PwC Hong Kong: Privacy Statement

This privacy statement (“Statement”) was last updated on 15 October 2026.

Introduction

PwC is strongly committed to protecting personal information. This Statement describes why and how we collect and use personal information and provides information about individuals’ rights in relation to personal information. It applies to personal information provided to us, both by individuals themselves and by others. We may use personal information provided to us for any of the purposes described in this Statement or as otherwise stated at the point of collection.

If you do not agree with the terms in this Statement and have concerns about the categories of personal information, we require from you, please do not provide any personal information to us without contacting us. Where necessary and required by applicable law and regulation, we will need to obtain your separate consent for processing your personal information. If you do not provide us with the necessary personal information, the relevant processing purposes may not be achievable.

As used in this Statement, “PwC”, “we”, “us” and “our” refer to PwC member firms operating in Chinese Mainland, Hong Kong SAR and Macau SAR.

Please click the links below for a list of all PwC member firms operating in the following locations:

Given the breath of our business, we and PwC member firms may have separate privacy statements that apply in place of this Statement, please refer to the relevant privacy statements in order to understand how your personal information will be processed.

Who does this statement apply to?

This statement applies to the categories of individuals listed in the ‘How do we use your personal information?’ section below. We have separate privacy statements for certain digital products and applications used by clients or other users (which can be found within the specific product or application). If you are unclear which privacy statement applies to you, please contact us using the details below.

What is our lawful basis for processing your personal information?

Applicable laws may require us to set out in this Statement the legal grounds on which we rely in order to process your personal information. For the processing of personal information in Chinese Mainland, we rely on one or more of the following processing conditions:

where the consent of the individual concerned is obtained;
where it is necessary for the conclusion or performance of a contract to which the individual concerned is a party, or for the implementation of human resources management in accordance with the labor rules and regulations formulated in accordance with the law and the collective contract concluded in accordance with the law;
where it is necessary for the performance of statutory duties or statutory obligations;
where it is necessary for the response to a public health emergency or for the protection of the life, health and property safety of a natural person in an emergency;
where such acts as news reporting and supervision by public opinions are carried out for the public interest, and the handling of personal information is within a reasonable scope;
where it is necessary to handle the personal information disclosed by the individual concerned or other personal information that has been legally disclosed within a reasonable scope in accordance with the provisions of law; and
other circumstances prescribed by laws and administrative regulations.

If we need to process your personal information to fulfil our legal obligations or execute a contract with you, and you do not provide the necessary information, we may be unable to enter into the contract or carry out your instruction. We will inform you if this situation arises.

If you are an individual based in the European Economic Area (“EEA”) or the United Kingdom (“UK”) and the European Union General Data Protection Regulation (“EU GDPR”) or UK General Data Protection Regulation (“UK GDPR”) is applicable to PwC in providing our processing activities in question, we rely on legal basis other than consent to process your personal information as set out in Appendix 1.

How do we use your personal information?

PwC processes personal information for numerous purposes. Our policy is to be transparent about why and how we process personal information. Click on the section relevant to you for more information about personal information we collect and use.

We do not usually collect sensitive personal information (as defined) unless we have specific purposes as indicated in these processing activities, and such processing of the sensitive personal information is necessary for those specific purposes. We will take strict and appropriate measures in accordance with applicable law to protect the sensitive personal information during its collection and processing.

Do we share your personal information?

Network member firms

For details of PwC member firm locations, please see http://www.pwc.com/gx/en/about/office-locations.html.

We may share personal information with other PwC member firms where necessary in connection with the purposes described in this Statement. For example, when providing professional services to a client we may share personal information with PwC member firms in different territories that are involved in providing advice to that client.

Other PwC member firms may process your personal information on behalf of the personal information handler for the same purposes as set out herein. In addition, each PwC member firm with whom you share your information may determine jointly with other PwC member firms the purposes and means of processing of your personal information.

Third party providers

We may transfer or disclose the personal information we collect to third party contractors or subcontractors of PwC member firms (and their respective subsidiaries and affiliates), as well as other third parties, which may include providers of IT services, identity management, website hosting and management, data analysis, data back-up and archiving, security and storage services (including cloud service providers), event management, and other services with respect to the operation of our business. We use such third parties to support us in our processing activities.

When we transfer your personal information to third parties, we do so for the purposes stated under this Statement. It is our policy to use only third-party providers that are bound to maintain appropriate levels of security and confidentiality and process personal information only as instructed by us pursuant to the contract between third-party providers and us. Subject to the foregoing, third party service providers may also use their respective subsidiaries and affiliates, and their own third-party subcontractors that have access to personal information (sub-processors) to meet purposes of disclosure and/or transfer.

Other disclosures

We may disclose personal information to third parties under the following circumstances:

when explicitly requested by you;
when required to deliver publications or reference materials requested by you;
with professional advisers, for example, law firms, as necessary to establish, exercise or defend our legal rights and obtain advice in connection with the running of our business. Personal information may be shared with these advisers as necessary in connection with the services they have been engaged to provide;
when required to facilitate conferences or events hosted by a third party or co-hosted with a third party which you have registered for;
when PwC is involved in a merger, acquisition, or sale of all or a portion of its assets; and/or
as otherwise set out in this Statement.

