Search Menu
Language Menu
Mobile Menu
OGCIO

Facilitating Cross-boundary Data Flow within the Greater Bay Area

The Government of the Hong Kong Special Administrative Region fully recognises the strategic importance of leveraging data as a new engine propelling our economic growth, and strengthening the strategic role of data in driving the transformation and development of digital economy and society, thus contributing to data element development of the country. The 14th Five Year Plan indicates its clear support for Hong Kong’s development as an international Innovation and Technology (“I&T”) hub. Facilitating data flow in the Guangdong-Hong Kong-Macao Greater Bay Area (GBA) is an important initiative for promoting its integrated and high-quality development, streamlining the compliance arrangement of enterprises for cross boundary data flow, driving the development of Hong Kong’s digital economy and research, which helps integrating Hong Kong proactively into the national development.

The Innovation, Technology and Industry Bureau (“ITIB”) and the Cyberspace Administration of China (“CAC”) signed the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” (“the Memorandum”) in Beijing on 29 June 2023 to jointly promote cross-boundary data flow within the Greater Bay Area (“GBA”).

Facilitation measure on Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)
(hereinafter referred to as “the GBA Standard Contract”)

The “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (hereinafter referred to as “the GBA Standard Contract”) is a facilitation measure formulated jointly by the ITIB and CAC under the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area”. Its aim is to promote the safe and orderly cross-boundary flow of personal information within the GBA.

The adoption of GBA Standard Contract is on a voluntary basis. Individuals and organisations of both places may enter into a GBA Standard Contract, in accordance with the “Implementation Guidelines for Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (hereinafter referred to as “Implementation Guidelines of GBA Standard Contract”), based on a pre-designed template to outline the obligations and responsibilities of both contractual parties in protecting the personal information being transferred across the boundary. The GBA Standard Contract is applicable to the personal information processor1 and the recipient who are registered (applicable to organisations)/located (applicable to individuals) in Mainland cities within the GBA, that is, Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing, and conduct cross-boundary flow of personal information2 between these Mainland cities and Hong Kong (i.e., flow of the personal information from the Mainland cities in the GBA to Hong Kong, and vice versa). The personal information processor, by means of entering into a GBA Standard Contract may provide personal information across the boundary and such information shall not be transferred to any organisation or individual outside the GBA.


1Under the GBA Standard Contract, for the Mainland China, the “personal information processor” refers to an organisation or individual who, in the course of personal information processing activities, decide on their own the purpose and the manner of processing. For the HKSAR, it also refers to a “data user” who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data.
2Under the GBA Standard Contract, the personal information being processed by personal information processors in the Mainland within the GBA, is defined in accordance with the Personal Information Protection Law of the Mainland China. Personal information being processed by personal information processors in the HKSAR is defined in accordance with the interpretation of “personal data” under the Personal Data (Privacy) Ordinance of the HKSAR.

How to formulate the GBA Standard Contract

The GBA Standard Contract is referred to the contract entered into between the personal information processor and the recipient when conducting cross-boundary flow of personal information within the GBA. The main content includes the obligations and responsibilities of both parties, the rights of personal information subjects and related remedies, termination of contract, liability for breach of contract, dispute resolution and other matters. The personal information processor and the recipient entered into a GBA Standard Contract voluntarily to transfer personal information across the boundary, shall observe the relevant administrative measures perform filings, adhere to the protection of the rights and interests in relation to personal information, in order to safeguard the safe and free flow of personal information across the boundary.

For details of the GBA Standard Contract, please refer to the “Implementation Guidelines of GBA Standard Contract”.

Notes on Filing for the GBA Standard Contract

In accordance with the “Implementation Guidelines of GBA Standard Contract”, the personal information processor and the recipient in Hong Kong shall conduct the filing procedures with the Office of the Government Chief Information Officer (OGCIO).

The filing process of the GBA Standard Contract shall include submission of documents, checking of documents and notification of filing results, provision of supplementary information or carrying out the re-filing procedures. The filing documents shall include the following:

  • Photocopy of Identity proof of legal representative;
  • Undertaking; and
  • GBA Standard Contract (Chinese version).

