Hong Kong PDPO basics for a newsletter list

Not legal advice — counsel STOP

Not legal advice. This page summarises public PCPD, CLIC, and Resend pages for operators. It is not certified PDPO, GDPR, or UEMO advice, and it is not a substitute for counsel.

Not legal advice. Confirm with counsel before you collect addresses, send the first Broadcast, or claim the list is “PDPO compliant”. This page does not certify compliance.

How this differs from sibling playbooks

This page owns consent copy, opt-out, and records. Resend bilingual newsletter owns domain and signup structure. Resend Segments + Contacts owns list CRUD. Resend Broadcast drafts owns the draft and the stop before Send.

Who it’s for / not for

Stack (spine only)

Secondary (later): a full privacy-policy page, a UEMO (Cap. 593) deep-dive, a counsel-reviewed PICS, and a cookie-banner matrix.

• HK PDPO Part VIA (direct marketing) — PCPD Guidance on Direct Marketing (Apr 2023), the PCPD consent/opt-out leaflet, and the CLIC summary of ss.35C / 35E / 35F / 35G
• Resend — Contacts / Segments / Topics / Broadcasts, the consent KB, and one-click unsubscribe in Broadcasts
• StackQuay microsite — signup form + privacy notice (wire later; copy can be drafted from this outline)

Bot vs human

Numbered steps

1. Frame: newsletter email as direct marketing (when it fits). The PCPD leaflet describes direct marketing as offering or advertising goods, facilities, or services by sending information addressed to specific persons by name, including by email. A named StackQuay newsletter can fall here. Not legal advice — you or counsel classify the exact content. (leaflet)
2. Before using personal data for your own direct marketing (s.35C outline). Inform the person you intend to use their data in direct marketing; say you may not do so unless they consent; state the kinds of personal data (email, optional name); state the classes of marketing subjects specifically (“StackQuay product updates and shipping playbook tips”, not “all goods and services of our group”); provide a free response channel. Present this in an easily readable way. (CLIC, Guidance)
3. What counts as consent. Under the PDPO outline, consent can include an indication of no objection, but silence or non-response is not consent. Oral consent needs written confirmation within 14 days (s.35E — CLIC). Resend’s consent guide wants freely given, specific, informed, unambiguous active opt-in (unchecked box). Pre-checked ToS clauses are not valid permission per that guide. A checkbox you can edit: “Yes, email me StackQuay updates and shipping tips (optional).” Link a privacy notice. Do not bury marketing consent only inside Terms.
4. Response channel on the form. PCPD examples include an email account, an online subscribe/unsubscribe facility, a correspondence address, or a hotline. For v1: the website form plus a support email. Resend Topic unsubscribe comes later.
5. Capture → Resend Contact (opt-in only). After affirmative consent, create a Contact and add it to playbook-subscribers per Resend Segments + Contacts. Store a local consent record. STOP: no CSV of purchased addresses.
6. First use notice and ongoing opt-out (ss.35F / 35G). The first time you use the data in direct marketing, tell the person they can require you to cease, free of charge. They may opt out at any time, even after earlier consent. Map that to Resend: keep Broadcast unsubscribe and Topics footers, set unsubscribed, honour Suppression, and remove them from marketing Segments. The bot never strips unsubscribe links.
7. Records outline (evidence, not legal certification). Keep an access-controlled sheet with columns such as email, name_optional, consent_at_iso, source_url, notice_version, marketing_subjects, kinds_of_data, channel, resend_contact_id, segment_ids, opt_out_at, opt_out_channel, and notes. PCPD Guidance stresses keeping consent records. Do not keep personal data longer than needed — you set retention; counsel if unsure. You own storage and access.
8. Third-party provision — STOP for v1. Giving personal data to another person for their direct marketing needs written notice and written consent. StackQuay v1 is own marketing only. No selling or renting the list.
9. Wire to the Send gate. Only after consent records and the Segment look healthy: draft a Broadcast via Resend Broadcast drafts with send: false, then you press Send. You press Send in the Dashboard.

Unsubscribe ops

PCPD good practice: maintain an Opt-Out List and update it as requests arrive (or at least weekly for offline distribution). Do not keep mailing after a known opt-out.

Failure modes / HK caveats

• Not legal advice — STOP and ask counsel before asserting compliance publicly or handling edge cases (minors, sensitive data, cross-border processors).
• Silence ≠ consent — pre-checked boxes and “by using the site you agree to marketing” are unsafe patterns.
• Vague marketing subjects — “all products of our group” is called out as too broad in PCPD examples.
• Opt-out lag — the Opt-Out List, Resend unsubscribed, and Suppression must match.
• UEMO (Cap. 593) — a separate regime. Flag it for counsel if you go beyond this newsletter outline.
• Secrets — never paste Resend API keys into chat or git.
• You approve live sends.

Newsletter CTA

Clear notice, an unchecked opt-in, a record, a Segment, a draft, then you send. Not legal advice.

Human must verify

1. Counsel review if needed before live collection or any public “PDPO compliant” claim.
2. Final consent checkbox and notice in EN and 繁中, with specific marketing subjects.
3. Privacy notice URL live before collecting.
4. Response channel monitored (email and form).
5. Consent-record storage and access control.
6. Opt-Out List process (same-day / weekly rule).
7. Resend unsubscribe footers never stripped; Topics strategy agreed.
8. No third-party list provision without a separate written-consent flow.
9. You press Send on any Broadcast.
10. UEMO and other regimes: escalate if counsel flags them.

Doc gaps

The full Cap. 486 statutory text is not pasted here (use legislation.gov.hk or counsel). The UEMO deep-dive is deferred. Some PCPD HTML pages errored for fetch tools on 2026-10-16; the PDFs above were retrieved the same day. Edge cases such as promotional lucky-draw emails are not stepped — escalate to counsel.

Docs cited

• PCPD Guidance on Direct Marketing (GN_DM_e.pdf, Apr 2023) · 2026-10-16
• PCPD leaflet — consent and opt-out from direct marketing · 2026-10-16
• CLIC — own direct marketing · 2026-10-16
• Resend — What counts as email consent? · 2026-10-16
• Resend Contacts introduction · 2026-10-16
• Resend Broadcasts introduction · 2026-10-16

Related playbooks

• Resend bilingual newsletter
• Resend Segments + Contacts
• Resend Broadcast drafts