Personal Information Protection Regulations on the Mainland

I. Introduction

The Personal Information Protection Law (PIPL), the first piece of legislation in the Mainland dedicated to the protection of personal information, was passed by the Standing Committee of the National People’s Congress on 20 August 2021 and was effective since 1 November 2021.

The PIPL regulates the processing of personal information and protects an individual’s rights and interests in relation to personal information. It stipulates that the processing of personal information must abide by the principles of legality, justice, integrity, minimum necessity, openness and transparency, and the purposes of processing shall be explicit and reasonable.

Individuals have the right to access, copy, correct and request erasure of their personal information from personal information processors (similar to data users under the Personal Data (Privacy) Ordinance of Hong Kong). Individuals can also request personal information processors to provide them with the means of transferring their personal information to other processors.

When processing personal information of a minor under the age of 14, personal information processors must obtain the consent of the minor’s parent or guardian, and must formulate specific personal information processing rules.

The PIPL prohibits the use of automated decision-making based on personal information to implement unreasonable differential treatment in trade practices, such as unreasonable price discrimination against individuals (commonly known as “sha shu” behaviour). In addition, when automated decision-making is used to push information or conduct commercial marketing, personal information processors must provide individuals with options that do not target at their personal characteristics or convenient means to opt-out.

If personal information processors wish to transfer personal information out of the Mainland, they must obtain separate consent from individuals and meet specific requirements, such as passing the security assessment conducted by the national cyberspace authorities, obtaining certification from the relevant professional institutions, or entering into a standard contract formulated by the national cyberspace authorities.

The PIPL has extraterritorial effect. If overseas organisations process personal information of natural persons in the Mainland for the purposes of offering products or services to them, or for analysing or evaluating their behaviours, such overseas organisations must abide by the requirements under the PIPL, and establish designated agencies or appoint representatives in the Mainland.

The national cyberspace authorities shall be responsible for the overall coordination of personal information protection and the related supervision and management. The relevant departments of the State Council shall also be responsible for the protection of personal information and the related supervision and management within their purview.

A personal information processor that contravenes the requirements under the PIPL is liable to a maximum fine of RMB 50,000,000 or 5% of its annual turnover of the preceding year, and can also be ordered, amongst others, to suspend its business operations for rectification, have the relevant business permits or licenses revoked.

The full text of the PIPL (in Chinese) is available on the website of the National People’s Congress(NPC): https://www.gov.cn/xinwen/2021-08/20/content_5632486.htm. English translation published by the NPC is also available at http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559.htm. Please note that the NPC has specifically highlighted that the translation is for reference only.

---

II. Highlights of the Mainland’s Personal Information Protection Law

---

III. PCPD’s Publications and Articles on the Personal Information Protection Law

---

IV. Major Laws and Regulations of the Mainland in Relation to Cross-border Transfers of Personal Information (Extracted)

---

V. Facilitation Measures to Foster Cross-boundary Flows of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area

---

VI. Other Significant Regulatory Developments Relating to Personal Information Protection

Disclaimer

The information provided in this webpage is for general reference only. It does not provide an exhaustive guide to the application of the PIPL and / or any other regulations as mentioned in this webpage, and does not constitute any legal advice. The Privacy Commissioner for Personal Data makes no express or implied warranties of accuracy or fitness for a particular purpose or use with respect to the information set out on this webpage. Organisations and individuals should seek professional legal advice for compliance with the requirements under the PIPL and / or other regulations in the Mainland.

---

II. Highlights of the Mainland’s Personal Information Protection Law

Below are the highlights of the PIPL.

III. PCPD’s Publications and Articles on the Personal Information Protection Law

IV. Major Laws and Regulations of the Mainland in Relation to Cross-border Transfers of Personal Information (Extracted)

Since the implementation of the Personal Information Protection Law, different authorities of the Mainland have published laws and regulations in relation to cross-border transfers of personal information, including:

The consultation documents in relation to cross-border transfers of personal information that have been published by different authorities in the Mainland include:

The Practical Guidance of Cybersecurity Standards – Technical Specifications for Certification of Cross-border Processing of Personal Information Version 2.0⁸³

The National Information Security Standardisation Technical Committee (TC260) published a second edition of the “Practical Guidance of Cybersecurity Standards – Technical Specifications for Certification of Cross-border Processing of Personal Information Version V2.0” (the Guidance) on 16 December 2022. The Guidance amended an earlier version⁸⁴ published on 24 June of the same year by enhancing the requirements for personal information processors and data recipients outside the jurisdiction.