The personal information processor and the recipient of Hong Kong shall conduct the filing procedures with the OGCIO within 10 working days from the effective date of the GBA Standard Contract and be held responsible for the authenticity of the documents filed.

For the filing procedures in Hong Kong, please refer to the “Filing Guidelines on Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”.

For the filing procedures of the nine Mainland cities in the GBA, please refer to Announcement by Cyberspace Administration of Guangdong Province on Facilitation measure on “Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (Chinese only) or contact the Cyberspace Administration of Guangdong Province, if required.

“Early and Pilot Implementation” Arrangement for the GBA Standard Contract

  • With the implementation of the GBA Standard Contract, the compliance arrangement of cross-boundary data flow for enterprises would be streamlined, thereby facilitating the provision of relevant cross-boundary services in the GBA and bringing convenience to the public and businesses. The GBA Standard Contract also promotes the development of GBA’s digital economy and helps Hong Kong better integrating into the national development. Meanwhile, the processing and export of personal data from Hong Kong will continue to be regulated in accordance with the Personal Data (Privacy) Ordinance of Hong Kong
  • The OGCIO and Cyberspace Administration of Guangdong Province will take forward the orderly implementation of the GBA Standard Contract together. The GBA Standard Contract will streamline the compliance arrangements on conducting cross-boundary flow of personal information within the Greater Bay Area and benefit to the public and businesses of different sectors. An “early and pilot implementation” arrangement for the GBA Standard Contract will be implemented with the first phase inviting openly participation from banking, credit referencing and healthcare sectors.
  • OGCIO has organised a briefing on the “early and pilot implementation” arrangement on 13 December 2023. Please click here for the presentation deck (Chinese only). This presentation deck is for reference only. The “Implementation Guidelines of GBA Standard Contract” shall prevail.
  • The OGCIO has received Express of Interest forms from organisations under the initial phase of the “Early and Pilot Implementation” arrangement. We will facilitate the concerned organisations to proceed with their proposed arrangement on cross-boundary flow of personal information. Individuals or organisations who are interested to participate the “early and pilot implementation” arrangement are encouraged to submit the Express of Interest form to us.
Contact Us

Office of the Government Chief Information Officer
Address : 12/F, Treasury Building, No. 3 Tonkin Street West, Cheung Sha Wan, Kowloon
E-mail: gbascc@ogcio.gov.hk

