Company: GDHLF
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001410578-25-000935
Chunk: 219

Company: GDS Holdings Ltd
Filing Date: 2025-04-28
Form: 20-F
Item: Item 4
Chunk 219
---
, permissible deductions for outgoings and expenses, set-offs for losses and allowances for depreciation.

Laws and Regulations relating to Protection of Personal Data

The Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong), or the PDPO, imposes a statutory duty on data users to comply with the requirements of the six data protection principles, or the Data Protection Principles, contained in Schedule 1 to the PDPO. The PDPO provides that a data user shall not do an act, or engage in a practice, that contravenes a Data Protection Principle unless the act or practice, as the case may be, is required or permitted under the PDPO.

The six Data Protection Principles are:

  Principle 1 – purpose and manner of collection of personal data;  

  Principle 2 – accuracy and duration of retention of personal data;  

Table of Contents

  Principle 3 – use of personal data;  

  Principle 4 – security of personal data;  

  Principle 5 – information to be generally available; and  

  Principle 6 – access to personal data.  

Non-compliance with a Data Protection Principle may lead to a complaint to the Privacy Commissioner for Personal Data, or the Privacy Commissioner. The Privacy Commissioner may serve an enforcement notice to direct the data user to remedy the contravention and/or instigate prosecution actions. A data user who contravenes an enforcement notice commits an offense which may lead to a fine and imprisonment.

The PDPO also gives data subjects certain rights, inter alia:

  the right to be informed by a data user whether the data user holds personal data of which the individual is the data subject;  

  if the data user holds such data, to be supplied with a copy of such data; and  

  the right to request correction of any data they consider to be inaccurate.  

The PDPO criminalizes, including but not limited to, the misuse or inappropriate use of personal data in direct marketing activities, non-compliance with a data access request and the unauthorized disclosure of personal data obtained without the relevant data user’s consent. An individual who suffers damage, including injured feelings, by reason of a contravention of the PDPO in relation to his or her personal data may seek compensation from the data user concerned.

With respect to cross-border data transfer, the PDPO does not restrict the transfer of personal data outside of Hong Kong as at December 31, 2022 (while section 33 of the PDPO lists out certain restrictions on cross border