7 Questions Every HR Leader Should Ask Before Implementing a Surveillance Policy in Hong Kong

You are an HR leader in Hong Kong. The CEO just asked you to look into employee monitoring software. Maybe a recent incident involving leaked client data has the board worried. Or perhaps a manager wants to track remote workers more closely. Whatever the reason, the request lands on your desk with a sense of urgency.

Before you start comparing camera systems or keystroke logging tools, stop. Workplace surveillance in Hong Kong sits at a tricky intersection of operational need, employee privacy, and legal compliance under the Personal Data (Privacy) Ordinance (PDPO). One wrong move can destroy trust, trigger a complaint to the Privacy Commissioner, or even land your company in court.

The good news? You do not need to say no to monitoring. You just need to ask the right questions first.

Why Surveillance Feels Different in Hong Kong

Hong Kong workers are used to being watched in public spaces. Security cameras are everywhere. But workplace monitoring feels personal. When an employer tracks your screen time, your location, or your bathroom breaks, the dynamic shifts.

The PDPO does not ban employee surveillance. It does require that your purpose is lawful, your methods are fair, and your data collection is not excessive. The Privacy Commissioner for Personal Data (PCPD) has issued clear guidance on this. If your policy is too broad or too secret, you risk a formal investigation.

Beyond the law, there is a cultural factor. Trust matters deeply in Hong Kong’s relationship-driven business environment. A surveillance policy that feels like a spying operation can damage your employer brand. That is especially dangerous when you are already fighting for talent. As we discussed in our article on why Hong Kong startups are losing the war for tech talent, trust is a currency you cannot afford to waste.

The Seven Questions Every HR Leader Must Ask

1. What specific problem are we trying to solve?

This is the most important question. If you cannot articulate the business problem in one sentence, do not proceed.

Bad reason: “We want to see what employees do all day.”
Good reason: “We need to verify that sensitive client data is not being downloaded to personal devices in the finance team.”

The PDPO requires that you collect personal data only for a lawful purpose directly related to a function or activity of the employer. A vague goal like “improving productivity” is not specific enough. A concrete goal like “preventing data leakage in a regulated department” is much stronger.

2. Is this method proportionate to the risk?

Proportionality is the heart of Hong Kong’s data protection principles. You cannot use a sledgehammer to crack a nut.

Ask yourself: Is there a less intrusive way to achieve the same result?

Surveillance method	Proportional?	Common mistake
Time tracking software for hourly workers	Usually yes, if limited to login/logout times	Tracking idle time and using it for discipline without warning
Camera in a shared office area	Possibly, if notified and for security	Hiding a camera in a break room or restroom
Keystroke logging on company laptops	Rarely proportionate for general staff	Using it to monitor every single keystroke of every employee
GPS tracking on company vehicles	Yes, for route optimization during work hours	Tracking the vehicle after hours without consent

If your risk is low (for example, a small administrative error), then a high-intensity method like continuous screen recording is hard to justify.

3. How will we inform employees?

Transparency is not optional. Under the PDPO, you must inform employees about the purpose of data collection and how the data will be used. This is often called the “notice” requirement.

Your notice should cover:

• What data is being collected (screen time, location, emails, etc.)
• Why it is being collected
• How long it will be kept
• Who will have access to it
• Whether the data will be shared with third parties

Do not bury this in a 40-page employee handbook. Send a clear, separate memo. Hold a team meeting. Let people ask questions. If employees find out about monitoring through gossip or an accidental discovery, you have lost their trust.

4. Do we have a legal basis for every type of data we collect?

The PDPO uses a consent-based model. In practice, employment relationships complicate consent because there is a power imbalance. An employee may feel they cannot say no.

The PCPD guidance suggests that employers should rely on a legitimate business purpose rather than forced consent. For example, you can argue that monitoring email traffic for security threats is necessary for the operation of the business. You do not need individual consent for that, but you do need to inform staff.

However, for more intrusive methods like biometric data (fingerprint scans, facial recognition), explicit consent is strongly recommended. We covered this in depth in our guide on implementing biometric attendance systems without violating Hong Kong’s PDPO.

5. What is our data retention and deletion policy?

Collecting data is one thing. Keeping it forever is another. The PDPO requires that personal data is not kept longer than necessary.

A common mistake is to set up monitoring software and then never review the retention settings. Years later, you have a massive archive of employee activity that you have no legal right to hold.

Create a schedule:

• Logs of system access: retain for 6 months, then delete.
• CCTV footage: retain for 30 days unless an incident occurs.
• Email monitoring records: retain only as long as needed for the specific investigation.