Article 38 (2) of the PIPL states that one of the prerequisites for carrying out cross-border personal information processing activities is that personal information processors obtain certification in relation to personal information protection from specialised institutions according to the provisions issued by the national cyberspace authorities. The Guidance provides a basis for certification institutions to conduct certification of cross-border personal information processing activities, and serves as a reference guideline for personal information processors to regulate their own cross-border personal information processing activities⁸⁵.

The Guidance sets out various basic principles in relation to cross-border processing of personal information, requiring both personal information processors and the relevant data recipients outside the jurisdiction to meet the requirements of the legislations and regulations of the Mainland⁸⁶. Parties are also required to, amongst others, enter into legally binding agreements, designate an officer to take charge of personal information protection, and to conduct a personal information protection impact assessment before carrying out cross-border processing activities⁸⁷. Besides, the Guidance incorporates protection on various rights and interests of personal information subjects⁸⁸, including the right to withdraw consent, the rights to access and to erase their personal information, etc. The Guidance also sets out additional and more detailed requirements and obligations for personal information processors and data recipients outside the jurisdiction to observe when carrying out cross-border personal information processing activities, so as to meet the relevant requirements as set out in the Security Assessment Measures on Cross-border Transfers of Data and in the Draft Rules on the Standard Contractual Clauses for Cross-border Transfers of Personal Information.

Other major requirements of the Guidance include:

• personal information processors applying for certification should be a valid legal entity currently carrying out business with good reputation and goodwill⁸⁹;
• personal information processors and data recipients outside the jurisdiction should set up respective personal information protection agencies in fulfilling their personal information protection obligations⁹⁰; and
• cross-border personal information processing activities should be recorded objectively with the relevant records retained for at least three years and submitted to national cyberspace authorities in accordance with relevant laws and regulations⁹¹.

As no implementation date is specified in the Guidance, the date of issue shall be deemed as the effective date of the Guidance (i.e. 16 December 2022).

Implementation Rules for Personal Information Protection Certification⁹²

On 18 November 2022, the State Administration for Market Regulation (SAMR) and the Cyberspace Administration of China (CAC) jointly issued the Implementation Rules for Personal Information Protection Certification (the Rules). The Rules provides clearer guidance on the certification of personal information processors in relation to their cross-border personal information processing activities, as mentioned in Article 38(2)⁹³ of the PIPL. The Rules sets out the basic principles and requirements of certification for personal information processors in relation to their collection, storage, use, processing, transmission, provision, disclosure, erasure and cross-border transfers, etc of personal information.

The certification is a voluntary mechanism. The Rules stipulates that personal information processors carrying out cross-border personal information processing activities would have to comply with the national standards as set out in GB/T 35273-2020 Information Security Technology—Personal Information Security Specification⁹⁴ as well as in the TC260-PG-20222A Guidance.

The Rules also provides the following two personal information protection certification marks⁹⁵:

(1) Certification mark for activities not involving cross-border processing of personal information

(2) Certification mark for activities involving cross-border processing of personal information

“ABCD” represents the certification institution.

According to the Rules, the modes for Personal Information Protection Certification include⁹⁶:

• Technical verification
• On-site review
• Continuous post-certification supervision

Certifications issued by certification institutions are valid for three years. Personal information processors must pass the post-certification supervision within the validity period in order to maintain the validity of the certification. For certifications that are due to expire, renewal applications should be made within six months before the actual date of expiry. The certification would only be renewed where the approval of post-certification supervision by the relevant certification institutions is passed and the requirements of certification are satisfied⁹⁷.

As no implementation date is specified in the Rules, the date of issue shall be deemed as the effective date of the Rules (i.e. 18 November 2022).

The Security Assessment Measures on Cross-border Transfers of Data⁹⁸

The Security Assessment Measures on Cross-border Transfers of Data (the Measures), promulgated by the Cyberspace Administration of China (CAC) on 7 July 2022, came into operation on 1 September 2022. The Measures were drafted with reference to relevant laws including the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law of the Mainland, for the purposes of regulating cross-border data transfers, protecting the rights and interests regarding personal information, upholding national security and society’s public interest, and facilitating the safe and free flow of data across the border.

