Personal Data (Privacy) Ordinance Schedule 1 S1-10 Section 4 Cap. 486 (4) In this section— new purpose (新目的), in relation to the use of personal data, means any purpose other than— (a) the purpose for which the data was to be used at the time of the collection of the data; or (b) a purpose directly related to the purpose referred to in paragraph (a). (Added 18 of 2012 s. 40) 4. Principle 4—security of personal data (1) All practicable steps shall be taken to ensure that any personal data (including data in a form in which access to or processing of the data is not practicable) held by a data user is protected against unauthorized or accidental access, processing, erasure, loss or use having particular regard to—  (Amended 18 of 2012 s. 40; 17 of 2018 s. 129) (a) the kind of data and the harm that could result if any of those things should occur; (b) the physical location where the data is stored; (Amended 18 of 2012 s. 40) (c) any security measures incorporated (whether by automated means or otherwise) into any equipment in which the data is stored; (Amended 18 of 2012 s. 40) (d) any measures taken for ensuring the integrity, prudence and competence of persons having access to the data; and (e) any measures taken for ensuring the secure transmission of the data. (2) Without limiting subsection (1), if a data user engages a data processor, whether within or outside Hong Kong, to process personal data on the data user’s behalf, the data user must adopt contractual or other means to prevent unauthorized or Verified Copy Last updated date 20.4.2018