Facilitating Cross-boundary Data Flow within the Greater Bay Area

Importance of Cross-Boundary Data Flow

Data plays a strategic role in driving innovation and facilitating high-quality development of the economy. The Government of the Hong Kong Special Administrative Region fully recognises the crucial role of data as a new engine in propelling our economic growth and transformation of digital economy and society. The 14th Five Year Plan indicates its solid support for Hong Kong’s development as an international Innovation and Technology (“I&T”) hub. Facilitating data flow in the Guangdong-Hong Kong-Macao Greater Bay Area (GBA) is an important initiative for promoting high quality development of the economy. It also contributes to drive digital economy and smart city development, which paves the way for Hong Kong to integrate into development of the GBA and the nation.

The “Memorandum”

The close tie between Hong Kong industries and Mainland business partners result in an increasing demand for cross-boundary services and data flow between Hong Kong and the Greater Bay Area. The Innovation, Technology and Industry Bureau (“ITIB”) and the Cyberspace Administration of China (“CAC”) signed the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” (“the Memorandum”) in Beijing on 29 June 2023 to promote cross-boundary data flow within the Greater Bay Area. It is a policy breakthrough to leverage data flow to promote digital economic development, while at the same time protect personal privacy and data security.

Facilitation Measures under the “Memorandum”

Facilitation Measure of “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”

The “Standard Contract for Cross-Boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (the “GBA Standard Contract”) is the first facilitation measure jointly announced by the ITIB and CAC on 13 December 2023 under the “Memorandum”. Its aim is to promote the safe and orderly cross-boundary flow of personal information within the GBA. The relevant facilitation measure will be implemented through administrative arrangements by the Digital Policy Office (DPO) (or the then Office of the Government Chief Information Officer).

The facilitation measure of the GBA Standard Contract is now extended to all sectors of industries, promoting more cross-boundary services to benefit the public and businesses while facilitating data flow throughout the GBA. Individuals or organisations who have the need to arrange cross-boundary flow of personal information between Mainland and Hong Kong within the Greater Bay Area are encouraged to adopt the GBA Standard Contract and file with the Digital Policy Office in Hong Kong.

What is the GBA Standard Contract?

Adopted on a voluntary basis, the GBA Standard Contract refers to the contract entered into between the Personal Information Processor¹ and Recipient when conducting cross-boundary flow of personal information within the GBA. It is a pre-designed contract template that outlines the obligations and responsibilities of both contractual parties in protecting the personal information being transferred across the boundary. Individuals and organisations of both Hong Kong and the nine Mainland cities in the GBA (namely, Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing) may enter into a GBA Standard Contract, in accordance with the “Implementation Guidelines on the GBA Standard Contract”, to facilitate the flow of personal information² between the nine Mainland cities and Hong Kong (i.e., flow of the personal information from the aforesaid nine Mainland cities in the GBA to Hong Kong, and vice versa).

¹Under the GBA Standard Contract, for the Mainland China, the “Personal Information Processor” refers to an organisation or individual who, in the course of personal information processing activities, decide on their own the purpose and the manner of processing. For the HKSAR, it also refers to a “data user” who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data.
²Under the GBA Standard Contract, the personal information being processed by Personal Information Processors in the Mainland within the GBA, is defined in accordance with the Personal Information Protection Law of the Mainland China. Personal information being processed by Personal Information Processors in the HKSAR is defined in accordance with the interpretation of “personal data” under the Personal Data (Privacy) Ordinance of the HKSAR.
Benefits of the GBA Standard Contract

The GBA Standard Contract streamlines the compliance arrangement of cross-boundary data flow for enterprises, thus facilitating the provision of relevant cross-boundary services in the GBA and bringing convenience to the public and business. It can lower the cost of compliance arrangement in data flow, which further promotes the digital economy and research development in the Greater Bay Area. It also solids the growth of Hong Kong into an Innovation hub and its integration into the GBA region and complement national development.

With the facilitation measure in place, the key assessment areas of Personal Information Protection Impact Assessment (PIA) in the GBA Standard Contract are simplified from six to three areas. The GBA Standard Contract, also, lifts the restriction on the volume of cross-boundary flow of personal data that a Personal Information Processor can transfer under the Mainland’s framework. The filing process for the GBA Standard Contract is also shortened to 10 working days. Thus simplifying the assessment areas and saving time and cost. Meanwhile, the processing and export of personal data from Hong Kong will continue to be regulated in accordance with the Personal Data (Privacy) Ordinance of Hong Kong
Role to Play in Cross-Boundary Data Flow

The contractual parties either play the role as the Personal Information Processor or the Recipient in the cross-boundary flow of personal information. Both parties need to comply with the relevant administrative measures, perform filings to protect personal information against risks and safeguard the safe and orderly flow of personal information across the boundary.

