To significantly facilitate cross-border data flow from Mainland China to Hong Kong (and vice versa), the Cyberspace Administration of China (CAC) and the Innovation, Technology and Industry Bureau of the Government of the Hong Kong Special Administrative Region (ITIB) has published the template Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong–Hong Kong–Macao Greater Bay Area (Standard Contract) and its implementation guidelines on December 13, 2023.

The Standard Contract is a facilitation measure under the Memorandum of Understanding on Facilitating Cross-boundary Data Flow Within the Guangdong-Hong Kong-Macao Greater Bay Area (Memorandum) that aims to streamline the compliance arrangements concerning cross-boundary flows of personal information from Mainland cities within other cities in the Greater Bay Area to Hong Kong.

Personal information processors and recipients in the Greater Bay Area may now readily conduct cross-boundary flow of personal information between Mainland cities within the Greater Bay Area and Hong Kong by entering the Standard Contract.

The Standard Contract and its implementation guidelines detail the obligations and responsibilities of personal information processors (including data users) and recipients. In particular, the personal information processor shall:

1. Inform the personal information subject of the necessary information required or obtain the consent of the personal information subject.
2. Not transfer the personal information to any organization or individual outside the Greater Bay Area.
3. Conduct a personal information protection impact assessment.

Similarly, the recipient shall not provide personal information received to organizations or individuals outside the Greater Bay Area. If the recipient receives a request from a government department / judicial body of the jurisdiction where it is located to provide personal information received under the Standard Contract, it should immediately notify the personal information processor.

If there are any changes to the cross-boundary transfers of personal information in terms of the purpose, scope, categories, means, or the recipient’s use and means of personal information processing or the retention period is extended etc., the personal information processer shall conduct a personal information protection impact assessment afresh, enter into a supplemental agreement or a new Standard Contract and conduct the corresponding filing procedures.

In case of a personal information breach, the personal information processor or the recipient shall immediately take remedial measures and, according to its jurisdiction, notify the CAC or the ITIB.

There is also a filing requirement imposed on the personal information processor and recipient. They shall, according to the jurisdiction concerned, conduct the filing procedures of the Standard Contract within 10 working days from the effective date of the Standard Contract.

Any personal information processor or a recipient who fails to fulfill its obligations and responsibilities required may be requested by the authorities to make rectification if relatively high security risks in cross-boundary personal information processing activities or the occurrence of personal information security incidents are found.

An “early and pilot implementation” arrangement for the Standard Contract will be implemented with the first phase inviting openly participation from banking, credit referencing and healthcare sectors.

Companies can now make good use of the Standard Contract and implementation guidelines that will help ease data export restrictions in the Greater Bay Area. Sources suggest that the Standard Contract was drafted in Hong Kong, where there is strong rule of law and where clarification will be readily available.

This article was co-authored by Sylvia Tsang.