What's New

Facilitating Cross-boundary Data Flow within the Greater Bay Area

Importance of Cross-Boundary Data Flow

Data plays a strategic role in driving innovation and facilitating high-quality development of the economy. The Government of the Hong Kong Special Administrative Region fully recognises the crucial role of data as a new engine in propelling our economic growth and transformation of digital economy and society. The 14th Five Year Plan indicates its solid support for Hong Kong’s development as an international Innovation and Technology (“I&T”) hub. Facilitating data flow in the Guangdong-Hong Kong-Macao Greater Bay Area (GBA) is an important initiative for promoting high quality development of the economy. It also contributes to drive digital economy and smart city development, which paves the way for Hong Kong to integrate into development of the GBA and the nation.

The “Memorandum”

The close tie of Hong Kong industries and Mainland business partners results in an increasing demand for cross-boundary services and data flow between Hong Kong and the Greater Bay Area. The Innovation, Technology and Industry Bureau (“ITIB”) and the Cyberspace Administration of China (“CAC”) signed the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” (“the Memorandum”) in Beijing on 29 June 2023 to promote cross-boundary data flow within the Greater Bay Area (“GBA”). It is a policy breakthrough to leverage data flow to promote digital economic development, while at the same time protect personal privacy and data security.

Facilitation Measures under the “Memorandum”

  • Facilitation Measure of “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”

    The “Standard Contract for Cross-Boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (The “GBA Standard Contract”) is the first facilitation measure jointly announced by the ITIB and CAC on 13 December 2023 under the “Memorandum”. Its aim is to promote the safe and orderly cross-boundary flow of personal information within the GBA. The relevant facilitation measure will be implemented through administrative arrangements by the Digital Policy Office (DPO) (or the then Office of the Government Chief Information Officer).

  • “Early and Pilot Implementation” Arrangement

    An “Early and Pilot Implementation” arrangement for facilitation measure of the GBA Standard Contract has been implemented with the first phase inviting participation from banking, credit referencing and healthcare sectors.

    • A briefing on the “Early and Pilot Implementation” arrangement has been organised on 13 December 2023. Please click here for the presentation deck (Chinese only). This presentation deck is for reference only.
    • The Digital Policy Office (DPO) has received Express of Interest forms from organisations under the “Early and Pilot Implementation” arrangement. We will facilitate the concerned organisations to proceed with their proposed arrangement on cross-boundary flow of personal information. Individuals or organisations which are interested to participate in the “Early and Pilot Implementation” arrangement are encouraged to submit the Express of Interest form to us.

  1. What is the GBA Standard Contract?

    Adopted on a voluntary basis, the GBA Standard Contract referred to the contract entered into between the personal information processor1 and recipient when conducting cross-boundary flow of personal information within the GBA. It is a pre-designed contract template that outline the obligations and responsibilities of both contractual parties in protecting the personal information being transferred across the boundary. Individuals and organisations of both Hong Kong and the nine Mainland cities in the GBA (namely, Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing) may enter into a GBA Standard Contract, in accordance with the “Implementation Guidelines on the GBA Standard Contract”, to facilitate the flow of personal information2 between the nine Mainland cities and Hong Kong (i.e., flow of the personal information from the aforesaid nine Mainland cities in the GBA to Hong Kong, and vice versa).

    1Under the GBA Standard Contract, for the Mainland China, the “personal information processor” refers to an organisation or individual who, in the course of personal information processing activities, decide on their own the purpose and the manner of processing. For the HKSAR, it also refers to a “data user” who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data.
    2Under the GBA Standard Contract, the personal information being processed by personal information processors in the Mainland within the GBA, is defined in accordance with the Personal Information Protection Law of the Mainland China. Personal information being processed by personal information processors in the HKSAR is defined in accordance with the interpretation of “personal data” under the Personal Data (Privacy) Ordinance of the HKSAR.

  2. Benefits of the GBA Standard Contract

    The GBA Standard Contract streamlined the compliance arrangement of cross-boundary data flow for enterprises, thus facilitating the provision of relevant cross-boundary services in the GBA and bringing convenience to the public and business. It can lower the cost of compliance arrangement in data flow, which further promotes the digital economy and research development in the Greater Bay Area. It also solids the growth of Hong Kong into an Innovation hub and its integration into the GBA region and complement national development.