Cyberspace Administration of Guangdong Province
Tel : +86 (020) 87100793

Frequently Asked Questions
  1. What is the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” (“the Memorandum”)? What are the benefits of entering the Memorandum between Hong Kong and the Mainland?
  • The National 14th Five-Year Plan promulgated clear support for Hong Kong’s development as an international innovation and technology hub. Facilitating data flow in the Guangdong-Hong Kong-Macao Greater Bay Area (“GBA”) is an important initiative for promoting the integrated and high-quality development of the GBA and conductive to promote the development of digital economy and smart city in the GBA. To this end, the Innovation, Technology and Industry Bureau (ITIB) and the Cyberspace Administration of China (CAC) entered into the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” (“the Memorandum”) on 29 June 2023 to foster cross-boundary data flow in the GBA in a safe and orderly manner under the national management framework. The signing of the Memorandum is iconic and a policy breakthrough. It will facilitate enterprises in the GBA and streamline the compliance arrangements for conducting cross-boundary flow of data. Meanwhile, the export of data from Hong Kong will continue to be regulated in accordance with the laws of Hong Kong.
  1. What is the “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”?
  • The “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (“the GBA Standard Contract”), is a facilitation measure formulated jointly by the Cyberspace Administration of China (CAC) and the Innovation, Technology and Industry Bureau (ITIB) under the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” aiming to facilitate the cross-boundary flow of personal information within the Guangdong-Hong Kong-Macao Greater Bay Area. The adoption of the GBA Standard Contract is on a voluntary basis. It allows individuals and organisations in the Mainland cities within the GBA and Hong Kong to enter into a GBA Standard Contract based on a standardised template with both contractual parties’ responsibilities and obligations in protecting personal information regulated.
  • The GBA Standard Contract refers to the contract entered into between personal information processors and the recipients when conducting cross-boundary flow of personal information within the Greater Bay Area. The GBA Standard Contract comprises both contractual parties’ responsibilities and obligations, the rights of personal information subjects and related remedies, the termination of a contract, the liability for breach of contract, and other matters.
  1. Under what circumstances of the cross-boundary transfer of personal information will the “GBA Standard Contract” be applicable?
  • The GBA Standard Contract is a facilitation measure to promote the cross-boundary flow of personal information in the Greater Bay Area. Adoption of the GBA Standard Contract is on a voluntary basis. The personal information processors and the recipients should be registered (applicable to organisations)/located (applicable to individuals) in the Greater Bay Area, that is, Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing in the Guangdong Province, or the Hong Kong Special Administrative Region. They may conduct cross-boundary flow of personal information from the nine Mainland cities within the GBA to Hong Kong, and vice versa, by entering into the GBA Standard Contract.
  1. What are the edges of Hong Kong regarding cross-boundary data flow? What are the benefits of implementing the GBA Standard Contract?
  • Data is the key element for promoting innovation and high-quality development. The HKSAR government attaches great importance to the role of data in promoting the development of smart city and digital economy.
  • Under the “One Country, Two Systems” principle, Hong Kong allows free flow of information and possesses a sound legal system and its edges in infrastructure investments, financing and Fintech which are conducive to the convergence of global information hub. Meanwhile, Hong Kong is set to leverage the unique advantage of “dual convergence” of data from the Mainland and overseas, thus providing important raw ingredients for the development of smart city and digital economy. In parallel, the Personal Data (Privacy) Ordinance of Hong Kong has set clear regulations on protecting the privacy and security of personal data. This provides an important legal basis for protection of cross boundary flow of personal data to Hong Kong and enhances the credibility and reliability of data flows.
  • With a closer integration among cities within the Guangdong-Hong Kong-Macao Greater Bay Area (GBA), the demand for data flow between Hong Kong and other cities in the GBA is increasing. Under the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow Within the Guangdong-Hong Kong-Macao Greater Bay Area”, the Government of HKSAR and the Cyberspace Administration of Guangdong Province jointly introduce the GBA Standard Contract facilitation measure. With the implementation of the facilitation measure, the compliance arrangements of cross-boundary data flow for enterprises would be greatly streamlined, thereby facilitating the provision of relevant cross-boundary services in the GBA and bringing convenience to the public and businesses.
  1. Can the content of the GBA Standard Contract be altered based on the commercial considerations of both parties?
