Why a Fundraising Broadcast Is a Legal Event, Not Just a Campaign
Why the PDPO Treats a Donation Ask as Direct Marketing
Building a Supporter List That Survives a Complaint
Broadcast, Template or Conversation? Choosing the Right Message Type
The Pre-Send Check: Ten Minutes That Prevents a Complaint
Running the Campaign Without Burning the List
What a Broadcast Cannot Fix
A programme manager at a Kwun Tong social service NGO has a supporter list of roughly twelve thousand phone numbers, assembled over eight years from street sign-ups, event registrations, volunteer forms, an old donation platform and three spreadsheets that predate the current database. The year-end appeal is four weeks away. The board wants a messaging campaign because the last email appeal reached fewer people than the mailing list would suggest.
The payoff, by the numbers
Before the detail, here is why this is worth the team’s time:
The instinct is understandable and the tooling is cheap. The risk is that most Hong Kong NGOs treat a fundraising broadcast as a marketing decision, when Hong Kong law treats it as a regulated use of personal data with criminal consequences attached.
This matters more, not less, as messaging replaces email. A supporter who ignores a fundraising email deletes it. A supporter who receives an unwanted fundraising message on WhatsApp experiences it as an intrusion into a personal space, and the complaint route to the Privacy Commissioner is short and free.
The good news is that the rules are legible and the compliant version of the campaign generally performs better, because it is sent to people who agreed to hear from you. What follows is the sequence a Hong Kong NGO can actually run, and the specific points where well-meaning fundraising teams get it wrong.
Fundraisers often assume the direct marketing provisions of the Personal Data (Privacy) Ordinance (Cap. 486) apply to businesses selling things, and that a charity asking for support sits outside them. It does not. The Ordinance's definition of direct marketing expressly covers the solicitation of donations or contributions for charitable, cultural, philanthropic, recreational, political and other purposes.
The practical consequence is that when your NGO sends a supporter a message asking them to give, you are doing the same regulated thing a retailer does when it sends a promotion — and Part 6A of the Ordinance applies in full.
You must tell the supporter before you use their data this way. The notification has to say that you intend to use their personal data in direct marketing, which kinds of data you will use, and what classes of marketing subjects the messages will cover. It must be presented so it is easily readable and understandable, and it must be free to respond to.
You must have their consent, and you must be able to prove it. Consent in this context means an indication of no objection given by the supporter. A blank tick box that nobody ticked is not consent, and a list inherited from a partner organisation almost never carries usable consent.
You must tell them on the first use that they can opt out at any time, free of charge. And when a supporter does opt out, you must stop, across every channel that opt-out reasonably covers.
Transferring supporter data to another organisation for their own marketing is a separate and stricter matter. Providing personal data to a third party for use in direct marketing requires its own written consent, and where data is provided for gain the Ordinance treats the breach more seriously still. List swaps between charities, which used to be routine, are the highest-risk practice in the sector.
Breaches of the direct marketing provisions are criminal offences carrying fines and, in the more serious provision-for-gain cases, the possibility of imprisonment. For a charity, the reputational consequence of an enforcement notice usually outweighs the penalty itself.
The work that makes a fundraising broadcast defensible happens months before the campaign. It consists of separating a supporter database into what you may actually send, and being honest about the parts you may not.
Start by tagging every contact with where the record came from and what the supporter was told at the time. Then sort into three tiers. The first is supporters who received a compliant notification and gave consent for fundraising messages on a messaging channel. The second is supporters you may contact for a specific administrative purpose — a receipt, an event they registered for, a recurring gift they set up — but not to solicit. The third is contacts with no usable record, which for messaging purposes do not exist.
| Where the contact came from | Can you send a fundraising broadcast? | Apa yang harus dilakukan selanjutnya |
|---|---|---|
| Sign-up form with a clear direct-marketing notice and opt-in | Yes, within the classes described in the notice | Record the notice version and the timestamp |
| Donation receipt only, no marketing notice | No — administrative contact only | Ask for opt-in on the next legitimate contact |
| Event registration with no fundraising notice | Tidak | Add a compliant notice to the registration form |
| Volunteer roster | No, unless volunteering consent covered fundraising | Separate volunteer comms from donor appeals |
| List received from a partner charity | Tidak | Do not import; the consent does not travel |
| Business card or a WhatsApp group of well-wishers | Tidak | Invite them to opt in through your own form |
Two practices are worth adopting permanently. Record consent as an event, not a flag: who consented, when, through which form, and which version of the notice they saw. And re-permission deliberately rather than opportunistically — a short, honest message to a lapsed segment asking whether they want to keep hearing from you will shrink the list and improve every metric that follows.
