Hong Kong Recording Laws: Privacy Rules and Penalties (2026)

The Statutory Gap: No Ban on Private Recording

Hong Kong sits in unusual legal territory. Unlike jurisdictions such as the United States or Australia, where federal and state wiretapping laws spell out exactly who can record what, Hong Kong has no statute that directly addresses whether a private citizen can record a conversation.

The closest thing to a wiretapping law is the Interception of Communications and Surveillance Ordinance (ICSO, Cap. 589), enacted in 2006. But the ICSO was built for a narrow purpose: regulating how law enforcement agencies conduct interception of communications and covert surveillance. It does not extend to private individuals or corporations.

As the law firm Bowers Law noted in its analysis of Hong Kong recording law, "there is no express law or regulation governing or prohibiting covert recordings by private individuals or corporations." That gap has left the legal status of everyday recording governed by a patchwork of privacy legislation, constitutional protections, and case-by-case judicial discretion.

Eric Cheung Tat-ming, a principal law lecturer at the University of Hong Kong, put it bluntly during a 2015 controversy over a leaked audio recording at HKU: "Recording what people say is not a criminal offence." His statement, reported by the South China Morning Post, reflected the consensus among Hong Kong legal practitioners at the time, and the legal landscape has not changed materially since.

How the ICSO (Cap. 589) Actually Works

The ICSO provides a statutory framework for the authorization and regulation of interception of communications and covert surveillance conducted by law enforcement agencies (LEAs) in Hong Kong. Its scope is limited to activities carried out "by or on behalf of public officers" in the course of preventing or detecting serious crime or protecting public security.

Who It Covers

Only designated law enforcement agencies fall under the ICSO. Before conducting any interception or covert surveillance, these agencies must obtain authorization from a panel judge or, in urgent cases, from a designated authority. An independent Commissioner on Interception of Communications and Surveillance, appointed by the Chief Executive on the recommendation of the Chief Justice, oversees the entire process.

Who It Does Not Cover

The ICSO does not regulate, restrict, or even mention recording by private individuals, employees, journalists, or businesses. If you pull out your phone and record a conversation you are part of, the ICSO simply does not apply to you.

Penalties Under the ICSO

For law enforcement officers who conduct unauthorized interception, the ICSO creates criminal liability. Public officers who carry out intercepting acts or covert surveillance without proper authorization face prosecution. The Secretary for Security has issued a code of practice governing the conduct of officers under the Ordinance. However, because the ICSO targets government actors, its penalty provisions have no bearing on private recording.

The Personal Data (Privacy) Ordinance (Cap. 486)

While the ICSO ignores private recording, the Personal Data (Privacy) Ordinance (PDPO, Cap. 486) can apply depending on what a recording captures.

The PDPO, enacted in 1995 and substantially amended in 2012, is Hong Kong's primary data protection law. It defines "personal data" as information relating to a living individual from which the identity of the individual can be directly or indirectly ascertained, and which exists in a form that allows practical access and processing.

An audio recording of a conversation can qualify as personal data if it captures identifiable information about the speakers. When it does, the person making the recording becomes a "data user" under the PDPO and must comply with the six Data Protection Principles (DPPs).

The Six Data Protection Principles

DPP1, Purpose and Manner of Collection: Personal data must be collected for a lawful purpose directly related to a function or activity of the data user. The collection method must be fair in the circumstances, and data subjects must be informed of the purpose and the classes of persons to whom the data may be transferred.

DPP2, Accuracy and Retention: Data must be kept accurate and should not be retained longer than necessary for the purpose for which it was collected.

DPP3, Use of Data: Personal data cannot be used for a new purpose unrelated to the original collection purpose without the data subject's express consent.

DPP4, Data Security: The data user must take practicable steps to protect the data against unauthorized or accidental access, processing, erasure, loss, or use.

DPP5, Openness and Transparency: Data users must make available their policies and practices regarding personal data, including the kinds of data held and the main purposes for holding it.

DPP6, Access and Correction: Individuals have the right to request access to and correction of their personal data.

How This Applies to Recording

If you record a conversation and the recording contains personal data, DPP1 requires that you had a lawful purpose for collecting it and that your collection method was fair. Recording someone without telling them raises questions about "fairness" under DPP1, though the PDPO does not explicitly ban covert recording.