    With the facilitation measure, the key assessment areas of Personal Information Protection Impact Assessment (PIA) in the GBA Standard Contract are simplified from six to three areas. The filing process for the GBA Standard Contract is also shortened from 15 working days to 10 working days. Thus simplifying the assessment areas and saving time and cost. Meanwhile, the processing and export of personal data from Hong Kong will continue to be regulated in accordance with the Personal Data (Privacy) Ordinance of Hong Kong

  3. Role to Play in Cross-Boundary Data Flow

    The contractual parties either play the role as the Personal Information Processor or the Recipient in the cross-boundary flow of personal information. Both parties need to comply with the relevant administrative measures, perform filings to protect personal information against risks and safeguard the safe and orderly flow of personal information across the boundary.

    The Personal Information Processor may provide personal information across the boundary upon a legal and necessary business need. Prior to that, the personal information processor must be in accordance with the law of its place to get the consent of the personal information subject. The Personal Information Processor also need to conduct the Personal Information Protection Impact Assessment (PIA) within 3 months before the filing date. It is the responsibility of the Personal Information Processor not to transfer personal information to any organisation or individual outside the Greater Bay Area.

    The Recipient is the receiver of personal information across the boundary. The Recipient need to ensure the retention period of personal information shall be the minimum time necessary to achieve the purpose of processing. Upon expiry of the retention period, the personal information shall be erased. The Recipient also needs to adopt technical and management measures to ensure the security of personal information. According to the GBA Standard Contract, the Recipient should not provide personal information to any organisation or individual outside the Greater Bay Area, including to a third party. It needs to be in the same jurisdiction, that is, registered or located in the Mainland cities within the Greater Bay Area or the HKSAR.

  4. Steps of Commencing Cross-Boundary Data Flow in the GBA

    1. Signing of GBA Standard Contract based on the template

      On a voluntary basis, the contractual parties should signed the GBA Standard Contract and the “Undertaking” according to the Implementation Guidelines and the templates of the Contract and “Undertaking”.

      • By adopting the GBA Standard Contract, the personal information processor and the recipient are subject to different obligations and responsibilities. Therefore, each GBA Standard Contract is only applicable to cross-boundary flow of personal information from the nine Mainland cities within the GBA to Hong Kong or from Hong Kong to the nine Mainland cities in the GBA. If there is a need to transfer personal information to and from Hong Kong and the nine Mainland cities in the GBA, contracting parties need to sign two GBA Standard Contracts, that is one for Hong Kong company as the Personal Information Processor, Mainland partner as the Recipient; and another one for Mainland partner as the Personal Information Processor, and Hong Kong company as the Recipient.

      Please download and make reference to the Implementation Guidelines of the GBA Standard Contract and templates of the GBA Standard Contract and Undertaking.

    2. Filing of the GBA Standard Contract in Hong Kong

      The personal information processor and the recipient of Hong Kong shall conduct the filing procedures with the Digital Policy Office (DPO) (the then Office of the Government Chief Information Officer (OGCIO)) within 10 working days from the effective date of the GBA Standard Contract (that is the signing date of the GBA Standard Contract) and be held responsible for the authenticity of the documents filed.

      At the same time, the contracting party in the Mainland (either Personal Information Processor or Recipient) should also conduct their filing procedures with Cyberspace Administration of Guangdong Province within 10 working days from the effective date of the GBA Standard Contract (that is the signing date of the GBA Standard Contract). For the filing procedures of the nine Mainland cities in the GBA, please refer to Announcement by Cyberspace Administration of Guangdong Province on Facilitation measure on “Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (Chinese only) or contact the Cyberspace Administration of Guangdong Province, if required..

    3. Filing Process in Hong Kong

      Upon receipt of all the required documents, the DPO (the then OGCIO) will do the checking on the documents within 10 working days; and a notification email will be sent to the respective Personal Information Processor and Recipient upon completion of the filing process.

    4. Ongoing responsibilities

      Both parties need to adhere to the responsibilities and obligations to protect personal information, in order to safeguard the safe and orderly flow of personal information across the boundary.

      If there are any changes to the cross-boundary transfers of personal information in terms of the purpose, scope, categories, means, or the recipient’s use and means of personal information processing, or the retention period is extended, or there are any other circumstances that affect or may affect the rights and interests in relation to personal information, the personal information processor shall conduct again a new personal information protection impact assessment, enter into a supplemental agreement or a new Standard Contract, and conduct the corresponding filing procedures. Hong Kong contracting party needs to inform the DPO of any of these changes immediately.