  • No. The GBA Standard Contract shall be entered into strictly in accordance with the Annex to the “Implementation Guidelines of GBA Standard Contract”, and cross-boundary personal information transfer shall only be conducted after the GBA Standard Contract has come into effect. Personal information processor may agree on other terms with the recipient, but such terms shall not conflict with the GBA Standard Contract. If there is any conflict between the GBA Standard Contract and any other legal documents executed by both parties, the terms of the GBA Standard Contract shall prevail.
  1. What procedures are required for adopting the GBA Standard Contract?
  • Prior to the cross-boundary transfers of personal information by entering into GBA Standard Contract, the personal information processor shall conduct a personal information protection impact assessment and complete it within 3 months before the filing date.
  • The personal information processor and the recipient shall, according to its jurisdiction concerned, conduct the filing procedures of the GBA Standard Contract with the Cyberspace Administration of Guangdong Province or the OGCIO within 10 working days from the effective date of the GBA Standard Contract. The filing documents include the photocopy of identity proof of the legal representatives, the undertaking to acknowledge provision of necessary co-operation and support for filing of the GBA Standard Contract and the signed GBA Standard Contract (Chinese version). OGCIO will complete the documents checking within 10 working days.
  • For details, please refer to the “Implementation Guidelines of GBA Standard Contract”.
  1. What should personal information processors (including data users) and recipients pay attention to when adopting the GBA Standard Contract for cross-boundary flow of personal information?
  • Adoption of the GBA Standard Contract is on voluntary basis. The personal information processor and recipient shall understand and observe the “Implementation Guidelines of GBA Standard Contract”, including conditions and requirements for entering into the contract, management procedures, etc. The personal information processor or recipient of Hong Kong shall voluntarily undertake to be supervised and managed by the Office of the Government Chief Information Officer.
  • The personal information processor and recipient who had entered into the GBA Standard Contract shall fulfill the obligations and responsibilities set out in the contract and undertake the responsibilities to protect personal information concerned. Meanwhile, the processing and export of personal data from Hong Kong will continue to be regulated in accordance with the laws of Hong Kong, including the Personal Data (Privacy) Ordinance.
  1. How to participate in the “early and pilot implementation” arrangement?
  • Individuals or organisations who are interested to participate the “early and pilot implementation” arrangement are encouraged to submit the Express of Interest form to the OGCIO.
  • The OGCIO will conduct an initial review on the received Express of Interest forms and acknowledge individuals or organisations of their intentions to participate in the “early and pilot implementation” arrangement. The concerned individual or organisation can then enter into the GBA standard contract with their mainland partners and conduct filing procedures.
  1. Can the cross-boundary flow of personal information between Hong Kong and Macau adopt the GBA Standard Contract?
  • Currently the GBA Standard Contract is only applicable to cross-boundary flow of personal information between the nine Mainland cities within the GBA (i.e. Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing) and Hong Kong, Macau is not included in the scope.
  1. Our Mainland partner (registered in Mainland cities within the GBA) is planning to provide personal information of citizens who are located in Mainland cities outside the GBA (e.g., Beijing, Shanghai, etc.). Can my organisation (registered in Hong Kong) adopt the GBA Standard Contract to receive such personal information?
  • In Mainland, the personal information processors and the recipients must be registered (applicable to organisations)/ located (applicable to individuals) in the Mainland cities within the Greater Bay Area, that is, Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing in the Guangdong Province, in order to adopt the GBA Standard Contract. Therefore, if your Mainland partners are registered (applicable to organizations) / located (applicable to individuals) in the above-mentioned regions, you may consider adopting the facilitation measure of “GBA Standard Contract” for cross-boundary flow of personal information.
  • According to the GBA Standard Contract, personal information being processed by personal information processors in the Mainland cities of the Greater Bay Area, is determined in accordance with the Personal Information Protection Law of the People’s Republic of China.
  1. My organisation and our Mainland partners have entered into a standard contract for personal information transfer activities in accordance with the Measures on the Standard Contract for Export of Personal Information (“Measures on Standard Contract”). Do we need to re-enter the “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (“GBA Standard Contract”) for conducting cross boundary flow in the Greater Bay Area?
  • The “GBA Standard Contract” facilitation measure aims to streamline the compliance arrangements for the cross-boundary flow of personal information in the Guangdong-Hong Kong-Macao Greater Bay Area and its adoption is on a voluntary basis.
  • The “Measures on Standard Contract” and the “GBA Standard Contract” facilitation measure are two different arrangements. While the scope of application, requirements, restrictions and management framework, etc., of the “Measures on Standard Contract” and the “GBA Standard Contract” facilitation measure are different, individuals or organizations that conduct cross-boundary transfers of personal information may consider adopting the “Measures on Standard Contract” and/or the “GBA Standard Contract” facilitation measure based on actual circumstances and needs. It is advised to consult legal or professional advice if necessary.
