> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Hong Kong PCPD + OFCA Sender Rules
> Hong Kong on Orbit — the PDPO (Cap. 486) Part 6A direct-marketing consent model the PCPD enforces, the UEMO (Cap. 593) sender-identification and unsubscribe duties OFCA administers, the OFCA SMS Sender Registration Scheme behind +852 alphanumeric sender IDs, the live country-rules HK row, Chinese and English STOP handling, and tenant quiet hours.
# Hong Kong PCPD + OFCA Sender Rules
Hong Kong regulates commercial messaging through two regimes that sit
side by side: the **Personal Data (Privacy) Ordinance (PDPO, Cap. 486)**,
whose Part 6A governs direct marketing that uses personal data and is
enforced by the Privacy Commissioner for Personal Data (PCPD), and the
**Unsolicited Electronic Messages Ordinance (UEMO, Cap. 593)**, whose
sender-identification and unsubscribe duties the Office of the
Communications Authority (OFCA) administers. At the SMS layer, OFCA
additionally runs the **SMS Sender Registration Scheme** — the
sender-verification convention under which Hong Kong carriers accept
the alphanumeric sender IDs your `+852` traffic uses.
Hong Kong is a **tenant-owned burden**. Orbit keeps the
[country-rules reference](/compliance/country-requirements) that feeds
the send-time gates, the consent ledger, the suppression layer, and the
opt-out keyword rules. The legal posture — the Part 6A notice you give,
the consent you record, the unsubscribe window you honour, the hours you
keep — is yours.
This page is documentation, not legal advice. The PCPD enforces the
PDPO's direct-marketing provisions against the data user, and OFCA
enforces the UEMO against the sender. Have counsel review your consent
capture, your unsubscribe handling, and your sender-name choice;
Orbit supplies the surfaces.
***
## Two regimes — PDPO Part 6A and UEMO
| Regime | Statute | Regulator | What it governs |
| - | - | - | - |
| Direct marketing with personal data | PDPO (Cap. 486), Part 6A | PCPD | What you may send when the send uses the recipient's personal data: notice and a right to object for your own direct marketing; prior consent before you provide data to a third party for theirs |
| Commercial electronic messages | UEMO (Cap. 593) | OFCA | Sender identification and the unsubscribe duty on commercial electronic messages |
| SMS sender identity | OFCA SMS Sender Registration Scheme | OFCA | The registration of SMS sender IDs that Hong Kong carriers accept |
The two ordinances stack: a compliant HK send is identified (UEMO),
unsubscribable (UEMO), and sent on a recorded Part 6A footing (PDPO).
Satisfying one regime does not satisfy the other.
Part 6A in plain terms:
* **Own-use direct marketing is opt-out after first notice.** Before
you first use someone's personal data to market your own goods or
services you give a written notice of the intended use; the recipient
may object, and an objection stops the marketing.
* **Providing data to a third party is opt-in.** Supplying personal
data to another organisation for that organisation's direct marketing
requires the person's prior written consent.
* **UEMO adds the message-level duties.** A commercial electronic
message identifies its sender and carries a working unsubscribe
facility, and an unsubscribe request must be honoured within 10
working days. UEMO's statutory text is rooted in email and fax; for
SMS the operative carrier-side mechanism is the sender registration
scheme, and the unsubscribe convention carries across — a HK
recipient expects the same stop path on a marketing text.
Official references: [PDPO (Cap. 486)](https://www.elegislation.gov.hk/hk/cap486),
[UEMO (Cap. 593)](https://www.elegislation.gov.hk/hk/cap593),
[PCPD](https://www.pcpd.org.hk/english/index.html),
[OFCA](https://www.ofca.gov.hk/en/index.html).