The Personal Information Processor may provide personal information across the boundary upon a legal and necessary business need. Prior to that, the Personal Information Processor must be in accordance with the law of its jurisdiction to get the consent of the personal information subject. The Personal Information Processor also need to conduct the Personal Information Protection Impact Assessment (PIA) within 3 months before the filing date. By entering into the GBA Standard Contract, the personal information provided across the boundary shall not be transferred to any organisation or individual outside the GBA, including the group of companies, no matter it is the parent or subsidiary corporations of organisation that are situated outside Hong Kong.

The Recipient is the receiver of personal information across the boundary. The Recipient is required to ensure the retention period of personal information shall be the minimum time necessary to achieve the purpose of processing. Upon expiry of the retention period, the personal information shall be erased. The Recipient is also required to put in place the technical and management measures to ensure the security of personal information. According to the GBA Standard Contract, the Recipient should not provide personal information to any organisation or individual outside the Greater Bay Area, including to a third party or the group of companies, no matter it is the parent or subsidiary corporations of organisation that are situated outside Hong Kong. It needs to be in the same jurisdiction of the Recipient, which is, registered or located in the nine Mainland cities within the Greater Bay Area or Hong Kong.

Video on “Introduction to the GBA Standard Contract”

Cantonese or Putonghua version
Steps of Commencing Cross-Boundary Data Flow in the GBA
1. Signing of GBA Standard Contract based on the template
  
  Adoption of the GBA Standard Contract is on a voluntary basis. The Personal Information Processor and the Recipient shall understand and observe the Implementation Guidelines of the GBA Standard Contract. The contractual parties shall enter into a GBA Standard Contract based on the templates of the GBA Standard Contract and Undertaking
  - By adopting the GBA Standard Contract, the Personal Information Processor and the Recipient are subject to different obligations and responsibilities. Therefore, each GBA Standard Contract is only applicable to cross-boundary flow of personal information from the nine Mainland cities within the GBA to Hong Kong and vice versa. If there is a need to transfer personal information to and from Hong Kong and the nine Mainland cities in the GBA, the contractual parties need to sign two sets of GBA Standard Contracts, that is one set for Hong Kong company as the Personal Information Processor, Mainland partner as the Recipient; and another one set for Mainland partner as the Personal Information Processor, and Hong Kong company as the Recipient.
2. Filing of the GBA Standard Contract in Hong Kong
  
  The Personal Information Processor and the Recipient of Hong Kong shall conduct the filing procedures with the Digital Policy Office (DPO) (or the then Office of the Government Chief Information Officer (OGCIO)) within 10 working days from the effective date of the GBA Standard Contract (that is the signing date of the GBA Standard Contract) and be held responsible for the authenticity of the documents filed.
  1. Electronic submission (e-Form) (Please mail back the filing documents required); or
  2. By hand or by mail (download form in pdf)
  - Completed filing form with signature and company chop (28/10/2024 version or after) (e-Form / form in pdf)
  - Original copy of the GBA Standard Contract with signature
    - Personal Information Processor of Hong Kong can choose to submit either in
      - Chinese version (Traditional Chinese or Simplified Chinese); or
      - Bilingual version (English/Traditional Chinese or English/Simplified Chinese);
    - Recipient of Hong Kong need to submit the Simplified Chinese version
  - Original copy of the Undertaking with signature and company chop
    - Chinese version (Traditional Chinese or Simplified Chinese); or
    - Bilingual version (English/Traditional Chinese or English/Simplified Chinese);
  - Identity proof of the legal representatives
    - Individual: Individual’s identity proof of located in Hong Kong
    - Organisation: Identity proof of organisation registered in Hong Kong and the documentary proof of the authorised representative of the company.
  Video on “How to file the GBA Standard Contract”
  
