Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Privacy Commissioner for Personal Data (PCPD), Hongkong – 0 % · 3 cases
What for?
by area of lawAll areas of law
Who?
by company- Anonymised companies – 0 % · 2 cases
- Kwong's Art Jewellery Trading Company Limited, My Jewelry Management Limited – 0 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 1 | – |
| 2023 | 1 | – |
| 2024 | 0 | – |
| 2025 | 1 | – |
| 2026 | 0 | – |
3 cases
21 Aug 2025 Kwong's Art Jewellery Trading Company Limited, My Jewelry Management LimitedJewellery companies: data of around 79,400 people stolen – enforcement notices Order
At Kwong's Art Jewellery Trading Company Limited and its retail subsidiary My Jewelry Management Limited, which run their IT systems jointly, an attacker (reported in November 2024) obtained the credentials of an administrator account by brute force, exfiltrated the database and deleted it; around 79,400 individuals were affected, including customers and current and former employees. In its report published on 21 August 2025 the PCPD (Privacy Commissioner for Personal Data, Hong Kong's data protection authority) found breaches of DPP 4(1), among other things because the account of a departed employee had not been deleted in time, server operating systems were outdated and security policies and security assessments were lacking. Both companies were served enforcement notices to remedy the deficiencies and prevent further contraventions.
Delete the accounts of departing staff immediately, keep servers up to date and protect administrator access against brute-force attacks.
Access management for leavers, patch management and protection of administrator accounts
- Authority / court
- Privacy Commissioner for Personal Data (PCPD), Hongkong
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Personal Data (Privacy) Ordinance, Data Protection Principle 4(1); Enforcement Notices
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Published
- 21 Aug 2025
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
21 Dec 2023 a luxury fashion company in Hong KongPCPD: enforcement notice against luxury fashion company over health data in chat groups Order
A supervisor at the luxury fashion company shared a photo of an employee's medical diagnosis certificate in a work chat group of around 14 members and forwarded the employee's sick note to another group of around 10 members. The PCPD regarded this as use of health data for a new purpose without express consent and thus a breach of DPP 3(1). It issued an enforcement notice requiring policies, their inclusion in training, staff awareness measures and regular monitoring.
Sick notes and diagnoses belong only with those who need them for HR decisions, not in team chats.
Handling employees' health data in messaging groups
Missing or inadequate training played a role in the decision.
- Authority / court
- Privacy Commissioner for Personal Data (PCPD), Hongkong
- Area of law
- Data protection · Employee data
- Legal basis
- Data Protection Principle 3(1) Schedule 1 Personal Data (Privacy) Ordinance (Cap. 486)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Published
- 21 Dec 2023
Checked against the official source on 7 Oct 2026 · Company name anonymised since 21 Dec 2025 · Direct link
Report an error
14 Nov 2022 a Hong Kong photo services chainPCPD: enforcement notice against photo services chain after attack on unpatched VPN flaw Order
Following a ransomware attack in October 2021 on the database of the photo services chain's online store, which affected 544,862 members and 73,957 online store customers, the PCPD found a breach of data security principle DPP 4(1). The company had known since September 2019 at the latest about a vulnerability in its firewall's SSL VPN announced in May 2019, but did not apply the fix and did not use multi-factor authentication for remote access. The PCPD issued an enforcement notice requiring a security review, regular reviews by an independent expert, vulnerability scans and patch management rules, with proof of completion due within three months.
Known vulnerabilities in remote access must be patched promptly, especially when working from home increases the number of users.
Patch management and multi-factor authentication for remote access
- Authority / court
- Privacy Commissioner for Personal Data (PCPD), Hongkong
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Data Protection Principle 4(1) Schedule 1 und Section 50(1) Personal Data (Privacy) Ordinance (Cap. 486)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Mitigating circumstances
- Timely data breach notification, cooperation with the PCPD and technical and organisational measures after the incident.
- Published
- 14 Nov 2022
Checked against the official source on 7 Oct 2026 · Company name anonymised since 14 Nov 2024 · Direct link