The Measures apply to the security assessments of cross-border transfers of critical data and personal information collected and generated by data processors through their operations in the Mainland⁹⁹. The term “critical data” refers to any data which, if tampered with, damaged, leaked, or illegally acquired or used, may endanger national security, the operation of the economy, social stability, public health and security, etc¹⁰⁰. It is worth noting that as stated in the Draft Information Security Technology - Guideline for Identification of Critical Data released by the National Information Security Standardization Technical Committee on 7 January 2022, “critical data” specifically excludes state secrets and personal information. However, statistical data and derivative data which formation is based on massive personal information may be regarded as critical data¹⁰¹.

According to the Measures, data processors (including enterprises or organisations) which effect cross-border transfers of data shall, in any of the following situations, carry out their own security assessments and report such security assessments to the CAC through local cyberspace administration authorities at the provincial level¹⁰²:

• where the data processor transfers critical data across the border;
• where the data processor which transfers personal information across the border is an operator of Critical Information Infrastructure;
• where the data processor which transfers personal information across the border processes personal information of over 1 million persons;
• where the data processor which transfers personal information across the border has cumulatively made outbound transfers of personal information of over 100,000 persons, or sensitive personal information of over 10,000 persons since 1 January of the preceding year; and
• in other situations as prescribed by the CAC where a report on security assessment is required.

Regarding the applicability of the Measures, it should be read together with the Regulations on Facilitating and Regulating Cross-Border Data Flow, published by the CAC on 22 March 2024 (see below).

The self-assessment shall address, among others, the following key factors¹⁰³:

• the legality, propriety and necessity of (a) the cross-border transfer and (b) the purpose, scope and manner of processing of the data by the recipient outside the jurisdiction;
• the quantity, scope, category and sensitivity of the outbound data, and the risks that cross-border transfer of data might pose to national security, public interests, and the lawful rights and interests of individuals or organisations;
• whether the responsibilities and obligations undertaken by the recipient outside the jurisdiction and the management and technical measures and capabilities of such recipient to perform the aforesaid responsibilities and obligations can ensure the security of the outbound data;
• the risks of the outbound data suffering from alteration, destruction, leakage, loss, transfer, illegal acquisition or illegal use, etc., during and after the cross-border transfer, and whether or not channels are available to uphold personal information rights and interests, etc.;
• whether data security protection responsibilities and obligations are sufficiently stipulated in the contract, or other documents with legal effect, intended to be concluded with the recipient outside the jurisdiction regarding the cross-border data transfer; and
• other matters that may affect the security of the cross-border data transfer.

Regarding the procedures for reporting a security assessment, the Measures require a data processor to submit reporting materials to the local cyberspace administration authorities at the provincial level, which shall, within five working days upon receipt, confirm if the reporting materials are in order. If so, they are to be submitted to the CAC¹⁰⁴. The CAC shall, within seven working days upon receipt of the reporting materials, determine whether or not to accept them for review and notify the data processor in writing¹⁰⁵. The CAC shall complete the security assessment within 45 working days from the date of issuance of the written acceptance notice to the data processor¹⁰⁶. If the situation is complicated or the reporting materials need to be supplemented or corrected, the processing time may be appropriately extended, and the data processor is to be notified of the estimated extension period¹⁰⁷. The Measures also provide for a re-assessment mechanism. Where a data processor objects to the assessment results, the data processor may apply for a re-assessment within 15 working days upon receipt of the assessment results. The re-assessment results will be final verdict¹⁰⁸. Furthermore, the Measures empower the relevant authorities to hold a data processor legally accountable according to the law, if the data processor willfully submits false materials¹⁰⁹.

To guide and assist data processors in reporting security assessments of cross-border transfers of data in a regulated and orderly manner, the CAC issued the Guidance on Reporting Security Assessments of Cross-border Transfers of Data (1^st edition)¹¹⁰ and the Guidance on Reporting Security Assessments of Cross-border Transfers of Data (2nd edition)¹¹¹ on 31 August 2022 and 22 March 2024 respectively, explaining the specific requirements on the means and procedures of reporting such security assessments, as well as the materials to be submitted.