  Cantonese or Putonghua version
  
  At the same time, the contractual party in the Mainland (either Personal Information Processor or Recipient) should also conduct their filing procedures with Cyberspace Administration of Guangdong Province within 10 working days from the effective date of the GBA Standard Contract (that is the signing date of the GBA Standard Contract). For the filing procedures of the nine Mainland cities in the GBA, please refer to Announcement by Cyberspace Administration of Guangdong Province on Facilitation measure on “Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (Chinese only) or contact the Cyberspace Administration of Guangdong Province, where necessary.
3. Filing Process in Hong Kong
  
  Upon receipt of all the documents required, the DPO (or the then OGCIO) conduct checking on these documents within 10 working days; and notify the respective Personal Information Processor and Recipient upon completion of the filing process.
4. Ongoing responsibilities
  
  Both parties need to adhere to the responsibilities and obligations of protecting personal information, in order to safeguard the safe and orderly flow of personal information across the boundary.
  
  The Personal Information Processor and the Recipient of Hong Kong shall voluntarily undertake to be supervised and managed by the Digital Policy Office (or the then Office of the Government Chief Information Officer). Meanwhile, they shall observe and comply with the laws of Hong Kong, including the Personal Data (Privacy) Ordinance, when processing personal data.
  
  If there are any changes to the cross-boundary transfers of personal information in terms of the purpose, scope, categories, means, or the Recipient’s use and means of personal information processing, or the retention period is extended, or there are any other circumstances that affect or may affect the rights and interests in relation to personal information, the Personal Information Processor shall conduct again a new personal information protection impact assessment, enter into a supplemental agreement or a new Standard Contract, and conduct the corresponding filing procedures. Hong Kong contractual party needs to inform the DPO of any of these changes immediately.

Enquiry & Contact Us

Digital Policy Office
Address : 12/F, Treasury Building, No. 3 Tonkin Street West, Cheung Sha Wan, Kowloon
E-mail: gbascc@digitalpolicy.gov.hk

Cyberspace Administration of Guangdong Province
Tel : +86 (020) 87100793

Frequently Asked Questions

What is the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” (“the Memorandum”)? What are the benefits of entering the Memorandum between Hong Kong and the Mainland?

The National 14th Five-Year Plan promulgated solid support for Hong Kong’s development as an international innovation and technology hub. Facilitating data flow in the Guangdong-Hong Kong-Macao Greater Bay Area (“GBA”) is an important initiative for promoting the high quality development of the GBA, which is conducive to promoting the development of digital economy and smart city in the GBA. To this end, the Innovation, Technology and Industry Bureau (ITIB) and the Cyberspace Administration of China (CAC) entered into the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” (“the Memorandum”) on 29 June 2023 to foster cross-boundary data flow in the GBA in a safe and orderly manner under the national management framework. The signing of the Memorandum is iconic and a policy breakthrough. It will facilitate enterprises in the GBA and streamline the compliance arrangements for conducting cross-boundary flow of data. Meanwhile, the export of data from Hong Kong will continue to be regulated in accordance with the laws of Hong Kong.

What is the “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”?

The “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (“the GBA Standard Contract”), is a facilitation measure formulated jointly by the Cyberspace Administration of China (CAC) and the Innovation, Technology and Industry Bureau (ITIB) under the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” aiming to facilitate the cross-boundary flow of personal information within the Guangdong-Hong Kong-Macao Greater Bay Area. The adoption of the GBA Standard Contract is on a voluntary basis. It allows individuals and organisations in the Mainland cities within the GBA and Hong Kong to enter into a GBA Standard Contract based on a standardised contract with both contractual parties’ responsibilities and obligations in protecting personal information under the regulations.
The GBA Standard Contract refers to the contract entered into between Personal Information Processors and the Recipients when conducting cross-boundary flow of personal information within the Greater Bay Area. The GBA Standard Contract comprises both contractual parties’ responsibilities and obligations, the rights of personal information subjects and related remedies, the termination of a contract, the liability for breach of contract, and other matters.

Under what circumstances of the cross-boundary transfer of personal information will the “GBA Standard Contract” be applicable?

The GBA Standard Contract is a facilitation measure to promote the cross-boundary flow of personal information in the Greater Bay Area. Adoption of the GBA Standard Contract is on a voluntary basis. The Personal Information Processors and the Recipients should be registered (applicable to organisations)/located (applicable to individuals) in the Greater Bay Area, that is, Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing in the Guangdong Province, and the Hong Kong Special Administrative Region. By entering into the GBA Standard Contract, they may conduct cross-boundary flow of personal information from the nine Mainland cities within the GBA to Hong Kong, and vice versa.