Digital Policy Office
Address : 12/F, Treasury Building, No. 3 Tonkin Street West, Cheung Sha Wan, Kowloon
E-mail: gbascc@digitalpolicy.gov.hk

Cyberspace Administration of Guangdong Province
Tel : +86 (020) 87100793

  1. What is the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” (“the Memorandum”)? What are the benefits of entering the Memorandum between Hong Kong and the Mainland?
  • The National 14th Five-Year Plan promulgated solid support for Hong Kong’s development as an international innovation and technology hub. Facilitating data flow in the Guangdong-Hong Kong-Macao Greater Bay Area (“GBA”) is an important initiative for promoting the high quality development of the GBA and conductive to promoting the development of digital economy and smart city in the GBA. To this end, the Innovation, Technology and Industry Bureau (ITIB) and the Cyberspace Administration of China (CAC) entered into the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” (“the Memorandum”) on 29 June 2023 to foster cross-boundary data flow in the GBA in a safe and orderly manner under the national management framework. The signing of the Memorandum is iconic and a policy breakthrough. It will facilitate enterprises in the GBA and streamline the compliance arrangements for conducting cross-boundary flow of data. Meanwhile, the export of data from Hong Kong will continue to be regulated in accordance with the laws of Hong Kong.
  1. What is the “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”?
  • The “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (“the GBA Standard Contract”), is a facilitation measure formulated jointly by the Cyberspace Administration of China (CAC) and the Innovation, Technology and Industry Bureau (ITIB) under the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” aiming to facilitate the cross-boundary flow of personal information within the Guangdong-Hong Kong-Macao Greater Bay Area. The adoption of the GBA Standard Contract is on a voluntary basis. It allows individuals and organisations in the Mainland cities within the GBA and Hong Kong to enter into a GBA Standard Contract based on a standardised contract with both contractual parties’ responsibilities and obligations in protecting personal information under the regulations.
  • The GBA Standard Contract refers to the contract entered into between personal information processors and the recipients when conducting cross-boundary flow of personal information within the Greater Bay Area. The GBA Standard Contract comprises both contractual parties’ responsibilities and obligations, the rights of personal information subjects and related remedies, the termination of a contract, the liability for breach of contract, and other matters.
  1. Under what circumstances of the cross-boundary transfer of personal information will the “GBA Standard Contract” be applicable?
  • The GBA Standard Contract is a facilitation measure to promote the cross-boundary flow of personal information in the Greater Bay Area. Adoption of the GBA Standard Contract is on a voluntary basis. The personal information processors and the recipients should be registered (applicable to organisations)/located (applicable to individuals) in the Greater Bay Area, that is, Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing in the Guangdong Province, and the Hong Kong Special Administrative Region. By entering into the GBA Standard Contract, they may conduct cross-boundary flow of personal information from the nine Mainland cities within the GBA to Hong Kong, and vice versa.
  1. What are the edges of Hong Kong regarding cross-boundary data flow? What are the benefits of implementing the GBA Standard Contract?
  • Data is the key element for promoting innovation and high-quality development. The HKSAR government recognises the strategic role of data in promoting the development of smart city and digital economy.
  • Under the “One Country, Two Systems” principle, Hong Kong allows free flow of information and possesses a sound legal system and its edges in infrastructure investments, financing and Fintech which are conducive to the convergence of global information hub. Meanwhile, Hong Kong is set to leverage the unique advantage of “convergence” of data from the Mainland and overseas, thus providing important elements for the development of smart city and digital economy. In parallel, the Personal Data (Privacy) Ordinance of Hong Kong has set clear regulations on protecting the privacy and security of personal data. This provides an important legal basis for protection of cross boundary flow of personal data to Hong Kong and enhances the credibility and reliability of data flows.
  • Further on the integration of cities within the Guangdong-Hong Kong-Macao Greater Bay Area (GBA), the demand for data flow between Hong Kong and other cities in the GBA is increasing. Under the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow Within the Guangdong-Hong Kong-Macao Greater Bay Area”, the Government of HKSAR and the Cyberspace Administration of China jointly introduce the GBA Standard Contract facilitation measure. With the implementation of the facilitation measure, the compliance arrangements of cross-boundary data flow for enterprises would be greatly streamlined, thereby facilitating the provision of relevant cross-boundary services in the GBA and bringing convenience to the public and businesses.
  1. Can the content of the GBA Standard Contract be altered based on the commercial considerations of both parties?
  • No. The GBA Standard Contract shall be entered into strictly in accordance with the Annex to the “Implementation Guidelines of the GBA Standard Contract”, and cross-boundary personal information transfer shall only be conducted after the GBA Standard Contract has come into effect. Personal information processor may agree on other terms with the recipient, but such terms shall not conflict with the GBA Standard Contract. If there is any conflict between the GBA Standard Contract and any other legal documents conducted by both parties, the terms of the GBA Standard Contract shall prevail.
  1. What procedures are required for adopting the GBA Standard Contract?
  • Prior to the cross-boundary transfers of personal information by entering into GBA Standard Contract, the personal information processor shall conduct a personal information protection impact assessment and complete it within 3 months before the filing date.
