Jira & Confluence 
Bitrix24 Hong Kong · PDPO ss.18–20 · reply within 40 days
Told your data may have leaked in Hong Kong? — data access request letter ready, 40 days counted
Short answer. Your covering letter is open below: add the incident, where your data may be held, and attach the official form OPS003. Right to ask: Whether the organisation holds your personal data, and a copy of it (Personal Data (Privacy) Ordinance (Cap. 486), s.18(1)).
- Last day for the organisation to comply (40 days after receiving the request): type the date
Check your own case.
Personal Data (Privacy) Ordinance s.19(1): a data user must comply with a data access request within 40 days after receiving it — by telling you in writing whether it holds your data and supplying a copy, or telling you it holds none. If it cannot comply in time, it must tell you in writing before the 40 days end, with reasons, and comply as soon as practicable afterwards (s.19(2)). The organisation may refuse a request not made in the form specified by the Privacy Commissioner (s.20(3)(e)) — use form OPS003. Days are calendar days.
Start typing right in the document — no sign-up. It stays in this browser; save it to your free Layers account to keep it, open it on your phone and share it.
Lida, Layers template assistant
Enter the date the organisation received your request, and I will show you the last day it must reply.
Describe where your data may sit — the app, the account, the period. Vague requests take longer.
An illustrated character, not a lawyer.
Deadlines
The rules, with the source
| What | Deadline | Source |
|---|---|---|
| Right to ask | Whether the organisation holds your personal data, and a copy of it | Personal Data (Privacy) Ordinance (Cap. 486), s.18(1) |
| Time to comply | Within 40 days after receiving the request; if it cannot, written notice with reasons before the 40 days end | PDPO s.19(1), (2) |
| Form | Data Access Request Form OPS003, specified by the Privacy Commissioner; a request not in the specified form may be refused | PDPO s.20(3)(e); PCPD forms page |
| Fee | May be charged but must not be excessive; compliance may wait until it is paid | PDPO s.28(2), (3), (5) |
| Complaint to the PCPD | May be refused if you knew of the matter for more than 2 years before complaining | PDPO s.39(1)(a) |
The data access request is your right to see your data. Questions about the incident itself are a separate request; the organisation is not bound by the 40-day rule for them, but asking in writing creates a record.
Step by step
What to do, in order
1
Download form OPS003
From the PCPD website. Fill in your details and describe the data clearly.
2
Fill in the letter
Where the data may be held, the period, and how you learned of the incident.
3
Prove who you are
Attach the proof the form asks for. Mask numbers you do not need to show.
4
Send to the organisation
To its data protection officer, not to the PCPD. Keep proof of the date received.
5
Watch day 40
No reply, no written reason for delay, or a refusal you disagree with: you can complain to the PCPD.
6
Protect yourself now
Change passwords and be careful with messages that mention the incident — they may be phishing.
Questions
Can I just send an e-mail instead of the form?
You can send this letter by e-mail, but attach the completed OPS003 form. Without it, the organisation may lawfully refuse your request.
Do I have to pay?
The organisation may charge a fee that is not excessive and may wait for payment before replying. Ask for the amount first.
Will this get me compensation?
No. It gets you the facts: what data they hold about you. That is the starting point for any complaint.
Official sources
- Personal Data (Privacy) Ordinance (Cap. 486), s.18 Data access request
- Personal Data (Privacy) Ordinance (Cap. 486), s.19 Compliance with data access request
- Personal Data (Privacy) Ordinance (Cap. 486), s.20 Refusal of data access request
- Personal Data (Privacy) Ordinance (Cap. 486), s.28 Imposition of fees by data user
- Personal Data (Privacy) Ordinance (Cap. 486), s.39 Restrictions on investigations
- PCPD — Forms (OPS003 Data Access Request Form)
- PCPD media statement, 20 August 2026 — investigation findings on the Canvas data breach
Other documents
Keep the papers in one place
Letters, receipts and notices in one folder you can share with family or a lawyer. The templates and the editor are free; Layers is free for up to 20 people.
This is a ready document and a deadline calculation, not legal advice.