What are the edges of Hong Kong regarding cross-boundary data flow? What are the benefits of implementing the GBA Standard Contract?

Data is the key element for promoting innovation and high-quality development. The HKSAR government recognises the strategic role of data in promoting the development of smart city and digital economy.
Under the “One Country, Two Systems” principle, Hong Kong allows free flow of information and possesses a sound legal system and its edges in infrastructure investments, financing and Fintech which are conducive to the convergence of global information hub. Meanwhile, Hong Kong is set to leverage the unique advantage of “convergence” of data from the Mainland and overseas, thus providing important elements for the development of smart city and digital economy. In parallel, the Personal Data (Privacy) Ordinance of Hong Kong has set clear regulations on protecting the privacy and security of personal data. This provides an important legal basis for protection of cross boundary flow of personal data to Hong Kong and enhances the credibility and reliability of data flows.
Further on the integration of cities within the Greater Bay Area (GBA), the demand for data flow between Hong Kong and other cities in the GBA is increasing. Under the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow Within the Guangdong-Hong Kong-Macao Greater Bay Area”, the Government of HKSAR and the Cyberspace Administration of China jointly introduce the GBA Standard Contract facilitation measure. With the implementation of the facilitation measure, the compliance arrangements of cross-boundary data flow for enterprises would be greatly streamlined, thereby facilitating the provision of relevant cross-boundary services in the GBA and bringing convenience to the public and businesses.

Can the content of the GBA Standard Contract be altered based on the commercial considerations of both parties?

No. The GBA Standard Contract shall be entered into strictly in accordance with the “Implementation Guidelines of the GBA Standard Contract” and templates of the GBA Standard Contract, and cross-boundary personal information transfer shall only be conducted after the GBA Standard Contract has come into effect. Personal Information Processor may agree on other terms with the Recipient, but such terms shall not be in conflict with the GBA Standard Contract. If there is any conflict between the GBA Standard Contract and any other legal documents conducted by both parties, the terms of the GBA Standard Contract shall prevail.

What procedures are required for adopting the GBA Standard Contract?

Adoption of the GBA Standard Contract is on a voluntary basis. Prior to the cross-boundary transfers of personal information by entering into GBA Standard Contract, the Personal Information Processor shall conduct a personal information protection impact assessment and complete it within 3 months before the filing date.
The Personal Information Processor and the Recipient shall, according to its jurisdiction concerned, conduct the filing procedures of the GBA Standard Contract with the Cyberspace Administration of Guangdong Province and the Digital Policy Office (DPO) (or the then Office of the Government Chief Information Officer (OGCIO)) respectively within 10 working days from the effective date of the GBA Standard Contract (that is the signing date of the GBA Standard Contract). For details, please refer to the “Implementation Guidelines of the GBA Standard Contract”.

What should Personal Information Processors (including data users) and Recipients pay attention to when adopting the GBA Standard Contract for cross-boundary flow of personal information?

Adoption of the GBA Standard Contract is on a voluntary basis. The Personal Information Processor and the Recipient shall understand and observe the “Implementation Guidelines of the GBA Standard Contract” and the GBA Standard Contract, including conditions and requirements for entering into the contract, management procedures, etc. The Personal Information Processor or the Recipient of Hong Kong shall voluntarily undertake to be supervised and managed by the Digital Policy Office (or the then Office of the Government Chief Information Officer).
The Personal Information Processor and the Recipient who had entered into the GBA Standard Contract shall fulfill the obligations and responsibilities set out in the contract and undertake the responsibilities to protect personal information concerned. Meanwhile, the processing and export of personal data from Hong Kong will continue to be regulated in accordance with the laws of Hong Kong, including the Personal Data (Privacy) Ordinance.

Is the GBA Standard Contract applicable to the cross-boundary flow of personal information between Hong Kong and Macau?

Currently the GBA Standard Contract is only applicable to cross-boundary flow of personal information between the nine Mainland cities within the GBA (i.e. Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing) and Hong Kong, Macau is not included in the scope.

Our Mainland partner (registered in Mainland cities within the GBA) is planning to provide personal information of citizens who are located in Mainland cities outside the GBA (e.g., Beijing, Shanghai, etc.). Can my organisation (registered in Hong Kong) adopt the GBA Standard Contract to receive such personal information?

