Data Governance in Hong Kong
The goal of data governance is to create a framework for managing your data so that it supports your business goals. This involves understanding your data, establishing policies and identifying roles and responsibilities. A data governance program involves a lot of people—employees, customers and partners. Many will have opinions, and some of them may be passionate. As you develop your program, it’s important to organize this crowd so that everyone understands their role and responsibilities. One way to do this is to use a responsibility assignment matrix, such as the RACI model (responsible, accountable, consult and informed). This will ensure that the right people have input into your policy development and that they know who to contact when they have a question.
Hong Kong is home to a thriving and diverse industry ecosystem that includes a dense concentration of enterprises, networks and IT providers. Equinix’s data centers in this metro offer direct connectivity to this ecosystem and a variety of interconnection options that provide businesses the flexibility they need to scale their operations across Asia.
Whether or not Hong Kong’s laws change to match the GDPR definition of personal data, it is likely that the government will continue to focus on improving the PDPO. For example, a discussion paper published earlier this year explored the possibility of changing the current definition of personal data to include information that is ‘identifiable’ as well as ‘personal’. This would make it harder for companies to avoid having their activities classified as personal data.
Regardless of whether or not the definition of personal data changes, it is important for companies to understand their obligations under the PDPO. To do so, they should conduct a privacy impact assessment whenever they intend to transfer data to another jurisdiction. This should cover the legal environment, laws and practices in both the exporting and importing country. It should also take into account any other implications that could arise from the transfer of data.