***
## The HK row — live country-rules lookup
Read the HK row of `GET /api/v1/compliance/country-rules?channel=sms`
(see [Country Compliance Requirements](/compliance/country-requirements)):
```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/country-rules?channel=sms&country=HK" \
-H "Authorization: Bearer $ORBIT_API_KEY"
```
| Rule | HK value | What it means for you |
| - | - | - |
| Sender types | `alphanumeric` | Alphanumeric sender IDs are the accepted named-sender class into `+852`, delivered through the aggregator and registration-scheme route below. |
| Registration | `none` | Orbit's send-time gate does not hold HK traffic on a sender registration — the scheme registration happens at your aggregator, not against Orbit. The carrier-side acceptance is still real; confirm coverage before launch (below). |
| Marketing consent | PDPO Part 6A — notice for own-use, consent for provision | Record the Part 6A footing per `(contact, channel)` before the first marketing send. |
| Opt-out keywords | English `STOP` family plus the Chinese synonyms you add | The seeded English family matches; register Chinese synonyms yourself (below). |
| Quiet hours | Tenant-configured posture | No statutory SMS marketing window exists; configure a window deliberately (below). |
Registration levels change at the regulator — always read the live
`registration` field for the HK row rather than relying on this page's
snapshot.
***
## Sender-ID acceptance posture — alphanumeric via the aggregator
Hong Kong carriers accept SMS from sender IDs registered under OFCA's
SMS Sender Registration Scheme; the scheme is the sender-verification
convention for `+852`. In practice the registration sits with the route
your traffic travels:
* **Alphanumeric sender IDs ride the aggregator.** Your terminating
aggregator registers the sender IDs it passes to Hong Kong carriers
under the scheme. Confirm with your aggregator that each sender ID
you plan to use into HK carries a current scheme registration before
the first send.
* **The live row reads `registration: none`.** Because the scheme
registration sits with the aggregator, Orbit requires no Orbit-filed
HK sender registration and its send-time gate does not hold HK
traffic. Traffic on an unregistered sender ID is still dropped at the
carrier — the `none` row is not a statement that the scheme does not
matter, only that Orbit is not the gate.
* **Match the sender to the brand.** The scheme registers senders that
tie back to a real organisation. Pick a brand name your KYC documents
support.
Pre-flight a sender for HK with
`GET /api/v1/compliance/check?sender_id=&country=HK`, and see
[Sender-ID Registration](/compliance/sender-id-registration) for the
format floors and the markets where Orbit does file registrations on
your behalf.
***
## Opt-in vs opt-out — which duty applies when
| Your send | The duty | Orbit surface |
| - | - | - |
| Marketing your own goods or services using the recipient's personal data | Part 6A notice before first use; an objection (opt-out) honoured from then on | [Consent Management](/compliance/consent-management) — record the notice basis and write any objection to the same suppression list as a keyword opt-out |
| Providing personal data to a third party for their direct marketing | Prior written consent (opt-in) | A consent entry with `lawful_basis` and a `purpose` string per `(contact, channel)` before any provision |
| Any commercial electronic message | Sender identified, working unsubscribe, request honoured within 10 working days | The suppression layer and your opt-out keyword rules — one list, every entry point |
The split matters in both directions. An HK list built on a valid
own-use notice is still not a footing for selling or sharing that list;
provision needs separate written consent. And a recorded Part 6A
footing does not remove the message-level unsubscribe duty.
***
## Chinese and English STOP handling
The [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table)
seeds the English family — `STOP`, `UNSUBSCRIBE`, `CANCEL`, `END`,
`QUIT` — matched with locale-insensitive case-folding. Hong Kong
recipients reply in English, Traditional Chinese, and Simplified
Chinese, and the seeded set carries no Chinese vocabulary, so a reply
of 停止 does not match today.
Add the Chinese synonyms yourself with
`POST /api/v1/settings/opt-out-rules` (or in the dashboard under
**Messages → SMS → Opt-out Rules**):
| Language | Synonyms to register |
| - | - |
| Traditional Chinese | 停止, 取消, 退訂, 退出 |
| Simplified Chinese | 停止, 取消, 退订, 退出 |
Each rule you add writes the same channel-scoped `all` suppression
entry as the English aliases: a 退訂 reply takes that contact off SMS,
WhatsApp, and email at once, because the opt-out is a request to stop
being contacted, not a request to stop one channel. Publish the
keywords you register in your consent text and message footer, and
acknowledge the opt-out in the language the recipient used.