According to the Measures, the approval of the security assessment of cross-border transfers of data is valid for two years, to be calculated from the date when the results of assessment are issued. The Measures set out the circumstances under which a data processor shall submit a report afresh before the expiry of the aforesaid period of validity¹¹²:

• there are changes in the purpose, manner, scope, or category of transfer of data across the border, or the purpose and manner of processing the data by the recipient outside the jurisdiction, hence affecting the security of the outbound data; or where the time limit for storing personal information or critical data outside the jurisdiction is extended;
• where the security of outbound data is affected in situations such as: there is change in the data security protection polices and cybersecurity environment of the recipient outside the jurisdiction, or other force majeure event occurs; there is a change in the actual control over the data processor or the recipient outside the jurisdiction; or there is change to the legal document between the data processor and the data recipient outside the jurisdiction;
• where other circumstances arise which affect the security of the outbound data.

Regarding the validity of the security assessment of cross-border transfers of data, the Measures should be read together with the Regulations on Facilitating and Regulating Cross-Border Data Flow, published by the CAC on 22 March 2024 (see below).

The Measures require data processors to submit another report on data security assessment 60 working days before the validity period expires, so as to continue with their cross-border transfers of data¹¹³.

Lastly, the Measures provide that where cross-border data transfers carried out before 1 September 2022 (i.e. before the Measures came into operation) do not conform with the provisions of the Measures, steps must be taken to rectify the situation within 6 months from 1 September 2022¹¹⁴.

Measures on the Standard Contract for Cross-border Transfers of Personal Information¹¹⁵

The CAC promulgated the Measures on the Standard Contract for Cross-border Transfers of Personal Information (the Standard Contract Measures) on 24 February 2023. The Measures, which comes with 13 provisions and a template standard contract, will come into operation on 1 June 2023.

The Standard Contract Measures is promogulated pursuant to legislations and regulations including the PIPL¹¹⁶. Personal information processors are required to follow the provisions of the Standard Contract Measures and enter into a standard contract if they wish to rely on the execution of standard contracts to transfer personal information out of the Mainland as prescribed by Article 38(3)¹¹⁷ of the PIPL¹¹⁸. The Standard Contract Measures also stipulates clearly that all other contractual provisions entered into between a personal information processor and a recipient outside the jurisdiction must not be in conflict with the standard contract¹¹⁹.

According to the Standard Contract Measures, personal information processors that satisfy all of the following conditions may rely on the execution of standard contracts to transfer personal information out of the Mainland¹²⁰:

• where the personal information processor is not an operator of critical information infrastructure;
• where the personal information processor which transfers personal information out of the Mainland processes personal information of not more than one million persons (in aggregate);
• where the personal information processor which transfers out personal information has cumulatively made outbound transfers of personal information of not more than 100,000 persons (in aggregate) since 1 January of the preceding year; and
• where the personal information processor which transfers out personal information has cumulatively made outbound transfers of sensitive personal information of not more than 10,000 persons since 1 January of the preceding year.

Regarding the applicability of the Standard Contract Measures, it should be read together with the Regulations on Facilitating and Regulating Cross-Border Data Flow, published by the CAC on 22 March 2024 (see below).

Pursuant to the Standard Contract Measures, the relevant personal information processor shall enter into a standard contract strictly in accordance with the template standard contract¹²¹ and shall carry out a personal information protection impact assessment prior to the outbound transfer of personal information¹²². The impact assessment report, together with the standard contract signed, shall be filed with the local cyberspace administration authority at the provincial level within 10 working days from the effective date of the contract¹²³. Any transfers of personal information out of the Mainland shall only take place after the standard contract takes effect¹²⁴.

To guide and assist personal information processors in filing the standard contracts for cross-border transfers of personal information in an orderly manner, the CAC issued the Guidance on Filing the Standard Contract for Cross-border Transfers of Personal Information (1st edition)¹²⁵ and the Guidance on Filing the Standard Contract for Cross-border Transfers of Personal Information (2nd edition)¹²⁶ on 30 May 2023 and 22 March 2024 respectively, setting out the details on the mode of filing, filing procedures, and materials to be submitted, etc.

Further, it is noteworthy that the Standard Contract Measures stipulates clearly that personal information processors that are required to duly undergo security assessments for transferring personal information out of the Mainland shall not deploy tactics such as quantity splitting so that they may transfer personal information outside the jurisdiction by entering into standard contracts¹²⁷.