We may also disclose your personal information to law enforcement, regulatory and other government agencies and authorities, professional bodies and other third parties, as required by and/or in accordance with applicable law or regulation.

International transfers

As PricewaterhouseCoopers is a global network with member firms and third-party providers located around the world, your personal information may be transferred to and stored outside the country or region where you are located. PwC member firms, the third-party providers and sub-processors they engage may use servers and other resources in various countries and territories to process your information. Such jurisdictions may have different data protection laws. It is our policy to use only third-party providers that are bound to maintain appropriate levels of security and confidentiality and process personal information only as instructed by us pursuant to the contract between the third party providers and us. This may include confidentiality agreements with parties that we commission to handle personal information, requiring them to process personal information in accordance with our requirements, this Statement and any other relevant confidentiality and security measures.

For personal information collected from Chinese Mainland: In principle, the personal information we collect and generate in Chinese Mainland will be stored within Chinese Mainland. With your consent or based on other legal basis, your personal information may be transmitted to or accessed from a jurisdiction outside of Chinese Mainland for the purposes set out in this Statement. We will satisfy the applicable condition(s) for cross-border transfer (if any) required by applicable law and regulation.

Where we collect personal information from within the EEA or UK, in circumstances where the EU GDPR or UK GDPR is applicable to PwC in providing our processing activities in question, please refer to Appendix 1.

Transfer of business

This Statement discusses information practices of PwC in the ordinary course of its business. PwC reserves the right to transfer all data in its possession to a successor-in-interest to its business or assets.

We will require such successor-in-interest to continue to be bound by this Statement, otherwise they will be required to seek your consent.

How long will we keep your personal information?

It is our policy to retain personal information only for as long as it is necessary for the fulfilment of the purposes for which the data was collected, or as required by applicable law, regulation. We may retain personal information in order to establish, exercise or defend our legal rights.

If the period necessary for the fulfilment of the purposes for which the information is to be used, agreed retention period, or legal retention period expires, or if applicable laws and regulations require the deletion of personal information, we will erase the relevant personal information according to law. If it is difficult to erase personal information technically, we will cease the processing of personal information other than storing and taking necessary security protection measures for such information.

Security

We follow internationally recognised standards for technology and operational security to safeguard personal information against loss, misuse, alteration and destruction. The data centres we use are certified to ISO/IEC 27001 security standards, and only authorised personnel have access to personal information, all of whom are bound to maintaining confidentiality. We have established a comprehensive framework of policies and procedures addressing data protection, confidentiality and security, and we continuously review and enhance our security measures to help ensure your data remains secure.

Although we implement appropriate security measures once we have received your personal information, transmission of data over the internet (including by email) is not completely secure and we cannot guarantee the security of data transmitted to or by us.

Where a personal information security incident occurs, we will respond to the incident, assess its potential impact, take appropriate actions to contain and remediate the incident. Where necessary, we will report to the appropriate authority, notify you of the incident and provide relevant information, as may be required under applicable laws and regulations.

Your rights

You have certain rights under applicable laws in relation to the personal information we hold about you, including:

Right to enquire and request for copy of personal information;
Right to update, correct or supplement your personal information which is inaccurate or incomplete;
Right to request the transfer of your personal information to a designated personal information handler;
Right to request the deletion of your personal information;
Right to request a restriction on the processing of your personal information;
Right to request cancellation of your account (if applicable);
Right to request an explanation of our personal information processing rules;
Right to withdraw your consent to processing your personal information (to the extent such processing is based on consent and consent is the only permissible basis for processing). Should your consent withdrawal be effective, we will no longer process the corresponding personal information. However, your decision to withdraw your consent will not affect the processing of personal information previously based on your authorisation; and
Other rights under applicable law.

If you would like to exercise any of these rights, please contact our Privacy Team . We will treat your requests in accordance with applicable legal requirements.

We may charge a fee for your request to access your information, if permitted by applicable law.

If you are an individual based in the EEA or UK and EU GDPR or UK GDPR is applicable to PwC in our processing activities in question, you may be entitled to additional rights (see Appendix 1).

Providing personal information of other individuals

If you are providing personal information of other individuals, please make sure that:

the personal information is from a legitimate and lawful source;
the other individuals are aware of the purpose(s) for collecting his or her personal information and all other relevant arrangement described in this Statement relating to the processing and use of personal information, and that he or she has consented to such disclosure and data processing.

We may contact you to inquire and confirm with you in relation to (i) and (ii) above. If you receive such an enquiry from us, please kindly assist and provide us with prompt response. We may have to discontinue our processing activities if we are unable to obtain the verification needed.

Children

We understand the importance of protecting children’s privacy and are committed to protecting children’s privacy. Our processing activities are not intentionally designed for or directed at children, and we do not knowingly collect or store personal information about children. In the case of collecting personal information of a minor in Chinese Mainland under the age of 14, we will only process such information if we have obtained explicit consent of the minor’s parent or guardian. We will protect the confidentiality and security of children’s personal information in accordance with relevant applicable laws and regulations.