***
## Quiet hours — tenant-owned
No Hong Kong statute sets an SMS marketing window. The posture is
deliberate configuration, not a default Orbit sets for you.
| Surface | Behaviour for HK |
| - | - |
| Tenant quiet hours (deliberate) | [Quiet-Hours Configuration](/guides/quiet-hours-configuration) — opt-in tenant control, default **OFF / fail-open**; configure a window covering Hong Kong overnight hours (a conservative start is 21:00–09:00 Asia/Hong\_Kong) if you want the platform to hold HK marketing sends. Nothing in Orbit defaults this on. |
| Platform default (fallback) | When no tenant window is set, drip/journey sends inherit the platform default 21:00–09:00 recipient local — a fallback that incidentally covers a conservative Hong Kong window, not a tenant guarantee. |
Hong Kong runs a fixed **UTC+8** zone with **no daylight saving**, so a
recipient-timezone-resolved window applies the same offset all year.
Validate the resolution with
[Quiet-Hours Preview](/compliance/quiet-hours-preview) before you flip
HK live.
***
## Posture-FAQ tuple for Hong Kong
When you answer "what does Hong Kong need?" against the
[Posture FAQ](/compliance/posture-faq), the HK-specific tuple is:
* **Default quiet-hours window**: platform fallback 21:00–09:00
(fail-open fallback only — configure tenant hours deliberately).
* **Opt-in required before marketing**: split — own-use direct
marketing is opt-out after the first Part 6A notice; providing data
to a third party for their direct marketing is opt-in (prior written
consent).
* **Sender registration level**: `none` on the live Orbit row; carrier
acceptance rides on OFCA's SMS Sender Registration Scheme at your
aggregator.
* **Opt-out keyword family**: English `STOP`, `UNSUBSCRIBE`, `CANCEL`,
`END`, `QUIT` plus tenant-registered Chinese synonyms.
* **Official law**: Personal Data (Privacy) Ordinance (Cap. 486),
Part 6A — PCPD; Unsolicited Electronic Messages Ordinance
(Cap. 593) — OFCA.
***
## Worked configuration to a defensible HK posture
Narrowed from the generic launch checklist in
[Country Compliance Requirements](/compliance/country-requirements) to
the HK row:
Call `GET /api/v1/compliance/country-rules?channel=sms&country=HK`
and read `sender_types`, `registration`, and `stop_requirement`.
`registration: none` means Orbit's gate will not hold HK traffic —
the carrier-side scheme check is the next step, not this row.
For each alphanumeric sender ID you plan into `+852`, confirm your
terminating aggregator holds a current OFCA SMS Sender Registration
Scheme registration. Unregistered sender IDs are dropped at the
Hong Kong carrier.
Record a consent entry with `lawful_basis` and a `purpose` string
per `(contact, channel)` before any HK marketing send — the
own-use notice basis, or written consent where data is provided to
a third party. See [Consent Management](/compliance/consent-management).
Add the Traditional and Simplified Chinese stop vocabulary with
`POST /api/v1/settings/opt-out-rules` so a 停止 or 退訂 reply
writes the suppression entry. See the STOP section above.
Turn on tenant quiet hours covering a window your counsel accepts
for HK marketing (a conservative start is 21:00–09:00
Asia/Hong\_Kong). Orbit defaults this off. Validate with
[Quiet-Hours Preview](/compliance/quiet-hours-preview). See
[Quiet-Hours Configuration](/guides/quiet-hours-configuration).
With the aggregator-side scheme registration confirmed, the Part
6A footing recorded, the Chinese aliases registered, and quiet
hours set, start sending.
***
## Related references
* [Country Compliance Requirements](/compliance/country-requirements) —
the full matrix this page expands one row of.
* [Regional Posture Hub](/compliance/country-rules-directory) — the
index this page is wired into.
* [Sender-ID Registration](/compliance/sender-id-registration) — the
markets where Orbit files registrations on your behalf, and the
sender-format floors.
* [Consent Management](/compliance/consent-management) — where the
Part 6A footing record lives.
* [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) —
the seeded English `STOP` family your Chinese synonyms extend.
* [Quiet-Hours Configuration](/guides/quiet-hours-configuration) — the
tenant-owned opt-in control you use to cover the HK window.
* [Quiet-Hours Preview](/compliance/quiet-hours-preview) — validate the
recipient timezone resolution before you go live.
* [Japan APPI](/compliance/japan-appi) and
[Singapore SGNIC Sender-ID Registration Rules](/compliance/singapore-sgnic-sender-rules) —
the neighbouring APAC postures.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.