  • The personal information processor and the recipient shall, according to its jurisdiction concerned, conduct the filing procedures of the GBA Standard Contract with the Cyberspace Administration of Guangdong Province and the Digital Policy Office (DPO) (the then Office of the Government Chief Information Officer (OGCIO)) respectively within 10 working days from the effective date of the GBA Standard Contract (that is the signing date of the GBA Standard Contract). The filing documents include the photocopy of identity proof of the legal representatives, the undertaking to acknowledge provision of necessary co-operation and support for filing of the GBA Standard Contract and the signed GBA Standard Contract (Chinese version in traditional Chinese or simplified Chinese). The DPO will complete the documents checking within 10 working days.
  • For details, please refer to the “Implementation Guidelines of the GBA Standard Contract”.
  1. What should personal information processors (including data users) and recipients pay attention to when adopting the GBA Standard Contract for cross-boundary flow of personal information?
  • Adoption of the GBA Standard Contract is on voluntary basis. The personal information processor and recipient shall understand and observe the “Implementation Guidelines of the GBA Standard Contract”, including conditions and requirements for entering into the contract, management procedures, etc. The personal information processor or recipient of Hong Kong shall voluntarily undertake to be supervised and managed by the Digital Policy Office (or the then Office of the Government Chief Information Officer).
  • The personal information processor and recipient who had entered into the GBA Standard Contract shall fulfill the obligations and responsibilities set out in the contract and undertake the responsibilities to protect personal information concerned. Meanwhile, the processing and export of personal data from Hong Kong will continue to be regulated in accordance with the laws of Hong Kong, including the Personal Data (Privacy) Ordinance.
  1. How to participate in the “early and pilot implementation” arrangement?
  • Individuals or organisations who are interested to participate the “early and pilot implementation” arrangement are encouraged to submit the Express of Interest formto the Digital Policy Office (DPO) (the then Office of the Government Chief Information Officer (OGCIO)) .
  • The DPO (the then OGCIO) will conduct an initial review on the received Express of Interest forms and acknowledge individuals or organisations of their intentions to participate in the “early and pilot implementation” arrangement. The concerned individual or organisation can then enter into the GBA standard contract with their mainland partners and conduct filing procedures.
  1. Can the cross-boundary flow of personal information between Hong Kong and Macau adopt the GBA Standard Contract?
  • Currently the GBA Standard Contract is only applicable to cross-boundary flow of personal information between the nine Mainland cities within the GBA (i.e. Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing) and Hong Kong, Macau is not included in the scope.
  1. Our Mainland partner (registered in Mainland cities within the GBA) is planning to provide personal information of citizens who are located in Mainland cities outside the GBA (e.g., Beijing, Shanghai, etc.). Can my organisation (registered in Hong Kong) adopt the GBA Standard Contract to receive such personal information?
  • In adoption of the GBA Standard Contract, the personal information processors and the recipients must be registered (applicable to organisations)/located (applicable to individuals) in the nine Mainland cities within the Greater Bay Area, that is, Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing in the Guangdong Province. If your Mainland partners are registered (applicable to organisations)/located (applicable to individuals) in the above-mentioned regions, you may consider adopting the facilitation measure of “GBA Standard Contract” for cross-boundary flow of personal information.
  • According to the GBA Standard Contract, personal information being processed by personal information processors in the Mainland cities of the Greater Bay Area, is determined in accordance with the Personal Information Protection Law of the People’s Republic of China.
  1. My organisation and our Mainland partners have entered into a standard contract for personal information transfer activities in accordance with the Measures on the Standard Contract for Export of Personal Information (“Measures on Standard Contract”). Do we need to re-enter the “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (“GBA Standard Contract”) for conducting cross boundary flow in the Greater Bay Area?
  • The “GBA Standard Contract” facilitation measure aims to streamline the compliance arrangements for the cross-boundary flow of personal information in the Guangdong-Hong Kong-Macao Greater Bay Area and its adoption is on a voluntary basis.
  • The “Measures on Standard Contract” and the “GBA Standard Contract” facilitation measure are two different arrangements. While the scope of application, requirements, restrictions and management framework, etc., of the “Measures on Standard Contract” and the “GBA Standard Contract” facilitation measure are different, individuals or organizations that conduct cross-boundary transfers of personal information may consider adopting the “Measures on Standard Contract” and/or the “GBA Standard Contract” facilitation measure based on actual circumstances and needs. It is advised to consult legal or professional advice if necessary.
  1. Due to business needs, my organisation (registered in Hong Kong) needs to transfer customers’ personal information to our partners in Mainland cities within the Greater Bay Area. Is it a must to adopt the GBA Standard Contract?
  • According to the “Guidance on Cross-Boundary Data Transfer: Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” issued by the Office of the Privacy Commissioner for Personal Data of Hong Kong (PCPD), for cross-boundary transfer of personal data to personal information processors (covers data users) and recipients in the Greater Bay Area, the PCPD recommends eligible personal information processors (covers data users) and recipients in the Greater Bay Area to adopt GBA Standard Contract.
