Facilitating Cross-boundary Data Flow within the Greater Bay Area

Office of the Government Chief Information Officer
Address : 12/F, Treasury Building, No. 3 Tonkin Street West, Cheung Sha Wan, Kowloon
E-mail: gbascc@ogcio.gov.hk

Cyberspace Administration of Guangdong Province
Tel : +86 (020) 87100793

Relevant Documents

• Implementation Guidelines on Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)
• Annex 1: Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong) (Chinese only)
• Expression of Interest for “early and pilot implementation” of the Facilitation measure: “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (Updated on 24 Jan 2024)
• Filing Guidelines on Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong) (Updated on 19 Mar 2024)

Reference Materials

• Press Release - Facilitation measure on “Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” and its early and pilot implementation arrangements (13 December 2023)
• Announcement by the CAC (Chinese only) (13 December 2023)
• Announcement by Cyberspace Administration of Guangdong Province on Facilitation measure on “Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (Chinese only) (4 January 2024)
• Privacy Commissioner’s Office Welcomes the Facilitation Measures of Using Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong–Hong Kong–Macao Greater Bay Area (Mainland, Hong Kong) (13 December 2023)
• Press Release - ITIB and CAC signed Memorandum of Understanding (29 June 2023)
• “Facilitating Cross-boundary Data Flow Within the Guangdong-Hong Kong-Macao Greater Bay Area” Discussion Paper of Legislative Council Panel on Information Technology and Broadcasting (5 February 2024)
• “Guidance on Cross-boundary Data Transfer: Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong – Hong Kong – Macao Greater Bay Area (Mainland, Hong Kong)” by PCPD (13 December 2023)
• The Personal Data (Privacy) Ordinance of Hong Kong
• “Guidance on Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data” by PCPD (May 2022)
• “Guidance on Personal Data Protection in Cross-border Data Transfer” by PCPD (December 2014)
• Mainland’s Personal Information Protection Law (Chinese only)
• Mainland’s Security Assessment Measures on Cross-border Transfers of Data (Chinese only)
• Announcement by the CAC on Regulating and Facilitating Cross-Border Data Flow (Chinese only) (22 March 2024)

1. What is the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” (“the Memorandum”)? What are the benefits of entering the Memorandum between Hong Kong and the Mainland?

• The National 14th Five-Year Plan promulgated clear support for Hong Kong’s development as an international innovation and technology hub. Facilitating data flow in the Guangdong-Hong Kong-Macao Greater Bay Area (“GBA”) is an important initiative for promoting the integrated and high-quality development of the GBA and conductive to promote the development of digital economy and smart city in the GBA. To this end, the Innovation, Technology and Industry Bureau (ITIB) and the Cyberspace Administration of China (CAC) entered into the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” (“the Memorandum”) on 29 June 2023 to foster cross-boundary data flow in the GBA in a safe and orderly manner under the national management framework. The signing of the Memorandum is iconic and a policy breakthrough. It will facilitate enterprises in the GBA and streamline the compliance arrangements for conducting cross-boundary flow of data. Meanwhile, the export of data from Hong Kong will continue to be regulated in accordance with the laws of Hong Kong.

2. What is the “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”?

• The “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (“the GBA Standard Contract”), is a facilitation measure formulated jointly by the Cyberspace Administration of China (CAC) and the Innovation, Technology and Industry Bureau (ITIB) under the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” aiming to facilitate the cross-boundary flow of personal information within the Guangdong-Hong Kong-Macao Greater Bay Area. The adoption of the GBA Standard Contract is on a voluntary basis. It allows individuals and organisations in the Mainland cities within the GBA and Hong Kong to enter into a GBA Standard Contract based on a standardised template with both contractual parties’ responsibilities and obligations in protecting personal information regulated.
• The GBA Standard Contract refers to the contract entered into between personal information processors and the recipients when conducting cross-boundary flow of personal information within the Greater Bay Area. The GBA Standard Contract comprises both contractual parties’ responsibilities and obligations, the rights of personal information subjects and related remedies, the termination of a contract, the liability for breach of contract, and other matters.

3. Under what circumstances of the cross-boundary transfer of personal information will the “GBA Standard Contract” be applicable?