In adoption of the GBA Standard Contract, the Personal Information Processors and the Recipients must be registered (applicable to organisations)/located (applicable to individuals) in the nine Mainland cities within the Greater Bay Area, that is, Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing in the Guangdong Province. If your Mainland partners are registered (applicable to organisations)/located (applicable to individuals) in the above-mentioned regions, you may consider adopting the facilitation measure of “GBA Standard Contract” for cross-boundary flow of personal information.
According to the GBA Standard Contract, personal information being processed by Personal Information Processors in the Mainland cities of the Greater Bay Area, is determined in accordance with the Personal Information Protection Law of the People’s Republic of China.

My organisation and our Mainland partners have entered into a standard contract for personal information transfer activities in accordance with the Measures on the Standard Contract for Export of Personal Information (“Measures on Standard Contract”). Do we need to re-enter the “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (“GBA Standard Contract”) for conducting cross boundary flow in the Greater Bay Area?

The “GBA Standard Contract” facilitation measure aims to streamline the compliance arrangements for the cross-boundary flow of personal information in the Guangdong-Hong Kong-Macao Greater Bay Area and its adoption is on a voluntary basis.
The “Measures on Standard Contract” and the “GBA Standard Contract” facilitation measure are two different arrangements. While the scope of application, requirements, restrictions and management framework, etc., of the “Measures on Standard Contract” and the “GBA Standard Contract” facilitation measure are different, individuals or organisations that conduct cross-boundary transfers of personal information may consider adopting the “Measures on Standard Contract” and/or the “GBA Standard Contract” facilitation measure based on actual circumstances and needs. It is advised to consult legal or professional advice if necessary.

Due to business needs, my organisation (registered in Hong Kong) needs to transfer customers’ personal information to our partners in Mainland cities within the Greater Bay Area. Is it a must to adopt the GBA Standard Contract?

According to the “Guidance on Cross-Boundary Data Transfer: Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” issued by the Office of the Privacy Commissioner for Personal Data of Hong Kong (PCPD), for cross-boundary transfer of personal data within the Greater Bay Area, the PCPD recommends eligible Personal Information Processors and Recipients in the Greater Bay Area to adopt GBA Standard Contract.
The adoption of GBA Standard Contract is on a voluntary basis. Individuals or organisations that conduct cross-boundary transfers of personal information may consider adopting GBA Standard Contract based on actual circumstances and needs. It is advised to consult legal or professional advice if necessary.

What should I do if a Personal Information Processor (covers data user) and/or Recipient are found failed to fulfill the obligations and responsibilities as specified in the “Implementation Guidelines of the GBA Standard Contract and / or the GBA Standard Contract?

If any organisation or individual discovers that a Personal Information Processor or a Recipient that conducts cross-boundary flow of personal information within the Greater Bay Area in accordance with “Implementation Guidelines of the GBA Standard Contract” and / or the GBA Standard Contract fails to fulfill its obligations and responsibilities required, they may file a complaint or report to the Cyberspace Administration of China, the Cyberspace Administration of Guangdong Province or the Innovation, Technology and Industry Bureau, the Digital Policy Office (DPO) (or the then Office of the Government Chief Information Officer (OGCIO)) and the Office of the Privacy Commissioner for Personal Data Hong Kong (PCPD).
Upon receipt of complaints or reports, the DPO (or the then OGCIO) shall handle them in accordance with the “Implementation Guidelines of the GBA Standard Contract”, if necessary, the DPO (or the then OGCIO) shall request the Personal Information Processor or the Recipient to make necessary rectification in case. The DPO (or the then OGCIO) shall work closely with the PCPD, when handling the case.
The PCPD will perform their supervisory and management roles under the Personal Data (Privacy) Ordinance, including handling complaints, reports, investigations, and handling of illegal personal data processing activities.

My Mainland partner is not registered in the Greater Bay Area. Can we adopt the “GBA Standard Contract”?

No. To adopt the GBA Standard Contract, the Personal Information Processors and the Recipients should be registered in the Mainland cities within the Greater Bay Area, i.e., Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing in the Guangdong Province, or the Hong Kong Special Administrative Region (HKSAR).

The GBA Standard Contract aims to facilitate cross-boundary flow of personal information in the Greater Bay Area. Will this, in disguise, encourage or cause data users in Hong Kong to transfer the personal data of Hong Kong citizens to Mainland cities within the Greater Bay Area?

