Does your Hong Kong business website enquiry form need a PICS?

Many Hong Kong SME websites use an enquiry form: a visitor leaves a name, phone number, email and a short message. Those fields are usually personal data under the Personal Data (Privacy) Ordinance. PCPD guidance says that, on or before collecting personal data directly from someone, a data user must take all reasonably practicable steps to give the required notice. Online, the common way to do that is a Personal Information Collection Statement (PICS) on or next to the form. This guide turns public PCPD materials into a practical website checklist. It is general information only, not legal advice.

Why a website form is different from WhatsApp

On WhatsApp or a phone call, customers usually know which business they are contacting. On a website form, they may only see a brand and fields. PCPD’s internet guidance also notes that collecting personal data while revealing little more than a web or email address can fall short of fair collection. Your site should state the company name and reliable Hong Kong contact details in About / Contact pages, and the enquiry form should carry a clear, readable PICS.

PICS versus privacy policy statement

• PICS: notice given on or before this collection (for example, submitting an enquiry) covering purpose, whether supply is voluntary or obligatory, classes of possible transferees, and access/correction rights with a contact person.
• Privacy Policy Statement (PPS): a broader statement of your privacy policies and practices—kinds of data held, cookies, retention, security—and should be easy to find on the site.
• Do not blur them into one vague paragraph: put a purpose-specific PICS by the form, and keep a site-wide PPS available.

What PCPD guidance says a PICS should cover

According to PCPD’s Guidance on Preparing a PICS and PPS, and its guidance on collecting personal data through the Internet, an online PICS should be clear and conspicuous (on the same page or via a well-described link) and generally include:

• Whether supplying the data is voluntary or obligatory; if obligatory, the consequences of not supplying it (for example, you cannot process the enquiry).
• The purposes of use after collection (for example, replying to this service enquiry, arranging a quote or appointment). Purposes should be specific enough for the person to understand—not open-ended phrases such as “other related purposes”.
• The classes of persons to whom the data may be transferred or disclosed (for example, staff handling enquiries, or a contracted form/email provider). Avoid vague classes such as “any business partners”; if you will not disclose to third parties, say so.
• The individual’s rights to request access to and correction of their personal data, plus the name or job title and address (or equivalent contact details) of the person who handles such requests.

Practical checklist for an SME enquiry form

• Collect only what you need to handle the enquiry. PCPD stresses adequate but not excessive collection: an ordinary enquiry rarely needs an ID number, full residential address or payment card details.
• Label mandatory and optional fields clearly, and allow submission when optional fields are blank.
• Keep the PICS readable in length, wording and font size; match the main language of the page (Chinese, English, or both).
• If you have different forms for different purposes (quote request, job application, newsletter), tailor a PICS to each purpose.
• Link to your privacy policy from the form page so visitors can read broader practices.
• Identify the business clearly on the site—company name and contact channels—not only a nameless form.

If you later want to use the data for marketing

If you intend to use names, phone numbers or emails from the enquiry form for direct marketing, PCPD guidance points to the Ordinance’s separate notification and consent / indication-of-no-objection requirements, including a response channel. Do not treat “submitted an enquiry” as consent to receive promotions. If the form is only for handling the enquiry, say that in the PICS and obtain any marketing permission separately when needed.

After submit: easy-to-miss follow-through

• Retention: do not keep personal data longer than needed for the purpose; have a way to clear closed enquiry records.
• Processors: if a third-party form, email or CRM receives the data for you, PCPD notes that you remain responsible for contractual or other means to prevent excessive retention and unauthorised use.
• Security: match safeguards to sensitivity; consider encrypted transmission for sensitive data, and do not leave form exports on publicly indexable URLs.
• Reference example: PCPD’s own enquiry form states that submission is voluntary, use is limited to handling the enquiry, how to request access/correction, and that data may be shared with parties contacted while handling the case—use that pattern to check your own statement covers the core elements.

Three steps you can take today

• Open your enquiry page and confirm visitors can see (or open in one clear click) a purpose-specific PICS before they submit.
• Check the four core elements above; replace vague purposes and vague transferee classes; add an access/correction contact.
• Trim unnecessary mandatory fields, and make sure the site shows your company identity plus a privacy policy link.

A clear enquiry-form notice helps customers understand how you handle the details they leave. For definitive requirements, read PCPD’s guidance and the Ordinance, or seek qualified professional advice.