The personal information protection impact assessment shall assess, among others, the following key matters¹²⁸:

• the legality, propriety and necessity of the purpose, scope and manner of processing of the personal information by the personal information processor and the recipient outside the jurisdiction;
• the scale, scope, category and sensitivity of the outbound personal information, and the risks that cross-border transfer of personal information might pose to the rights and interests of individuals regarding personal information;
• whether the obligations undertaken by the recipient outside the jurisdiction and the management, technical measures and capabilities of such recipient to perform such obligations can ensure the security of the outbound data;
• the risks of the outbound personal information suffering from alteration, destruction, leakage, loss or illegal use, etc., during and after the cross-border transfers, and whether the channels provided to uphold the rights and interests of individuals regarding personal information are clear, etc.;
• the impact of personal information protection policies and regulations of the location of the recipient outside the jurisdiction on the performance of the standard contract; and
• other matters that may affect the security of the cross-border transfers of personal information.

Where any of the following situations take place during the effective period of the standard contract, the personal information processor shall conduct a new personal information protection impact assessment, supplement or re-enter into a standard contract with the personal information recipient outside the jurisdiction, and comply with the corresponding filing requirements:

• change of the purpose, scope, category, sensitivity, manner of provision, location of storage of the personal information, or change of the purpose and manner of processing of personal information on the part of the recipient outside the jurisdiction, or extension of the retention period of the personal information outside the jurisdiction;
• change of personal information protection policies and regulations of the location of the recipient outside the jurisdiction which may affect the rights and interests of individuals regarding personal information;
• any other situations which may affect the rights and interests of individuals regarding personal information¹²⁹.

As to the terms of the standard contract, they cover, amongst others, the obligations of the personal information processor and the recipient outside the jurisdiction¹³⁰, the impact of personal information protection policies and regulations of the location of the recipient outside the jurisdiction on the performance of the standard contract¹³¹, the rights of the individuals¹³², remedies available to individuals¹³³, and liability for breach of the contract¹³⁴. The personal information processor and the recipient outside the jurisdiction may also incorporate other provisions if necessary.

Finally, where cross-border transfers of personal information which have commenced before the effective date of the Standard Contract Measures (i.e. 1 June 2023) do not conform with the provisions of the Standard Contract Measures, action should be taken to rectify the situation within six months from the commencement of the Standard Contract Measures (i.e. before 30 November 2023)¹³⁵.

Regulations on Facilitating and Regulating Cross-Border Data Flow¹³⁶

The CAC released the Regulations on Facilitating and Regulating Cross-Border Data Flow (the Regulations) on 22 March 2024, which came into effect on the same day. The Regulations, which comprise of 14 provisions,seek to facilitate the orderly and free flow of data through, inter alia, introducing certain exemptions where data processors may be exempted from conducting security assessments, entering into standard contracts, or obtaining personal information protection certification.

According to the Regulations, where the data concerned has not been classified or publicly promulgated by the relevant authorities or regions as important data, no security assessments would have to be conducted by the data processor(s)¹³⁷. Situations where there can be exemptions from conducting security assessments, entering into standard contracts or obtaining personal information protection certifications include:

• where the data to be transferred out of the Mainland is collected and generated from international trade, cross-border transportation, academic collaboration, cross-border manufacturing activities, and marketing or sales activities, which does not contain any personal information or important data¹³⁸;
• where the personal information collected and originated by a data processor outside Mainland is transferred to the Mainland for domestic processing before being provided abroad, the process of which does not involve any personal information or important data within the Mainland¹³⁹;
• where the transfer, not containing any important data, by a data processor meets one of the following conditions¹⁴⁰:
  • the outbound transfer of personal information is necessary for the execution and performance of a contract to which the individuals are parties (e.g., for cross-border purchases, cross-border deliveries, cross-border remittances, cross-border payments, cross-border account opening, hotel and air ticket reservations, visa applications, examination services etc.);
  • the outbound transfer of employees’ personal information is necessary for the implementation of cross-border human resources management in accordance with applicable labour regulations and legally executed collective contracts ;
  • the outbound transfer of personal information is necessary in emergency circumstances to protect an individual’s life, health, and safety of his or her properties; and
  • the data processor that is not a critical information infrastructure operator (CIIO) transfers personal information of less than 100,000 individuals (excluding sensitive personal information) since 1 January of the current year.