  • The adoption of GBA Standard Contract is on a voluntary basis. Individuals or organizations that conduct cross-boundary transfers of personal information may consider adopting GBA Standard Contract based on actual circumstances and needs. It is advised to consult legal or professional advice if necessary.
  1. What should I do if a personal information processor (covers data user) and/or recipient are found failed to fulfill the obligations and responsibilities as specified in the “Implementation Guidelines of the GBA Standard Contract and / or the GBA Standard Contract?
  • If any organisation or individual discovers that a personal information processor or a recipient that conducts cross-boundary flow of personal information within the Greater Bay Area in accordance with “Implementation Guidelines of the GBA Standard Contract” and / or the GBA Standard Contract fails to fulfill its obligations and responsibilities required, it may file a complaint or report to the Cyberspace Administration of China, the Cyberspace Administration of Guangdong Province or the Innovation, Technology and Industry Bureau, the Digital Policy Office (DPO) (the then Office of the Government Chief Information Officer (OGCIO)) and the Office of the Privacy Commissioner for Personal Data Hong Kong (PCPD).
  • Upon receipt of complaints or reports, the DPO (the then OGCIO) shall handle them in accordance with the “Implementation Guidelines of the GBA Standard Contract”, if necessary, the DPO (the then OGCIO) shall request the personal information processor or the recipient to make necessary rectification in case. The DPO (the then OGCIO) shall work closely with the PCPD, when handling the case.
  • The PCPD will perform their supervisory and management roles under the Personal Data (Privacy) Ordinance, including handling complaints, reports, investigations, and handling of illegal personal data processing activities.
  1. My Mainland partner is not registered in the Greater Bay Area. Can we adopt the “GBA Standard Contract”?
  • No. To adopt the GBA Standard Contract, the personal information processors and the recipients should be registered in the Mainland cities within the Greater Bay Area, i.e., Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing in the Guangdong Province, or the Hong Kong Special Administrative Region (HKSAR).
  1. The GBA Standard Contract aims to facilitate cross-boundary flow of personal information in the Greater Bay Area. Will this, in disguise, encourage or cause data users in Hong Kong to transfer the personal data of Hong Kong citizens to Mainland cities within the Greater Bay Area?
  • The GBA Standard Contract is a facilitation measure to promote the cross-boundary flow of personal information in the Greater Bay Area and its adoption is on a voluntary basis. Meanwhile, the processing and export of personal data from Hong Kong will continue to be regulated in accordance with the Personal Data (Privacy) Ordinance (PDPO) of Hong Kong.
  • Besides, the Office of the Privacy Commissioner for Personal Data (PCPD) had participated to formulate the GBA Standard Contract and provided professional advices in order to ensure the implementation of cross-boundary flow of personal information to the nine Mainland cities in the Greater Bay Area under the GBA Standard Contract shall fulfill the regulations under the PDPO.
  • The GBA Standard Contract is an administrative measure, it does not affect the PCPD in performing their supervisory and management roles under the PDPO.
  1. My organisation (registered in Hong Kong) has already entered into the GBA Standard Contract with our Mainland partner for the cross-boundary flow of personal information. Do we or our Mainland partner need to conduct the filing procedures?
  1. It is noted that our Mainland partner (as personal information processor) has conducted the filing procedures in Mainland as required. Do we still need to conduct the filing procedures as a recipient in Hong Kong?
  1. My organisation (registered in Hong Kong) and our Mainland partner are planning to conduct cross-boundary of personal information from Mainland to Hong Kong and vice versa. Do we need to sign TWO GBA Standard Contracts to serve the purposes?
  • Yes, by adopting the GBA Standard Contract, the personal information processor and the recipient are subject to different obligations and responsibilities. Therefore, each GBA Standard Contract is only applicable to cross-boundary flow of personal information from the nine Mainland cities within the GBA to Hong Kong or vice versa. Both personal information processor and recipient shall, according to the jurisdiction concerned, conduct the filing procedures of the GBA Standard Contract with the Cyberspace Administration of Guangdong Province and the Digital Policy Office (or the then Office of the Government Chief Information Officer) of the HKSAR Government respectively.
  1. Can we adopt one (1) set of “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (“the GBA Standard Contract”) for all personal data, which covers multiple business aspects, of my organisation?
  • The adoption of GBA Standard Contract covers personal information of multiple business aspects and scenarios, such as loan business, syndication, or wealth management, etc., of banking industry, of the same organisation. With a view to save the efforts in entering into several contracts for multiple scenarios, an organisation can adopt one set of GBA Standard Contract covering all scenarios of cross-boundary transfer of personal information, provided that the concerned personal information processor and recipient as well as purposes on cross-boundary transfer of personal information are same in these business scenarios.
  1. The Cyberspace Administration of China (CAC) announced the “Regulations on Facilitating and Regulating Cross-Border Data Flow” (“the Regulations”) on 22 March 2024. Under relevant regulations, are personal information processors still required to adopt the “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (“the GBA Standard Contract”)?
  • On 22 March 2024, the CAC announced the Regulations which lifted certain restrictions on conducting cross-border data transfer from the Mainland with a view to facilitate cross-boundary data flow under the national regime of protecting data security. The Regulations lifted certain restrictions regarding the need of entering into “Standard contract for cross-border transfer of personal information”, which are applicable to the GBA Standard Contract.

