023 an online marketplace (Hong Kong entity)PCPD: enforcement notice against online marketplace after scraping of user data Order
After data of 2.6 million of the marketplace's users worldwide, including 324,232 accounts in Hong Kong, had been offered for sale on an online forum, the PCPD found that the marketplace's Hong Kong entity had breached DPP 4(1). The cause was a vulnerability in an application programming interface introduced during a system migration in January 2022; there was no privacy impact assessment, no complete code review, no thorough security assessment, no written code review policy and no effective detection measures. The PCPD issued an enforcement notice even though the systems were run centrally by the group.
A local company remains responsible for data security even where the group runs the systems centrally; migrations need a prior impact assessment and security review.
Data protection and code review during system migrations
- Authority / court
- Privacy Commissioner for Personal Data (PCPD), Hongkong
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Data Protection Principle 4(1) Schedule 1 und Section 50(1) Personal Data (Privacy) Ordinance (Cap. 486)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Mitigating circumstances
- Prompt data breach notification to the PCPD and affected users, cooperation with the investigation, voluntary acknowledgement of its deficiencies, and technical and organisational measures taken by the group after the incident.
- Published
- 21 Dec 2023
Checked against the official source on 7 Oct 2026 · Company name anonymised since 21 Dec 2025 · Direct link
Report an error
21 Dec 2023 a luxury fashion company in Hong KongPCPD: enforcement notice against luxury fashion company over health data in chat groups Order
A supervisor at the luxury fashion company shared a photo of an employee's medical diagnosis certificate in a work chat group of around 14 members and forwarded the employee's sick note to another group of around 10 members. The PCPD regarded this as use of health data for a new purpose without express consent and thus a breach of DPP 3(1). It issued an enforcement notice requiring policies, their inclusion in training, staff awareness measures and regular monitoring.
Sick notes and diagnoses belong only with those who need them for HR decisions, not in team chats.
Handling employees' health data in messaging groups
Missing or inadequate training played a role in the decision.
- Authority / court
- Privacy Commissioner for Personal Data (PCPD), Hongkong
- Area of law
- Data protection · Employee data
- Legal basis
- Data Protection Principle 3(1) Schedule 1 Personal Data (Privacy) Ordinance (Cap. 486)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Published
- 21 Dec 2023
Checked against the official source on 7 Oct 2026 · Company name anonymised since 21 Dec 2025 · Direct link
Report an error
14 Nov 2022 a Hong Kong photo services chainPCPD: enforcement notice against photo services chain after attack on unpatched VPN flaw Order
Following a ransomware attack in October 2021 on the database of the photo services chain's online store, which affected 544,862 members and 73,957 online store customers, the PCPD found a breach of data security principle DPP 4(1). The company had known since September 2019 at the latest about a vulnerability in its firewall's SSL VPN announced in May 2019, but did not apply the fix and did not use multi-factor authentication for remote access. The PCPD issued an enforcement notice requiring a security review, regular reviews by an independent expert, vulnerability scans and patch management rules, with proof of completion due within three months.
Known vulnerabilities in remote access must be patched promptly, especially when working from home increases the number of users.
Patch management and multi-factor authentication for remote access
- Authority / court
- Privacy Commissioner for Personal Data (PCPD), Hongkong
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Data Protection Principle 4(1) Schedule 1 und Section 50(1) Personal Data (Privacy) Ordinance (Cap. 486)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Mitigating circumstances
- Timely data breach notification, cooperation with the PCPD and technical and organisational measures after the incident.
- Published
- 14 Nov 2022
Checked against the official source on 7 Oct 2026 · Company name anonymised since 14 Nov 2024 · Direct link
Report an error
14 Nov 2022 a Hong Kong listed healthcare groupHealthcare group shared client data across brands: enforcement notice Order
In an investigation report published on 14 November 2022, the Privacy Commissioner for Personal Data (PCPD, Hong Kong's data protection authority) found that the listed healthcare group, after acquiring two brands, had moved their clients' data into a group-wide system and made it accessible to staff of other brands; in the two underlying complaint cases the individuals concerned had neither been informed nor given their consent. The system was used by 28 of the group's 39 brands and held data on around 1.08 million members; the PCPD found a breach of the purpose limitation rule in DPP 3(1). By enforcement notice, the group must stop cross-brand sharing without consent, adopt policies for client data from acquisitions and train its staff.
In acquisitions, client data must not simply be merged into group systems – the original purpose of collection and consent must cover the sharing.
Purpose limitation and data sharing within a group after acquisitions
Missing or inadequate training played a role in the decision.
- Authority / court
- Privacy Commissioner for Personal Data (PCPD), Hongkong
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Personal Data (Privacy) Ordinance (Cap. 486), Schedule 1, Data Protection Principle 3(1); Enforcement Notice nach s. 50(1)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Healthcare
- Published
- 14 Nov 2022
Checked against the official source on 7 Oct 2026 · Company name anonymised since 14 Nov 2024 · Direct link