• The GBA Standard Contract is a facilitation measure to promote the cross-boundary flow of personal information in the Greater Bay Area. Adoption of the GBA Standard Contract is on a voluntary basis. The personal information processors and the recipients should be registered (applicable to organisations)/located (applicable to individuals) in the Greater Bay Area, that is, Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing in the Guangdong Province, or the Hong Kong Special Administrative Region. They may conduct cross-boundary flow of personal information from the nine Mainland cities within the GBA to Hong Kong, and vice versa, by entering into the GBA Standard Contract.

4. What are the edges of Hong Kong regarding cross-boundary data flow? What are the benefits of implementing the GBA Standard Contract?

• Data is the key element for promoting innovation and high-quality development. The HKSAR government attaches great importance to the role of data in promoting the development of smart city and digital economy.
• Under the “One Country, Two Systems” principle, Hong Kong allows free flow of information and possesses a sound legal system and its edges in infrastructure investments, financing and Fintech which are conducive to the convergence of global information hub. Meanwhile, Hong Kong is set to leverage the unique advantage of “dual convergence” of data from the Mainland and overseas, thus providing important raw ingredients for the development of smart city and digital economy. In parallel, the Personal Data (Privacy) Ordinance of Hong Kong has set clear regulations on protecting the privacy and security of personal data. This provides an important legal basis for protection of cross boundary flow of personal data to Hong Kong and enhances the credibility and reliability of data flows.
• With a closer integration among cities within the Guangdong-Hong Kong-Macao Greater Bay Area (GBA), the demand for data flow between Hong Kong and other cities in the GBA is increasing. Under the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow Within the Guangdong-Hong Kong-Macao Greater Bay Area”, the Government of HKSAR and the Cyberspace Administration of China jointly introduce the GBA Standard Contract facilitation measure. With the implementation of the facilitation measure, the compliance arrangements of cross-boundary data flow for enterprises would be greatly streamlined, thereby facilitating the provision of relevant cross-boundary services in the GBA and bringing convenience to the public and businesses.

5. Can the content of the GBA Standard Contract be altered based on the commercial considerations of both parties?

• No. The GBA Standard Contract shall be entered into strictly in accordance with the Annex to the “Implementation Guidelines of GBA Standard Contract”, and cross-boundary personal information transfer shall only be conducted after the GBA Standard Contract has come into effect. Personal information processor may agree on other terms with the recipient, but such terms shall not conflict with the GBA Standard Contract. If there is any conflict between the GBA Standard Contract and any other legal documents executed by both parties, the terms of the GBA Standard Contract shall prevail.

6. What procedures are required for adopting the GBA Standard Contract?

• Prior to the cross-boundary transfers of personal information by entering into GBA Standard Contract, the personal information processor shall conduct a personal information protection impact assessment and complete it within 3 months before the filing date.
• The personal information processor and the recipient shall, according to its jurisdiction concerned, conduct the filing procedures of the GBA Standard Contract with the Cyberspace Administration of Guangdong Province and the OGCIO respectively within 10 working days from the effective date of the GBA Standard Contract. The filing documents include the photocopy of identity proof of the legal representatives, the undertaking to acknowledge provision of necessary co-operation and support for filing of the GBA Standard Contract and the signed GBA Standard Contract (Chinese version). OGCIO will complete the documents checking within 10 working days.
• For details, please refer to the “Implementation Guidelines of GBA Standard Contract”.

7. What should personal information processors (including data users) and recipients pay attention to when adopting the GBA Standard Contract for cross-boundary flow of personal information?

• Adoption of the GBA Standard Contract is on voluntary basis. The personal information processor and recipient shall understand and observe the “Implementation Guidelines of GBA Standard Contract”, including conditions and requirements for entering into the contract, management procedures, etc. The personal information processor or recipient of Hong Kong shall voluntarily undertake to be supervised and managed by the Office of the Government Chief Information Officer.
• The personal information processor and recipient who had entered into the GBA Standard Contract shall fulfill the obligations and responsibilities set out in the contract and undertake the responsibilities to protect personal information concerned. Meanwhile, the processing and export of personal data from Hong Kong will continue to be regulated in accordance with the laws of Hong Kong, including the Personal Data (Privacy) Ordinance.

