Hong Kong · Investigation Is Not Licensed, and the Disclosure Offence Is the Constraint
| Field | Hong Kong |
|---|---|
| What the state regulates | Neither. Hong Kong licenses guarding and security devices. There is no licence for the investigation profession and none for the activity. What constrains investigative work is a disclosure offence in the data statute. |
| Is there a private investigator licence? | No. The licensing regime is the Security and Guarding Services Ordinance, and its definition of the regulated activity does not reach investigation. See the quotation below, which is the whole of it. |
| Governing instrument for the licensed trade | Security and Guarding Services Ordinance (Cap 460). Administered by the Security and Guarding Services Industry Authority, a statutory body, with licences and permits issued through the Commissioner of Police. |
| What is licensed | A security company licence for a body corporate supplying persons to do security work for reward, and a security personnel permit for the individual. The permit criteria run across four categories, all of them guarding, distinguished mainly by whether arms are carried. |
| The instrument that actually bites | Personal Data (Privacy) Ordinance (Cap 486) s 64, as amended by Ordinance 32 of 2021. Three separate disclosure offences, one of which is made out on recklessness alone. |
| Headline penalty on the disclosure offence | On indictment, a fine of $1,000,000 and 5 years' imprisonment where the disclosure causes specified harm (s 64(3D)). Summarily, a level 6 fine and 2 years (s 64(3B)). |
| Regulator's compulsion powers | The Privacy Commissioner may require any person reasonably suspected to hold relevant material to produce it, attend and answer questions, make a statement, and give all reasonable assistance (s 66D). |
| Foreign and cross-border firms | Unverified, requires local advice. Whether s 64 reaches a disclosure made outside Hong Kong about a Hong Kong data subject, and whether s 66D can be exercised against a firm with no Hong Kong presence, were not resolved from the provisions read here. |
What Cap 460 actually defines, quoted in full
This is the entire definition, and it is short enough that the absence is not a matter of interpretation. Section 2 provides:
security work (保安工作) means any of the following activities—
(a) guarding any property;
(b) guarding any person or place for the purpose of preventing or detecting the occurrence of any offence;
(c) installing, maintaining or repairing a security device;
(d) designing for any particular premises or place a system incorporating a security device.
Four limbs, two of which are about physical guarding and two about hardware. Nothing in the definition turns on obtaining information about a person, and no limb reaches enquiry work of any kind. Limb (b) mentions detecting the occurrence of any offence, which is the closest the Ordinance comes, but it is anchored to guarding a person or place rather than to investigating one.
The supporting material points the same way. The Government's own eighteen-page paper to the Legislative Council on the permit criteria sets out four categories of security work and describes all four in terms of guarding, the distinguishing feature of Category C being the carrying of arms and ammunition. Across that whole paper the words investigation, detective and enquiry do not appear once.
The provision that actually bites: PDPO s 64
Because there is no licence to obtain, a practitioner arriving from a licensing jurisdiction can mistake Hong Kong for a permissive one. It is not. The constraint simply sits somewhere else, and it is criminal rather than administrative.
Section 64 was substantially rewritten by Ordinance 32 of 2021 and now contains three offences:
| Provision | What it catches | Penalty |
|---|---|---|
| s 64(1) | Disclosing personal data obtained from a data user without that data user's consent, with intent to obtain a gain in money or property, or to cause such a loss to the data subject. | Fine of $1,000,000 and 5 years |
| s 64(3A) | Disclosing personal data without the data subject's consent with intent to cause specified harm, or being reckless as to whether specified harm would be, or would likely be, caused, to the subject or a family member. | Level 6 fine and 2 years |
| s 64(3C) | The same conduct as 64(3A), where the disclosure actually causes specified harm. | On indictment, $1,000,000 and 5 years |
The mental element is where the risk sits for investigative work. Section 64(3A) does not require an intention to harm anyone. Recklessness as to whether harm would likely be caused is enough, and "specified harm" is defined in s 64(6) as:
(a) harassment, molestation, pestering, threat or intimidation to the person;
(b) bodily harm or psychological harm to the person;
(c) harm causing the person reasonably to be concerned for the person's safety or well-being; or
(d) damage to the property of the person.