The Privacy Commissioner for Personal Data (PCPD) has not issued a blanket prohibition on covert recording by individuals. Instead, the PCPD evaluates complaints on a case-by-case basis, weighing factors like the recorder's purpose, the context, and whether the recording was proportionate.

PDPO Penalties

Breaching the Data Protection Principles alone is not a criminal offence. However, if the PCPD investigates a complaint and issues an enforcement notice directing a data user to remedy a contravention, failure to comply with that enforcement notice is a criminal offence carrying:

• First conviction: A maximum fine of HK$50,000 and imprisonment for up to two years, plus HK$1,000 per day if the offence continues.
• Subsequent conviction: A maximum fine of HK$100,000 and imprisonment for up to two years, plus HK$2,000 per day if the offence continues.

For violations involving the misuse of personal data in direct marketing, penalties reach up to HK$1,000,000 and five years' imprisonment.

Article 30 of the Basic Law

Hong Kong's constitutional framework adds another layer. Article 30 of the Basic Law states:

"The freedom and privacy of communication of Hong Kong residents shall be protected by law. No department or individual may, on any grounds, infringe upon the freedom and privacy of communication of residents except that the relevant authorities may inspect communication in accordance with legal procedures to meet the needs of public security or of investigation into criminal offences."

This provision protects the privacy of communication as a fundamental right. A person whose conversation is covertly recorded could argue that the recording infringes their Article 30 rights. However, this right is not absolute. The courts have not used Article 30 to create a blanket prohibition on private recording, and the provision primarily addresses government intrusion into private communication.

In practice, Article 30 provides a constitutional foundation for the ICSO's restrictions on law enforcement surveillance rather than a direct cause of action for individuals recorded without their knowledge.

Phone Calls vs. In-Person Conversations

Hong Kong law does not distinguish between recording a phone call and recording an in-person conversation. The same legal framework applies to both scenarios.

Phone Calls

Because the ICSO only regulates law enforcement, there is no statutory prohibition on a private individual recording their own phone call. The PDPO may apply if the call captures personal data, but there is no "one-party consent" or "two-party consent" rule comparable to those found in American or Canadian law.

In-Person Conversations

The same analysis holds for face-to-face conversations. No statute requires you to inform the other party that you are recording. The PDPO's fairness requirement under DPP1 is the main legal consideration, and the PCPD has not declared covert in-person recording to be per se unfair.

The practical effect is that Hong Kong operates closer to a one-party consent model by default, though not because any law expressly establishes that framework. The gap in legislation simply means no law forbids it.

Admissibility of Recordings in Court

The absence of a recording ban does not mean recordings automatically become powerful courtroom evidence. Hong Kong courts apply nuanced rules about admissibility.

Consensual Recordings

When all parties to a conversation know it is being recorded, the audio recording is "generally admissible into evidence in legal proceedings by mutual agreement" and courts treat such recordings as credible and persuasive, according to the analysis in Bowers Law.

Covert Recordings

When only the person making the recording knows about it, the situation changes. Such recordings "should still be admissible into evidence in legal proceedings, but the evidential value of any such recording is significantly diminished and should be treated with caution."

The landmark case HKSAR v Li Man-tak & Another established that "evidence obtained in breach of the right of privacy is not inadmissible per se." Courts retain discretion to admit covert recordings, weighing factors including the evidential value of the recording, any prejudicial effects, and the motives of the person who made the recording.

In a 2017 government response to a Legislative Council question on the topic, the government confirmed that in criminal trials, "covert recordings are not absolutely inadmissible as evidence" and that courts consider the circumstances on a case-by-case basis.

Section 161 of the Crimes Ordinance: The Smartphone Wrinkle

One legal provision that occasionally surfaces in recording disputes is Section 161 of the Crimes Ordinance (Cap. 200), which criminalizes obtaining access to a computer with criminal or dishonest intent. Since smartphones qualify as "computers" under the statute, prosecutors historically attempted to use Section 161 against people who used their phones for illicit recording.

However, the Court of Final Appeal shut this door in a landmark 2019 ruling. The court held that Section 161(1)(c) "does not apply to the use by a person of his own computer." In other words, using your own smartphone to record something cannot constitute the offence of unauthorized computer access, because you are not accessing someone else's computer.