How to contact us

If you wish to submit a request to exercise your rights, under applicable privacy and data protection law, or have questions about how your information is handled at any time, or to make complaints, please send your request to our Privacy Team. When requested, and provided that it is practical and commercially feasible to comply with the request, we will reply to your request within such time as prescribed under applicable law.

Should you not be satisfied with the way PwC has resolved your concern, you have the right to complain to the data protection authority in your territory.

Changes to this Statement

We may need to update this Statement at any time to comply with applicable law and regulations or other legitimate purposes. We may also separately advise you about the change. Subject to obtaining your explicit consent as may be required by applicable law, the new modified or amended Statement will apply from that revision date. Therefore, we encourage you to review this Statement periodically to be informed about how we are protecting your information.

Definition

“Member firm” means an entity or partnership within the worldwide network of PricewaterhouseCoopers firms and entities, each of which is a separate and independent legal entity. For further details, please see pwc.com/structure.

For a list of countries and regions where PwC firms are located, please see http://www.pwc.com/gx/en/about/office-locations.html.

“Personal information” is sometimes called “personal data” or “personal identifiable information” refers to various information related to an identified or identifiable natural person recorded electronically or by other means but does not include anonymised information. “Anonymisation” refers to irreversible technical process that makes personal information subjects unidentifiable or unassociated.

“Personal information handler” refers to an organisation or individual that autonomously determines the purposes and means of personal information processing. This is broadly equivalent to the definitions of “data user” under Hong Kong SAR’s Personal Data (Privacy) Ordinance (Cap. 486), “controller” under Macau SAR’s Personal Data Protection Act (Act 8/2005) and “controller” under the EU GDPR and the UK GDPR. Unless specified otherwise (e.g. by way of contracts), the personal information handler is the PwC member firm(s) operating in Chinese Mainland, Hong Kong SAR and Macau SAR that perform the relevant processing activities.

“Processing of personal information” includes, without limitation, the collection, storage, use, processing, transmission, provision, disclosure, and deletion of personal information.

“Sensitive personal information” refers to personal information that once leaked or illegally used, may easily lead to the infringement of the personal dignity of a natural person or may endanger his personal safety or property, including information such as biometrics, religious belief, specific identity, medical health status, financial accounts, and the person’s whereabouts, as well as the personal information of a minor in Chinese Mainland under the age of 14 years.

“Special categories of personal data” include race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health, genetic data, biometric data, sexual life or sexual orientation and criminal records.

Appendix 1: Applicable only to individuals based in the EEA or UK

Appendix 1 of this Statement applies if you are an individual based in the EEA or the UK regardless of nationality or your employer or authorised representative is providing your personal data to us from a country in the EEA or the UK, and the EU GDPR or UK GDPR is applicable to our processing activities in question. Capitalised terms have the meanings given in the Statement.

Legal grounds for processing personal data

We process personal data for the purposes set out in this Statement, as described above. For the purposes of complying with the EU GDPR or UK GDPR, we do not need to collect your consent in order to process your personal data (except in limited circumstances where we process your special categories of personal data, where we may sometimes require your consent, in which case we will obtain your consent). Instead, we rely on one or more of the following processing conditions:

our legitimate interests in the effective delivery of information and services to you and in the effective and lawful operation of our businesses and the legitimate interests of our clients in receiving professional services from us as part of running their organisation (provided these do not interfere with your rights);
our legitimate interests in developing and improving our businesses, services and offerings and in developing new PwC technologies and offerings (provided these do not interfere with your rights);
to satisfy any requirement of law, regulation or professional body of which we are a member (for example, for some of our services, we have a legal obligation to provide the service in a certain way);
to perform our obligations under a contractual arrangement with you; or
where no other processing condition is available, if you have agreed to us processing your personal data for the relevant purpose.

International transfers of personal data

Our business may require us to transfer your personal data to countries outside the EEA or the UK, including countries that may not provide the same level of data protection as your home country. Where we collect personal data from within the EEA or the UK, transfer outside the EEA or the UK will be only:

to a recipient located in a country which provides an adequate level of protection for your personal data; and/or
under an agreement which covers the EU GDPR or UK GDPR requirements.

Please contact us at the contact details in this Statement if you would like to see a copy of the specific safeguards to export of your personal data.

Your rights

You have certain rights under the EU GDPR or UK GDPR in relation to the personal data we hold about you. In particular, you have the legal rights to:

obtain confirmation as to whether we process personal data about you, receive a copy of your personal data and obtain certain other information about how and why we process your personal data;
request for your personal data to be amended or rectified where it is inaccurate (for example, if you change your address) and to have incomplete personal data completed;
delete your personal data;
restrict the processing of your personal data;
object to the processing of your personal data (if our legal basis is that the processing is necessary for our legitimate interests or those of a third party or our processing is for direct marketing purposes);
exercise your rights of data portability;
withdraw consent at any time (where processing is based on consent); and
exercise other rights under the EU GDPR or UK GDPR.

If you would like to exercise any of these rights, please contact our Privacy Team. We will treat your requests in accordance with applicable legal requirements.