The GBA Standard Contract is a facilitation measure to promote the cross-boundary flow of personal information in the Greater Bay Area and its adoption is on a voluntary basis. Meanwhile, the processing and export of personal data from Hong Kong will continue to be regulated in accordance with the Personal Data (Privacy) Ordinance (PDPO) of Hong Kong.
Besides, the Office of the Privacy Commissioner for Personal Data (PCPD) had participated to formulate the GBA Standard Contract and provided professional advices in order to ensure the implementation of cross-boundary flow of personal information to the nine Mainland cities in the Greater Bay Area under the GBA Standard Contract shall fulfill the regulations under the PDPO.
The GBA Standard Contract is a facilitation measure being implemented through administrative arrangements by the Digital Policy Office, it does not affect the PCPD in performing their supervisory and management roles under the PDPO.

My organisation (registered in Hong Kong) has already entered into the GBA Standard Contract with our Mainland partner for the cross-boundary flow of personal information. Do we or our Mainland partner need to conduct the filing procedures?

According to the “Implementation Guidelines of the GBA Standard Contract”, the Personal Information Processor and the Recipient (i.e., both contractual parties) are required to conduct the filing procedures of the GBA Standard Contract within 10 working days from the effective date of the GBA Standard Contract (that is the signing date of the GBA Standard Contract).
The contractual party (whether as a Personal Information Processor or a Recipient) registered / located in Hong Kong shall conduct the filing procedures with the DPO (or the then OGCIO). For details, please refer to the Steps of Commencing Cross-Boundary Data Flow in the GBA.
The contractual party (whether as a Personal Information Processor or a Recipient) registered / located in the nine Mainland cities within the GBA (i.e. Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing) shall conduct the filing procedures with the GDCAC. For details, please refer to the Announcement by Cyberspace Administration of Guangdong Province on Facilitation measure on “Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (Chinese only).

It is noted that our Mainland partner (as Personal Information Processor) has conducted the filing procedures in Mainland as required. Do we still need to conduct the filing procedures as a Recipient in Hong Kong?

Yes. In accordance with the “Implementation Guidelines of the GBA Standard Contract” the Personal Information Processor and the Recipient shall, according to the jurisdiction concerned, conduct the filing procedures with the Cyberspace Administration of Guangdong Province and the Digital Policy Office (or the then Office of the Government Chief Information Officer) of the HKSAR Government respectively within 10 working days from the effective date of the GBA Standard Contract (that is the signing date of the GBA Standard Contract). For details, please refer to the “Filing Guidelines on Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”.

My organisation (registered in Hong Kong) and our Mainland partner are planning to conduct cross-boundary of personal information from Mainland to Hong Kong and vice versa. Do we need to sign TWO (2) sets of GBA Standard Contract to serve the purposes?

Yes, by adopting the GBA Standard Contract, the Personal Information Processor and the Recipient are subject to different obligations and responsibilities. Therefore, each set of GBA Standard Contract is only applicable to cross-boundary flow of personal information from the nine Mainland cities within the GBA to Hong Kong or vice versa.

Can we adopt one (1) set of GBA Standard Contract for all personal data, which covers multiple business aspects, of my organisation?

The adoption of GBA Standard Contract covers personal information of multiple business aspects and scenarios, such as loan business, syndication, or wealth management, etc., of banking industry, of the same organisation. With a view to save the efforts in entering into several contracts for multiple scenarios, an organisation can adopt one set of GBA Standard Contract covering all scenarios of cross-boundary transfer of personal information, provided that the concerned Personal Information Processor and the Recipient as well as purposes on cross-boundary transfer of personal information are same in these business scenarios.

The Cyberspace Administration of China (CAC) announced the “Regulations on Facilitating and Regulating Cross-Border Data Flow” (“the Regulations”) on 22 March 2024. Under relevant regulations, are Personal Information Processors still required to adopt the “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (“the GBA Standard Contract”)?

On 22 March 2024, the CAC announced the Regulations which lifted certain restrictions on conducting cross-border data transfer from the Mainland with a view to facilitate cross-boundary data flow under the national regime of protecting data security. The Regulations lifted certain restrictions regarding the need of entering into “Standard contract for cross-border transfer of personal information”, which are applicable to the GBA Standard Contract.

Useful Reference

Promotional Videos

Relevant Documents