8. How to participate in the “early and pilot implementation” arrangement?

• Individuals or organisations who are interested to participate the “early and pilot implementation” arrangement are encouraged to submit the Express of Interest form to the OGCIO.
• The OGCIO will conduct an initial review on the received Express of Interest forms and acknowledge individuals or organisations of their intentions to participate in the “early and pilot implementation” arrangement. The concerned individual or organisation can then enter into the GBA standard contract with their mainland partners and conduct filing procedures.

9. Can the cross-boundary flow of personal information between Hong Kong and Macau adopt the GBA Standard Contract?

• Currently the GBA Standard Contract is only applicable to cross-boundary flow of personal information between the nine Mainland cities within the GBA (i.e. Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing) and Hong Kong, Macau is not included in the scope.

10. Our Mainland partner (registered in Mainland cities within the GBA) is planning to provide personal information of citizens who are located in Mainland cities outside the GBA (e.g., Beijing, Shanghai, etc.). Can my organisation (registered in Hong Kong) adopt the GBA Standard Contract to receive such personal information?

• In Mainland, the personal information processors and the recipients must be registered (applicable to organisations)/ located (applicable to individuals) in the Mainland cities within the Greater Bay Area, that is, Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing in the Guangdong Province, in order to adopt the GBA Standard Contract. Therefore, if your Mainland partners are registered (applicable to organizations) / located (applicable to individuals) in the above-mentioned regions, you may consider adopting the facilitation measure of “GBA Standard Contract” for cross-boundary flow of personal information.
• According to the GBA Standard Contract, personal information being processed by personal information processors in the Mainland cities of the Greater Bay Area, is determined in accordance with the Personal Information Protection Law of the People’s Republic of China.

11. My organisation and our Mainland partners have entered into a standard contract for personal information transfer activities in accordance with the Measures on the Standard Contract for Export of Personal Information (“Measures on Standard Contract”). Do we need to re-enter the “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (“GBA Standard Contract”) for conducting cross boundary flow in the Greater Bay Area?

• The “GBA Standard Contract” facilitation measure aims to streamline the compliance arrangements for the cross-boundary flow of personal information in the Guangdong-Hong Kong-Macao Greater Bay Area and its adoption is on a voluntary basis.
• The “Measures on Standard Contract” and the “GBA Standard Contract” facilitation measure are two different arrangements. While the scope of application, requirements, restrictions and management framework, etc., of the “Measures on Standard Contract” and the “GBA Standard Contract” facilitation measure are different, individuals or organizations that conduct cross-boundary transfers of personal information may consider adopting the “Measures on Standard Contract” and/or the “GBA Standard Contract” facilitation measure based on actual circumstances and needs. It is advised to consult legal or professional advice if necessary.

12. Due to business needs, my organisation (registered in Hong Kong) needs to transfer customers’ personal information to our partners in Mainland cities within the Greater Bay Area. Is it a must to adopt the GBA Standard Contract?

• According to the “Guidance on Cross-Boundary Data Transfer: Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” issued by the Office of the Privacy Commissioner for Personal Data of Hong Kong (PCPD), for cross-boundary transfer of personal data to personal information processors (covers data users) and recipients in the Greater Bay Area, the PCPD recommends eligible personal information processors (covers data users) and recipients in the Greater Bay Area to adopt GBA Standard Contract.
• The adoption of GBA Standard Contract is on a voluntary basis. Individuals or organizations that conduct cross-boundary transfers of personal information may consider adopting GBA Standard Contract based on actual circumstances and needs. It is advised to consult legal or professional advice if necessary.

13. What should I do if a personal information processor (covers data user) and/or recipient are found failed to fulfill the obligations and responsibilities as specified in the “Implementation Guidelines of GBA Standard Contract and / or the GBA Standard Contract?