Relevant Documents

Reference Materials

2024 Policy Address Public Consultation
The 2024-25 Budget Public Consultation
Facilitating of the Cross-boundary Data Flow within the Greater Bay Area
Exhibition of the 4th Anniversary of Hong Kong National Security Law
Digital Inclusion Programme for the Elderlies
Enriched ICT Training Programme for the Elderly - Courses of the new round invite enrolment applications
ICT Outreach Programme for the Elderly
Let Social Enterprises Bloom!
Legislative Control of Cannabidiol (CBD)
National Security Education Day
Electronic Health Record Sharing System (eHealth)
Improve Electoral System Ensure Patriots Administering Hong Kong
iAM Smart Safe and Swift
CSDI website
Safeguarding National Security
Multi-functional Smart Lampposts
ICT Event Calendar
Smart Government Innovation Lab
talent.gov.hk
New Patent System
Elderly IT Learning Portal
Hong Kong Legal Hub
Guangdong-Hong Kong-Macao Greater Bay Area
Cybersec Infohub
Corruption Prevention Advisory Service
Cyber Security Information Portal
IT Career Role Models Platform
Hong Kong Smart City
Digital Accessibility Campaign
Mutual Recognition of Electronic Signature Certificates issued by Hong Kong and Guangdong
Marketing Consultancy Office (Rehabilitation)
Developing Datacentre in Hong Kong
Wi-Fi․HK
GovHK Website
Government Computer Emergency Response Team Hong Kong (GovCERT․HK)
DATA․GOV․HK
Hong Kong ICT Awards
INFO SEC
Student IT Corner
1823
SIE Fund