This ruling significantly narrowed the scope of Section 161 and effectively eliminated one of the few criminal provisions that had been used against private recording.

The 2021 Voyeurism Amendments

The Crimes (Amendment) Ordinance 2021, which took effect on October 8, 2021, introduced four new offences that are relevant to certain types of recording:

1. Voyeurism: Peeping or clandestine photography in circumstances that give rise to a reasonable expectation of privacy.
2. Unlawful recording of intimate parts: Targeting activities like upskirting and down-blousing photography.
3. Publication of images from voyeurism: Sharing images obtained through the first two offences.
4. Non-consensual publication of intimate images: Covering so-called revenge porn scenarios.

All four offences carry a maximum penalty of five years' imprisonment. Courts can also order the removal, deletion, or destruction of intimate images.

These provisions specifically address recording or photographing people in intimate or private circumstances. They do not apply to recording conversations or general-purpose audio recording.

Workplace Recording and Employer Surveillance

Workplace recording is one area where the PDPO's requirements carry real weight. The PCPD published [Privacy Guidelines: Monitoring and Personal Data Privacy at Work](https://www.pcpd.org.hk/english/publications/files/monguide_e.pdf) in December 2004, setting out practical guidance for employers.

Key Requirements for Employers

Under the PDPO's Data Protection Principles, employers who conduct workplace surveillance must:

• Have a lawful purpose directly related to their business function (DPP1).
• Inform employees in writing about what monitoring devices are in use, what data is being collected, and the purposes of collection.
• Limit collection to the minimum necessary for the stated purpose.
• Ensure fairness in how monitoring is conducted.

Surveillance in visible, accessible workspaces where conversations and actions are naturally exposed is generally permissible under the PDPO, provided it is conducted transparently and for legitimate purposes.

Employees Recording at Work

For employees who covertly record workplace conversations, the legal analysis from Tanner De Witt notes that there has been "little development in this area in Hong Kong." Courts and tribunals in Hong Kong have wide discretion in admitting covert workplace recordings as evidence.

UK case law, particularly the Phoenix House Ltd. v Stockman decision, has been cited as potentially influential in Hong Kong. That case established that covert recording by an employee does not automatically constitute gross misconduct, especially when "pressing circumstances" such as discrimination or harassment justify the recording. Factors that matter include:

• The purpose of the recording (self-protection vs. entrapment)
• Whether the employee knew of a policy prohibiting recording
• The subject matter of the recording (confidential business information vs. personal grievance)
• The employer's own disciplinary policies

Employers are advised to establish clear recording policies and communicate them to staff.

Recording in Public Places

Filming and photography in public places is generally permitted in Hong Kong. If you are standing on a public street, you can photograph or record what is happening around you. However, several restrictions apply:

• Government premises: Photography and recording may require permission in law courts, government buildings, libraries, civic centres, and some museums.
• Places of public entertainment: Recording in cinemas and indoor theaters is prohibited.
• Prohibited places under national security legislation: In 2025, subsidiary legislation designated six premises belonging to Beijing's national security office as "prohibited places." Photographing these sites is not automatically illegal, but disobeying a law enforcement officer's order to stop recording can lead to prosecution.

For audio recording in public, the same general principle applies: no law prohibits it, but the PDPO may be triggered if you are systematically collecting personal data about identifiable individuals.

Business Compliance and Best Practices

Organizations operating in Hong Kong should take a proactive approach to recording compliance, even though the law does not impose a blanket ban. The PCPD's guidelines and the PDPO's Data Protection Principles create practical obligations.

For Businesses That Record Calls or Meetings

• Post clear notices informing people that recording is taking place, including the purpose.
• Limit retention of recorded material to the minimum period necessary.
• Secure recordings against unauthorized access (DPP4).
• Establish a data access policy so individuals can request access to recordings containing their personal data (DPP6).
• Document your lawful purpose for collecting the recording in the first place (DPP1).

For Individuals

• There is no legal requirement to obtain consent before recording a conversation you are part of, but informing the other party is considered best practice by the PCPD.
• If you plan to use a recording as evidence in legal proceedings, be aware that covert recordings carry reduced evidential weight.
• The 2021 voyeurism amendments create serious criminal liability for recording intimate images without consent. These provisions are strictly enforced.