• If any organisation or individual discovers that a personal information processor or a recipient that conducts cross-boundary flow of personal information within the Greater Bay Area in accordance with “Implementation Guidelines of GBA Standard Contract” and / or the GBA Standard Contract fails to fulfill its obligations and responsibilities required, it may lodge a complaint or report to the Cyberspace Administration of China, the Cyberspace Administration of Guangdong Province or the Innovation, Technology and Industry Bureau, the OGCIO and the Office of the Privacy Commissioner for Personal Data Hong Kong (PCPD).
• Upon receipt of complaints or reports, the OGCIO shall handle them in accordance with the “Implementation Guidelines of GBA Standard Contract”, if necessary, the OGCIO shall request the personal information processor or the recipient to make necessary rectification in case. The OGCIO shall work closely with the PCPD, when handling the case.
• The PCPD will perform their supervisory and management roles under the Personal Data (Privacy) Ordinance, including handling complaints, reports, investigations, and handling of illegal personal data processing activities.

14. My Mainland partner is not registered in the Greater Bay Area. Can we adopt the “GBA Standard Contract”?

• No. To adopt the GBA Standard Contract, the personal information processors and the recipients should be registered in the Mainland cities within the Greater Bay Area, i.e., Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing in the Guangdong Province, or the Hong Kong Special Administrative Region (HKSAR).

15. The GBA Standard Contract aims to facilitate cross-boundary flow of personal information in the Greater Bay Area. Will this, in disguise, encourage or cause data users in Hong Kong to transfer the personal data of Hong Kong citizens to Mainland cities within the Greater Bay Area?

• The GBA Standard Contract is a facilitation measure to promote the cross-boundary flow of personal information in the Greater Bay Area and its adoption is on a voluntary basis. Meanwhile, the processing and export of personal data from Hong Kong will continue to be regulated in accordance with the Personal Data (Privacy) Ordinance (PDPO) of Hong Kong.
• Besides, the Office of the Privacy Commissioner for Personal Data (PCPD) had participated to formulate the GBA Standard Contract and provided professional advices in order to ensure the implementation of cross-boundary flow of personal information to other Mainland cities in the Greater Bay Area under the GBA Standard Contract shall fulfill the regulations under the PDPO.
• The GBA Standard Contract is an administrative measure, it does not affect the PCPD in performing their supervisory and management roles under the PDPO.

16. My organisation (registered in Hong Kong) has already entered into the GBA Standard Contract with our Mainland partner for the cross-boundary flow of personal information. Do we or our Mainland partner need to conduct the filing procedures?

• According to the “Implementation Guidelines of GBA Standard Contract”, the personal information processor and the recipient shall, according to its jurisdiction concerned, conduct the filing procedures of the GBA Standard Contract with the Cyberspace Administration of Guangdong Province (GDCAC) and the OGCIO respectively within 10 working days from the effective date of the GBA Standard Contract.
• The contractual party (whether as a personal information processor or a recipient) registered / located in the nine Mainland cities within the GBA (i.e. Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing) shall conduct the filing procedures with the GDCAC. For details, please refer to the Announcement by Cyberspace Administration of Guangdong Province on Facilitation measure on “Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (Chinese only).
• While the contractual party (whether as a personal information processor or a recipient) registered / located in Hong Kong shall conduct the filing procedures with the OGCIO. For details, please refer to the “Filing Guidelines on Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”.

17. It is noted that our Mainland partner (as personal information processor) has conducted the filing procedures in Mainland as required. Do we still need to conduct the filing procedures as a recipient in Hong Kong?

• Yes. In accordance with the “Implementation Guidelines of GBA Standard Contract”, the personal information processor and the recipient shall, according to the jurisdiction concerned, conduct the filing procedures with the Cyberspace Administration of Guangdong Province and the Office of Government Chief Information Officer of the HKSAR Government respectively within 10 working days from the effective date of the GBA Standard Contract. For details, please refer to the “Filing Guidelines on Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”.

18. My organisation (registered in Hong Kong) and our Mainland partner are planning to conduct cross-boundary of personal information from Mainland to Hong Kong and vice versa. Do we need to sign TWO GBA Standard Contracts to serve the purposes?

• Yes, by adopting the GBA Standard Contract, the personal information processor and the recipient are subject to different obligations and responsibilities. Therefore, each GBA Standard Contract is only applicable to cross-boundary flow of personal information from the nine Mainland cities within the GBA to Hong Kong or vice versa. Both personal information processor and recipient shall, according to the jurisdiction concerned, conduct the filing procedures of the GBA Standard Contract with the Cyberspace Administration of Guangdong Province and the Office of Government Chief Information Officer of the HKSAR Government respectively.