Skip to main content

​
Hong Kong PCPD + OFCA Sender Rules

Hong Kong regulates commercial messaging through two regimes that sit side by side: the Personal Data (Privacy) Ordinance (PDPO, Cap. 486), whose Part 6A governs direct marketing that uses personal data and is enforced by the Privacy Commissioner for Personal Data (PCPD), and the Unsolicited Electronic Messages Ordinance (UEMO, Cap. 593), whose sender-identification and unsubscribe duties the Office of the Communications Authority (OFCA) administers. At the SMS layer, OFCA additionally runs the SMS Sender Registration Scheme — the sender-verification convention under which Hong Kong carriers accept the alphanumeric sender IDs your +852 traffic uses. Hong Kong is a tenant-owned burden. Orbit keeps the country-rules reference that feeds the send-time gates, the consent ledger, the suppression layer, and the opt-out keyword rules. The legal posture — the Part 6A notice you give, the consent you record, the unsubscribe window you honour, the hours you keep — is yours.
This page is documentation, not legal advice. The PCPD enforces the PDPO’s direct-marketing provisions against the data user, and OFCA enforces the UEMO against the sender. Have counsel review your consent capture, your unsubscribe handling, and your sender-name choice; Orbit supplies the surfaces.

​
Two regimes — PDPO Part 6A and UEMO

The two ordinances stack: a compliant HK send is identified (UEMO), unsubscribable (UEMO), and sent on a recorded Part 6A footing (PDPO). Satisfying one regime does not satisfy the other. Part 6A in plain terms:
  • Own-use direct marketing is opt-out after first notice. Before you first use someone’s personal data to market your own goods or services you give a written notice of the intended use; the recipient may object, and an objection stops the marketing.
  • Providing data to a third party is opt-in. Supplying personal data to another organisation for that organisation’s direct marketing requires the person’s prior written consent.
  • UEMO adds the message-level duties. A commercial electronic message identifies its sender and carries a working unsubscribe facility, and an unsubscribe request must be honoured within 10 working days. UEMO’s statutory text is rooted in email and fax; for SMS the operative carrier-side mechanism is the sender registration scheme, and the unsubscribe convention carries across — a HK recipient expects the same stop path on a marketing text.
Official references: PDPO (Cap. 486), UEMO (Cap. 593), PCPD, OFCA.

​
The HK row — live country-rules lookup

Read the HK row of GET /api/v1/compliance/country-rules?channel=sms (see Country Compliance Requirements):
Registration levels change at the regulator — always read the live registration field for the HK row rather than relying on this page’s snapshot.

​
Sender-ID acceptance posture — alphanumeric via the aggregator

Hong Kong carriers accept SMS from sender IDs registered under OFCA’s SMS Sender Registration Scheme; the scheme is the sender-verification convention for +852. In practice the registration sits with the route your traffic travels:
  • Alphanumeric sender IDs ride the aggregator. Your terminating aggregator registers the sender IDs it passes to Hong Kong carriers under the scheme. Confirm with your aggregator that each sender ID you plan to use into HK carries a current scheme registration before the first send.
  • The live row reads registration: none. Because the scheme registration sits with the aggregator, Orbit requires no Orbit-filed HK sender registration and its send-time gate does not hold HK traffic. Traffic on an unregistered sender ID is still dropped at the carrier — the none row is not a statement that the scheme does not matter, only that Orbit is not the gate.
  • Match the sender to the brand. The scheme registers senders that tie back to a real organisation. Pick a brand name your KYC documents support.
Pre-flight a sender for HK with GET /api/v1/compliance/check?sender_id=<id>&country=HK, and see Sender-ID Registration for the format floors and the markets where Orbit does file registrations on your behalf.

​
Opt-in vs opt-out — which duty applies when

The split matters in both directions. An HK list built on a valid own-use notice is still not a footing for selling or sharing that list; provision needs separate written consent. And a recorded Part 6A footing does not remove the message-level unsubscribe duty.

​
Chinese and English STOP handling

The Opt-Out Keyword Alias Table seeds the English family — STOP, UNSUBSCRIBE, CANCEL, END, QUIT — matched with locale-insensitive case-folding. Hong Kong recipients reply in English, Traditional Chinese, and Simplified Chinese, and the seeded set carries no Chinese vocabulary, so a reply of 停止 does not match today. Add the Chinese synonyms yourself with POST /api/v1/settings/opt-out-rules (or in the dashboard under Messages → SMS → Opt-out Rules): Each rule you add writes the same channel-scoped all suppression entry as the English aliases: a 退訂 reply takes that contact off SMS, WhatsApp, and email at once, because the opt-out is a request to stop being contacted, not a request to stop one channel. Publish the keywords you register in your consent text and message footer, and acknowledge the opt-out in the language the recipient used.

​
Quiet hours — tenant-owned

No Hong Kong statute sets an SMS marketing window. The posture is deliberate configuration, not a default Orbit sets for you. Hong Kong runs a fixed UTC+8 zone with no daylight saving, so a recipient-timezone-resolved window applies the same offset all year. Validate the resolution with Quiet-Hours Preview before you flip HK live.

​
Posture-FAQ tuple for Hong Kong

When you answer “what does Hong Kong need?” against the Posture FAQ, the HK-specific tuple is:
  • Default quiet-hours window: platform fallback 21:00–09:00 (fail-open fallback only — configure tenant hours deliberately).
  • Opt-in required before marketing: split — own-use direct marketing is opt-out after the first Part 6A notice; providing data to a third party for their direct marketing is opt-in (prior written consent).
  • Sender registration level: none on the live Orbit row; carrier acceptance rides on OFCA’s SMS Sender Registration Scheme at your aggregator.
  • Opt-out keyword family: English STOP, UNSUBSCRIBE, CANCEL, END, QUIT plus tenant-registered Chinese synonyms.
  • Official law: Personal Data (Privacy) Ordinance (Cap. 486), Part 6A — PCPD; Unsolicited Electronic Messages Ordinance (Cap. 593) — OFCA.

​
Worked configuration to a defensible HK posture

Narrowed from the generic launch checklist in Country Compliance Requirements to the HK row:
1

Look up the HK row

Call GET /api/v1/compliance/country-rules?channel=sms&country=HK and read sender_types, registration, and stop_requirement. registration: none means Orbit’s gate will not hold HK traffic — the carrier-side scheme check is the next step, not this row.
2

Confirm sender coverage with your aggregator

For each alphanumeric sender ID you plan into +852, confirm your terminating aggregator holds a current OFCA SMS Sender Registration Scheme registration. Unregistered sender IDs are dropped at the Hong Kong carrier.
3

Record the Part 6A footing

Record a consent entry with lawful_basis and a purpose string per (contact, channel) before any HK marketing send — the own-use notice basis, or written consent where data is provided to a third party. See Consent Management.
4

Register the Chinese opt-out synonyms

Add the Traditional and Simplified Chinese stop vocabulary with POST /api/v1/settings/opt-out-rules so a 停止 or 退訂 reply writes the suppression entry. See the STOP section above.
5

Set tenant quiet hours deliberately

Turn on tenant quiet hours covering a window your counsel accepts for HK marketing (a conservative start is 21:00–09:00 Asia/Hong_Kong). Orbit defaults this off. Validate with Quiet-Hours Preview. See Quiet-Hours Configuration.
6

Launch

With the aggregator-side scheme registration confirmed, the Part 6A footing recorded, the Chinese aliases registered, and quiet hours set, start sending.