  1. Due to business needs, my organisation (registered in Hong Kong) needs to transfer customers’ personal information to our partners in Mainland cities within the Greater Bay Area. Is it a must to adopt the GBA Standard Contract?
  • According to the “Guidance on Cross-Boundary Data Transfer: Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” issued by the Office of the Privacy Commissioner for Personal Data of Hong Kong (PCPD), for cross-boundary transfer of personal data to personal information processors (covers data users) and recipients in the Greater Bay Area, the PCPD recommends eligible personal information processors (covers data users) and recipients in the Greater Bay Area to adopt GBA Standard Contract.
  • The adoption of GBA Standard Contract is on a voluntary basis. Individuals or organizations that conduct cross-boundary transfers of personal information may consider adopting GBA Standard Contract based on actual circumstances and needs. It is advised to consult legal or professional advice if necessary.
  1. What should I do if a personal information processor (covers data user) and/or recipient are found failed to fulfill the obligations and responsibilities as specified in the “Implementation Guidelines of GBA Standard Contract and / or the GBA Standard Contract?
  • If any organisation or individual discovers that a personal information processor or a recipient that conducts cross-boundary flow of personal information within the Greater Bay Area in accordance with “Implementation Guidelines of GBA Standard Contract” and / or the GBA Standard Contract fails to fulfill its obligations and responsibilities required, it may lodge a complaint or report to the Cyberspace Administration of China, the Cyberspace Administration of Guangdong Province or the Innovation, Technology and Industry Bureau, the OGCIO and the Office of the Privacy Commissioner for Personal Data Hong Kong (PCPD).
  • Upon receipt of complaints or reports, the OGCIO shall handle them in accordance with the “Implementation Guidelines of GBA Standard Contract”, if necessary, the OGCIO shall request the personal information processor or the recipient to make necessary rectification in case. The OGCIO shall work closely with the PCPD, when handling the case.
  • The PCPD will perform their supervisory and management roles under the Personal Data (Privacy) Ordinance, including handling complaints, reports, investigations, and handling of illegal personal data processing activities.
  1. My Mainland partner is not registered in the Greater Bay Area. Can we adopt the “GBA Standard Contract”?
  • No. To adopt the GBA Standard Contract, the personal information processors and the recipients should be registered in the Mainland cities within the Greater Bay Area, i.e., Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing in the Guangdong Province, or the Hong Kong Special Administrative Region (HKSAR).
  1. The GBA Standard Contract aims to facilitate cross-boundary flow of personal information in the Greater Bay Area. Will this, in disguise, encourage or cause data users in Hong Kong to transfer the personal data of Hong Kong citizens to Mainland cities within the Greater Bay Area?
  • The GBA Standard Contract is a facilitation measure to promote the cross-boundary flow of personal information in the Greater Bay Area and its adoption is on a voluntary basis. Meanwhile, the processing and export of personal data from Hong Kong will continue to be regulated in accordance with the Personal Data (Privacy) Ordinance (PDPO) of Hong Kong.
  • Besides, the Office of the Privacy Commissioner for Personal Data (PCPD) had participated to formulate the GBA Standard Contract and provided professional advices in order to ensure the implementation of cross-boundary flow of personal information to other Mainland cities in the Greater Bay Area under the GBA Standard Contract shall fulfill the regulations under the PDPO.
  • The GBA Standard Contract is an administrative measure, it does not affect the PCPD in performing their supervisory and management roles under the PDPO.
  1. My organisation (registered in Hong Kong) has already entered into the GBA Standard Contract with our Mainland partner for the cross-boundary flow of personal information. Do we or our Mainland partner need to conduct the filing procedures?
  1. It is noted that our Mainland partner (as personal information processor) has conducted the filing procedures in Mainland as required. Do we still need to conduct the filing procedures as a recipient in Hong Kong?
  1. My organisation (registered in Hong Kong) and our Mainland partner are planning to conduct cross-boundary of personal information from Mainland to Hong Kong and vice versa. Do we need to sign TWO GBA Standard Contracts to serve the purposes?
  • Yes, by adopting the GBA Standard Contract, the personal information processor and the recipient are subject to different obligations and responsibilities. Therefore, each GBA Standard Contract is only applicable to cross-boundary flow of personal information from the nine Mainland cities within the GBA to Hong Kong or vice versa. Both personal information processor and recipient shall, according to the jurisdiction concerned, conduct the filing procedures of the GBA Standard Contract with the Cyberspace Administration of Guangdong Province or the Office of Government Chief Information Officer of the HKSAR Government.
Reference Materials