Hong Kong Data Privacy
The Hong Kong Personal Data (Privacy) Ordinance (“PDPO”) regulates the collection, use and processing of personal data collected from individuals in Hong Kong. The Office of the Privacy Commission for Personal Data, Hong Kong (“PCPD”) oversees the execution and enforcement of the PDPO. In addition to the PDPO, the PCPD issues an information leaflet (“Cloud Computing Leaflet”) which aims to advise organizations on the factors they shall take into account in considering engaging cloud computing.
The main requirements for handling personal data are set out in the data protection principles (“DPPs”) of the PDPO. According to the DPPs, if a data user engages a data processor, whether within or outside Hong Kong, to process personal data on the data user’s behalf, the data user must adopt contractual or other means (i) to prevent any personal data transferred to the data processor from being kept longer than is necessary for processing of the data, and (ii) to prevent unauthorized or accidental access, processing, erasure, loss or use of the data transferred to the data processor for processing. The DPPs also require that personal data must be used for the purpose for which the data is collected or for a directly related purpose, unless voluntary and explicit consent with a new purpose is obtained from the data subject.
The PDPO does not restrict the transfer of personal data outside of Hong Kong. The Cloud Computing leaflet recommends that data users should know the locations/jurisdictions where the personal data will be stored and should ensure that such data is treated with a similar level of protection as if it resides in Hong Kong, and data subjects should be made aware of the transborder arrangement with regard to how their personal data is protected.
Both the PDPO and the Cloud Computing Leaflet make it clear that data users are required to protect and prevent the misuse of personal data entrusted to them by data subjects regardless of whether such personal data is stored within the data user’s premises, or is outsourced to cloud providers. As AWS does not have visibility into or knowledge of what customers are uploading onto its network, including whether or not that data is deemed subject to the PDPO, customers are ultimately responsible for their own compliance with the PDPO.
AWS is vigilant about your privacy and data security. Security at AWS starts with our core infrastructure. Custom-built for the cloud and designed to meet the most stringent security requirements in the world, our infrastructure is monitored 24x7 to ensure the confidentiality, integrity, and availability of our customer's data. The same world-class security experts who monitor this infrastructure also build and maintain our broad selection of innovative security services, which can help you simplify meeting your own security and regulatory requirements. As an AWS customer, regardless of your size or location, you inherit all the benefits of our experience, tested against the strictest of third-party assurance frameworks.
AWS implements and maintains technical and organizational security measures applicable to AWS cloud infrastructure services under globally recognized security assurance frameworks and certifications, including ISO 27001, ISO 27017, ISO 27018, PCI DSS Level 1, and SOC 1, 2 and 3. These technical and organizational security measures are validated by independent third-party assessors, and are designed to prevent unauthorized access to or disclosure of customer content.
For example, ISO 27018 is the first International code of practice that focuses on protection of personal data in the cloud. It is based on ISO information security standard 27002 and provides implementation guidance on ISO 27002 controls applicable to Personally Identifiable Information (PII) processed by public cloud service providers. This demonstrates to customers that AWS has a system of controls in place that specifically address the privacy protection of their content.
These comprehensive AWS technical and organizational measures are consistent with the goals of the PDPO to protect personal data. Customers using AWS services maintain control over their content and are responsible for implementing additional security measures based on their specific needs, including content classification, encryption, access management and security credentials.
The content on this page supplements the existing Data Privacy resources to help you align your requirements with the AWS Shared Responsibility Model when you process personal data in international data centers.
What is the customer’s role in securing their content?
Under the AWS Shared Responsibility Model, AWS customers retain control of what security they choose to implement to protect their own content, platform, applications, systems and networks, no differently than they would for applications in an on-site data center. Customers can build on the technical and organizational security measures and controls offered by AWS to manage their own compliance requirements. Customers can use familiar measures to protect their data, such as encryption and multi-factor authentication, in addition to AWS security features like AWS Identity and Access Management.
When evaluating the security of a cloud solution, it is important for customers to understand and distinguish between:
- Security measures that AWS implements and operates - "security of the cloud", and
- Security measures that customers implement and operate, related to the security of their customer content and applications that make use of AWS services - "security in the cloud"
Who can access customer content?
Customers maintain ownership and control of their customer content and select which AWS services process, store and host their customer content. AWS does not have visibility into customer content and does not access or use customer content except to provide the AWS services selected by a customer or where required to comply with the law or a binding legal order.
Customers using AWS services maintain control over their content within the AWS environment. They can:
- Determine where it will be located, for example the type of storage environment and geographic location of that storage.
- Control the format of that content, for example plain text, masked, anonymized or encrypted, using either AWS provided encryption or a third-party encryption mechanism of the customer’s choice.
- Manage other access controls, such as identity access management and security credentials.
- Control whether to use SSL, Virtual Private Cloud and other network security measures to prevent unauthorized access.
This allows AWS customers to control the entire life-cycle of their content on AWS and manage their content in accordance with their own specific needs, including content classification, access control, retention and deletion.
Where will customer content be stored?
AWS data centers are built in clusters in various locations around the world. We refer to each of our data center clusters in a given location as a "Region." Customers have access to 18 AWS Regions around the globe.
AWS customers choose the AWS Region(s) where their content will be stored. This allows customers with specific geographic requirements to establish environments in the location(s) of their choice. For example, AWS customers can choose to deploy their AWS services exclusively in one of the Regions in the EU (France, Germany, the UK, or Ireland). If the customer elects to do so, their content will be stored in the AWS Region they choose, unless the customer explicitly selects to move or replicate their content in a different AWS Region.
Customers can replicate and back up content in more than one Region, but AWS does not move customer content outside of the customer’s chosen Region(s), except to provide services as requested by customers or comply with applicable law.
How does AWS secure its data centers?
The AWS data center security strategy is assembled with scalable security controls and multiple layers of defense that help to protect your information. For example, AWS carefully manages potential flood and seismic activity risks. We use physical barriers, security guards, threat detection technology, and an in-depth screening process to limit access to data centers. We back up our systems, regularly test equipment and processes, and continuously train AWS employees to be ready for the unexpected.
To validate the security of our data centers, external auditors perform testing on more than 2,600 standards and requirements throughout the year. Such independent examination helps ensure that security standards are consistently being met or exceeded. As a result, the most highly regulated organizations in the world trust AWS to protect their data.
Learn more about how we secure AWS data centers by design by taking a virtual tour »
Which AWS Regions can I use?
What security measures does AWS have in place to protect systems?
The AWS Cloud infrastructure has been architected to be one of the most flexible and secure cloud computing environments available today. Amazon's scale allows significantly more investment in security policing and countermeasures than almost any large company could afford on its own. This infrastructure is comprised of the hardware, software, networking, and facilities that run AWS services, which provide powerful controls to customers and APN Partners, including security configuration controls, for the handling of personal data. More details on the measures AWS puts in place to maintain consistently high levels of security can be found in the AWS Overview of Security Processes Whitepaper.
AWS also provides several compliance reports from third-party auditors who have tested and verified our compliance with a variety of security standards and regulations - including ISO 27001, ISO 27017, and ISO 27018. To provide transparency on the effectiveness of these measures, we provide access to the third party audit reports in AWS Artifact. These reports show our customers and APN Partners, who may act as either data controllers or data processors, that we are protecting the underlying infrastructure upon which they store and process personal data. For more information, visit our Compliance Resources.