Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Privacy Commissioner for Personal Data (PCPD), Hongkong – 0 % · 1 case
What for?
by area of lawAll areas of law
Who?
by company- Anonymised companies – 0 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2024 | 1 | – |
| 2025 | 0 | – |
| 2026 | 0 | – |
1 case
2 Apr 2024 a Hong Kong state-owned technology park companyRansomware at technology park company: PCPD finds breaches and serves enforcement notice Order
After a ransomware attack in August 2023 on the technology park company, which is wholly owned by the Hong Kong government, data of 13,632 individuals were affected; data samples appeared on the dark web. On 2 April 2024 the PCPD (Privacy Commissioner for Personal Data, Hong Kong's data protection authority) found breaches of the data security duty (DPP 4(1)) and the retention limit (DPP 2(2)): brute-force attacks went undetected, remote access ran without multi-factor authentication, security audits were insufficient, the security policy lacked specificity, and data of 5,292 unsuccessful job applicants and former employees had been kept beyond the retention period. By enforcement notice, the company must among other things introduce multi-factor authentication, commission independent security audits every year and delete data held beyond the retention periods.
Multi-factor authentication for remote access and consistent deletion once retention periods expire limit both the damage and the liability in a cyberattack.
Ransomware, multi-factor authentication for remote access and retention periods
- Authority / court
- Privacy Commissioner for Personal Data (PCPD), Hongkong
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Personal Data (Privacy) Ordinance (Cap. 486), Data Protection Principles 4(1) und 2(2); Enforcement Notice nach s. 50(1)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Public sector
- Published
- 2 Apr 2024
Checked against the official source on 7 Oct 2026 · Company name anonymised since 2 Apr 2026 · Direct link