If you are using a cloud-based system, make sure the vendor allows you to set automatic deletion rules. Many off-the-shelf tools default to indefinite storage.

6. How will we handle data access requests?

Under the PDPO, employees have the right to access their personal data held by you. This includes surveillance data. If an employee submits a data access request, you must provide it within a reasonable time, unless an exemption applies.

This can be awkward. Imagine an employee asks for all the screen recordings of their work over the past year. You have to hand them over.

Plan for this now. Design your system so that data can be easily retrieved for a specific individual. If your monitoring tool makes it hard to isolate one person’s data, you are setting yourself up for a compliance headache.

7. Have we involved legal counsel and IT security?

This is not a question to answer alone. Your legal team (or external counsel) needs to review the policy for PDPO compliance. Your IT security team needs to verify that the monitoring tool itself does not introduce vulnerabilities.

Some monitoring software is poorly secured. If a bad actor hacks your surveillance system, they gain access to all your internal data. That is a disaster.

Also, involve your IT team in the vendor selection. They can test whether the tool integrates with your existing systems without creating conflicts.

A Practical Process for Getting Started

Do not try to implement everything at once. Follow these steps:

1. Define the scope. Pick one department or one risk to address first. Do not monitor the whole company until you have tested the approach.
2. Document the purpose. Write a brief memo explaining the specific business problem and why this method is necessary.
3. Conduct a privacy impact assessment. This is a formal review of how the surveillance will affect employee privacy and what measures you will take to minimize intrusion.
4. Draft the policy. Include the notice requirements, retention rules, and access procedures.
5. Consult legal counsel. Get a formal sign-off on PDPO compliance.
6. Communicate with staff. Give at least two weeks notice before activation. Hold a Q&A session.
7. Review after 90 days. Check whether the surveillance is achieving its goal. If not, stop it.

Common Pitfalls to Avoid

• Monitoring personal devices. If an employee uses their own phone for work, you have limited rights to monitor it. Stick to company-issued equipment.
• Using surveillance results for unrelated discipline. If you discover an employee is late through a camera system installed for security, you cannot use that footage to fire them unless your policy explicitly covers attendance monitoring.
• Ignoring the hybrid work reality. Many Hong Kong employees work from home part of the week. Your policy must address how monitoring works in a home environment. Employees have a reasonable expectation of privacy in their own homes.

“The most successful surveillance policies in Hong Kong are the ones employees barely notice. That is not because the monitoring is hidden. It is because the employer has been transparent, the scope is narrow, and the purpose is clearly aligned with a genuine business need.” — Sarah Lam, data privacy lawyer based in Hong Kong

What Happens If You Get It Wrong

The PCPD has the power to investigate complaints, issue enforcement notices, and impose fines. In 2024 and 2025, the office increased its enforcement activity, particularly around employment data. A single employee complaint can trigger a formal investigation that consumes months of your HR team’s time.

Beyond the legal risk, there is the human cost. Employees who feel spied on are more likely to disengage. They may start looking for new jobs. In a tight talent market, that is expensive. Our analysis of why Hong Kong employees are quiet quitting found that perceived lack of trust is one of the top drivers of disengagement.

Building a Policy That Protects Everyone

A good surveillance policy does not just protect the company. It protects employees too. It sets clear boundaries. It tells staff what data is collected and what is off limits. It gives them a way to challenge misuse.

Think of it as a contract of trust. You are saying: “We need to monitor this specific area to keep the business safe. Here is exactly what we are doing. Here is how long we keep the data. If you have questions, here is who to talk to.”

That kind of transparency builds respect. It also makes your policy much harder to challenge legally.

Your Next Steps

Before you buy any software or install any cameras, sit down with your leadership team and answer these seven questions. Write the answers down. If any answer is vague or uncomfortable, that is a red flag.

Then, review your existing policies. If you already have surveillance in place that was never properly communicated, fix that immediately. Send a clear notice to all affected employees.

Finally, consider your broader approach to employee data. If you are already handling other sensitive data, like biometric attendance or health records, your surveillance policy should align with those existing practices. Our guide on how to handle employee data privacy obligations under Hong Kong’s Personal Data Ordinance can help you see the full picture.

Trust as a Competitive Advantage

Hong Kong’s business landscape is changing. Employees have more options than ever. Companies that treat their people with respect will win the long game. A thoughtful, transparent surveillance policy is part of that respect.

Ask the hard questions now. Get the answers right. Your team, your legal team, and your bottom line will thank you.