Supporters also give you an operational gift when they opt in on a messaging channel: they can reply. A fundraising email is a broadcast into silence, while a message that a supporter can answer turns a campaign into a conversation your team can act on.
Hong Kong NGOs typically arrive at WhatsApp expecting it to behave like a mailing list. It does not. The WhatsApp Business Platform distinguishes between messages a business starts and messages a customer starts, and it puts business-initiated messages into approved template categories.
A fundraising appeal is a Marketing template. A donation receipt, a confirmation that a recurring gift was processed, or a reminder about an event the supporter signed up for is a Utility template, because it relates to a transaction the supporter already entered into. When a supporter messages you first, a 24-hour customer service window opens in which your team can reply freely without a template — which is where the actual conversation happens.
| Message type | Consent required | Typical NGO use | Notes |
|---|---|---|---|
| Marketing template | Direct-marketing notification plus consent under Part 6A | Year-end appeal, emergency appeal, campaign launch | Highest consent bar and highest cost |
| Utility template | Relationship with the supporter for that transaction | Donation receipt, recurring gift reminder, event confirmation | Must not carry an embedded ask |
| Authentication template | Account relationship | Verifying a login to a supporter portal | Rarely needed by small NGOs |
| Free-form reply in the service window | Supporter messaged you first | Answering questions, taking a pledge, resolving a failed payment | Where relationship building actually happens |
Two disciplines keep this clean. First, never smuggle an appeal into a Utility template because it is cheaper — that is the fastest route to template rejection and a falling quality rating, and it also breaks the PDPO logic that made the Utility message permissible in the first place. Second, plan for cost. Meta has moved to per-message pricing for template messages, and from 1 October 2026 service messages and utility templates sent inside the customer service window become billable rather than free. Model the appeal at your real list size before you commit the campaign budget.
The checks below are ordered by how often they are the thing that went wrong. None of them require a lawyer, and all of them are faster than responding to an enquiry from the Privacy Commissioner's office.
Is every recipient in the consented tier? Not the tier you believe is consented — the tier your records can evidence, filtered on the day of the send.
Does the message fall inside the classes you notified? If the notice described appeals for your own programmes, an appeal on behalf of a partner organisation is outside it.
Is the opt-out visible, free and honoured automatically? A reply of STOP should remove the supporter without a staff member remembering to do it, and the removal should apply to future appeals across channels.
Has anyone who opted out since the last campaign been suppressed? This is the most common breach in practice: a clean send from a stale export.
Is the sender identifiable, with a real route to a human? Supporters must be able to tell who is asking and reach someone about it.
Are the claims in the appeal accurate? Impact statements should be traceable to your own programme reporting, not rounded up for the campaign.
Does the activity need a permit? Fundraising in public places in Hong Kong — flag days, street collections, selling items in public places — is licensed, and the Social Welfare Department is the starting point. A digital appeal to your own supporters generally sits outside the public-place permit regime, but the Department's best-practice guidance on charitable fundraising still sets the expectation for how you conduct it.
Who can see the supporter data? Volunteers helping with a campaign should not have standing access to the full donor database. Role-based access and named accounts are the difference between a controlled campaign and an uncontrolled one.
Is the retention period defined? Supporter messages should not accumulate indefinitely because nobody chose a policy.
Sequencing matters as much as compliance. A messaging channel is more intimate than email, which makes it more effective and less forgiving. The pattern below works for a typical year-end or emergency appeal.
Segment before you write. Recurring donors, lapsed donors, one-off donors and non-donor supporters need different asks. A single message written for everyone performs worst with the group that matters most.
Send one considered appeal, not a drip. Two to three touches across a campaign is the realistic ceiling on a messaging channel before opt-outs accelerate. Make the first message carry the argument.
Staff the replies for the first four hours. Supporters will answer with questions, with pledges, and occasionally with a complaint. Every reply opens a service window in which your team can talk normally, and that conversation is worth more than the broadcast that triggered it.
Route donations to one link and instrument it. If you cannot attribute gifts to the message, you cannot defend the channel at the next budget meeting.
Honour opt-outs the same day and thank people who gave. A short, specific thank-you on the same channel is the cheapest retention activity available to a Hong Kong NGO.
Debrief with numbers. Delivery, read, reply, opt-out and gifts, by segment. Opt-out rate by segment is the health metric — if it climbs, reduce frequency before it costs you the list.
NGOs that adopt messaging expecting it to reverse a fundraising decline usually discover the decline had another cause. Being explicit about the limits protects the channel from being blamed for problems it never touched.