Limbs (b) and (c) are the ones to read twice. Psychological harm, and harm causing a person reasonably to be concerned for their own well-being, are ordinary consequences of being investigated and finding out. That does not make investigation unlawful in Hong Kong, and the offence is a disclosure offence rather than a collection offence. But it does mean that the moment a finding leaves your hands, the question is no longer only whether it is accurate.
The defences, and where the burden sits
Section 64(4) provides defences, of which the two that matter for investigative work are that the person reasonably believed the disclosure was necessary for preventing or detecting crime, and that the disclosure was required or authorised by law or by a court order. There is also a defence for lawful news activity in the public interest.
Section 64(5) is unusual and worth knowing: a defendant is taken to have established a defence if there is sufficient evidence to raise an issue with respect to it and the prosecution does not disprove it beyond reasonable doubt. That is an evidential burden rather than a legal one, which is more favourable to a defendant than it first reads.
Why this is the mirror image of Singapore, and why that matters on a cross-border matter
Practitioners moving between the two commonly get this backwards, because the intuitive question is "do I need a licence" and that question produces opposite answers for the wrong reason.
| Singapore | Hong Kong | |
|---|---|---|
| Licence to investigate | Required. Two of them: the individual under PSIA s 6 and the agency under s 7 | None exists |
| Where the risk sits | At the front. Doing the work at all, or advertising it, without a licence is the offence | At the back. Doing the work is unregulated; disclosing the product can be criminal |
| Does open-source method help? | No. The definition says nothing about how information is obtained | Not on s 64, which is about disclosure rather than collection |
| The practical error | Assuming OSINT is outside the regime | Assuming no licence means no constraint |
A Hong Kong firm accepting a Singapore matter, and a Singapore firm accepting a Hong Kong one, therefore face different questions in each direction, and neither is answered by the other jurisdiction's habits. See Singapore for the licensing side of that.
Open questions on this entry
How this compares
| Jurisdiction | What the state regulates | The short answer |
|---|---|---|
| Singapore | Profession | Licensed, source-agnostic definition, two licences |
| Malaysia | Profession | Licensed under the Private Agencies Act 1971 |
| Philippines | Profession | Licensed under RA 11917 |
| Japan | Profession | Notification, not licence, and internet-only work is excluded |
| Thailand | Neither | Guarding is licensed; investigation is not mentioned |
| Indonesia | Neither | Six licensed security categories; investigation is not one |
| Hong Kong | Neither | Guarding is licensed; the disclosure offence is the constraint |
| South Korea | Neither | No licence since the title was freed in 2020; the data law constrains |
| Laos | Neither | Guarding is licensed; the data law is the constraint |
| Vietnam | Activity | Data analysis and processing become conditional business lines |
Primary sources
- Security and Guarding Services Ordinance (Cap 460), s 2 (Interpretation)
- Personal Data (Privacy) Ordinance (Cap 486), ss 64 and 66D, as amended by Ordinance 32 of 2021
- Legislative Council Brief on the criteria for security personnel permits, Security Bureau
Other jurisdictions
- Singapore · Private Investigation Licensing
- Japan · Notification, and the Internet Exclusion
- South Korea · Not Licensed, and the Data Law Is the Constraint
- Asia-Pacific Private Investigation Registry
General information for practitioners, not legal advice. Engage Hong Kong counsel before relying on this reading for a live matter. Absence of a licensing regime is not absence of legal risk, and in Hong Kong the disclosure offence is the more demanding of the two.
AI9OS turns public information into verified, chain-of-custody findings for licensed investigation agencies, law firms and corporate risk teams.
Request a demo