The Independent Police Complaints Council is studying a report by the privacy commissioner about the leaking of a database containing the personal details of people who had filed complaints about the police.
Commissioner Roderick Woo Bun handed the study over on Monday and the council has 28 days to respond.
In March, the South China Morning Post reported that the names, addresses and identity card numbers of about 20,000 people who had complained about police over the past decade were readily available on the internet. The Office of the Privacy Commissioner received 55 complaints and launched a probe.
But Mr Woo refused to disclose the content of the report.
In its own report, the council blamed technology contractor EDPS Systems and its subcontractor, who maintained the database of confidential information, for the leak.
The privacy commissioner's report is expected to blame the council, which was understood to be ultimately responsible for safeguarding the data.