It does not fix a weak case for support. If supporters cannot tell what their gift changes, a faster channel simply delivers a vague ask more efficiently.
It does not create permission. A twelve-thousand-name list with three thousand consented contacts is a three-thousand-name list. Messaging the rest is not a growth tactic, it is an exposure.
It does not replace stewardship. Donors lapse because nobody told them what happened to their money. That is a reporting problem and a calendar problem, not a channel problem.
It does not survive over-use. The channel's advantage is that supporters read it. Send too often and they stop, and unlike email, they tell you by leaving.
| Symptom | Likely cause | Where the fix sits |
|---|---|---|
| High delivery, low giving | Unclear case for support | Campaign proposition, not the channel |
| Opt-out rate rising each appeal | Frequency too high for the channel | Contact policy and campaign calendar |
| Small reachable audience | Consent never captured at sign-up | Forms, notices and re-permission |
| Complaints about unexpected messages | Sending outside the notified classes | Notice wording and list segmentation |
| Cannot attribute gifts to the appeal | No tracked donation link | Instrumentation before the send |
| Replies unanswered for days | No roster for the service window | Staffing the first hours of the campaign |
Used with discipline, WhatsApp gives a Hong Kong NGO something email stopped providing years ago: appeals that are actually read, and supporters who can answer. imBee supports that with an omnichannel inbox, role-based access, retention controls and audit logging as an Official Meta Technology Partner, working with 10,000+ enterprises across 60+ industries. The NGO remains the data user under the Ordinance and owns its consent records; the platform's job is to make those obligations easy to keep, not to assume them.
Does the PDPO apply to charity fundraising in Hong Kong?
Yes. The Personal Data (Privacy) Ordinance (Cap. 486) defines direct marketing to include soliciting donations or contributions for charitable, cultural, philanthropic and similar purposes. A fundraising appeal sent to supporters is therefore regulated in the same way as a commercial promotion, and Part 6A's notification, consent and opt-out requirements apply in full.
Can a Hong Kong NGO send WhatsApp broadcasts to its supporter list?
Only to supporters who received a compliant direct-marketing notification and gave consent, and only within the classes of subject that notification described. Contacts collected for receipts, event registration or volunteering do not automatically carry fundraising consent, and a list obtained from another charity carries none at all.
What counts as consent under the direct marketing provisions?
An indication of no objection given by the supporter, after they have been told which data will be used and what classes of marketing they will receive. It should be recorded as an event with a timestamp, the collection route and the version of the notice shown, so it can be evidenced later rather than asserted.
Can we buy or swap a supporter list with another charity?
Providing personal data to another organisation for their direct marketing requires separate written consent from the individual, and the Ordinance treats provision for gain more seriously still. In practice, importing a partner charity's list is the highest-risk activity in the sector and should be treated as off-limits without explicit, documented consent.
Which WhatsApp template category does a donation appeal use?
A fundraising appeal is a Marketing template, because it asks the supporter to do something they did not specifically request. Receipts, recurring-gift reminders and event confirmations are Utility templates tied to an existing transaction. Placing an appeal inside a Utility template to reduce cost risks rejection and undermines the consent basis.
Do we need a permit to fundraise in Hong Kong?
Fundraising in public places — flag days, street collections and selling items in public places — is licensed, and the Social Welfare Department is the starting point for the relevant permits. A digital appeal to your own consented supporters generally falls outside the public-place permit regime, but the Department's best-practice guidance still sets the conduct expectation.
How often can we message supporters without losing them?
Two to three touches across a campaign is the realistic ceiling on a messaging channel. Messaging is read far more reliably than email, which makes over-use costly: supporters respond by opting out rather than ignoring you. Track opt-out rate by segment after each appeal and reduce frequency before the number climbs.
What should we do with supporters who opted out?
Suppress them immediately and automatically, across every channel the opt-out reasonably covers, and keep the suppression record permanently so a future export cannot reintroduce them. The most common real-world breach is not a deliberate one — it is a clean campaign sent from a list that was exported before the last round of opt-outs.
Kelly S.
Content Team Lead, imBee
Kelly S. owns content strategy, product positioning, and customer education at imBee. Previously, Kelly led B2B SaaS content programs and supported go-to-market initiatives for customer engagement products. On the imBee blog, Kelly covers conversational commerce, omnichannel messaging, WhatsApp Business, customer experience, and strategies for scaling business communications.
Questions about anything in this article? Talk to our team.
Mulai uji coba gratis 30 hari Anda hari ini. Tingkatkan produktivitas tim Anda lebih dari 30% dan bawa bisnis Anda ke tingkat kesuksesan yang lebih tinggi.