The Regulations stipulates that security assessments shall be filed with the CAC through provincial cyberspace authorities where one of the following requirements are met¹⁴¹:

• CIIOs are to transfer personal information or important data outside Mainland;
• Non-CIIOs are to transfer important data, or personal information of over 1,000,000 individuals (not containing any sensitive personal information), or sensitive personal information of over 10,000 individuals since 1 January of the current year outside Mainland.

Data processors that are not CIIOs are required to enter into standard contracts or obtain personal information protection certifications when personal information of over 100,000 individuals but less than 1,000,000 individuals (not containing any sensitive personal information), or sensitive personal information of less than 10,000 individuals, to be counted from 1 January of the current year, is to be transferred out of the Mainland¹⁴².

Data processors that transfer personal information abroad should fulfil obligations related to notification, obtaining separate consent from individuals, conducting personal information protection assessments. etc.¹⁴³. The validity period of approved security assessments results is 3 years. For data processors that need to continue to transfer data abroad and have not encountered any circumstances that necessitate reapplications, they may make an application with the CAC for extending the validity period of the approved assessment results within 60 working days before the validity period expires. Upon approval, the validity of the assessment results can be extended for another 3 years¹⁴⁴.

Pursuant to the framework of the national data classification and grading protection system, free trade pilot zones can formulate its own list of data that requires security assessments, standard contracts or other personal information protection certifications, also known as a “negative list” , based on its respective needs¹⁴⁵. Upon approval of the provincial CAC offices, such “negative list” should be filed with the national CAC and national data management authorities. Data not included in the “negative list” can be exempted from the requirements of conducting security assessments, entering into standard contracts or obtaining personal information protection certifications.

Finally, in case of any inconsistencies between the provisions in the Security Assessment Measures on Cross-border Transfers of Data and the Measures on the Standard Contract for Cross-border Transfers of Personal Information and those of the Regulations, the previsions of the Regulations shall prevail¹⁴⁶.

V. Facilitation Measures to Foster Cross-boundary Flows of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area

The Cyberspace Administration of China (CAC) and the Innovation, Technology and Industry Bureau of the Government of the Hong Kong Special Administrative Region (ITIB) signed the Memorandum of Understanding on Facilitating Cross-boundary Data Flow Within the Guangdong-Hong Kong-Macao Greater Bay Area (MoU) on 29 June 2023 to jointly promote cross-boundary data flows in the Guangdong-Hong Kong-Macao Greater Bay Area (GBA). The Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong–Hong Kong–Macao Greater Bay Area (Mainland, Hong Kong) (GBA SC) is a facilitation measure under the MoU to foster the cross-boundary flows of personal information¹⁴⁷ within the GBA. It was formulated by the CAC, ITIB, and Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).

The GBA SC applies to cross-boundary flows of personal information between personal information processors¹⁴⁸ and recipients which are registered (applicable to organisations) or who are located (applicable to individuals) in the Mainland cities within the GBA (i.e. Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing of Guangdong Province) and Hong Kong, including cross-boundary personal information transfers from the Mainland cities within the GBA to Hong Kong and those from Hong Kong to the Mainland cities within the GBA.

The GBA SC contains the following eight parts:
Article 1 Definition
Article 2 Obligations and Responsibilities of Personal Information Processors (including data users)
Article 3 Obligations and Responsibilities of Recipients
Article 4 Rights of Personal Information Subjects (including data subjects)
Article 5 Remedies
Article 6 Termination of Contract
Article 7 Liabilities for Breach of Contract
Article 8 Miscellaneous

According to the GBA SC, personal information processors (including data subjects) have to comply with the clauses stipulated therein. For instance, the obligations and responsibilities of personal information processors include (but are not limited to):

• Personal information subjects (including data subjects¹⁴⁹) should be informed of the name and contact information of the recipient, the purposes of processing the personal information to be transferred across boundary, the means of such processing, the categories of personal information, the retention period(s), the transfer to a third party in the same jurisdiction as the recipient (if the recipient is registered (applicable to organisations) or located (applicable to individuals) in a Mainland city within the GBA, “same jurisdiction” includes all Mainland cities within the GBA; if the recipient is registered (applicable to organisations) or located (applicable to individuals) in Hong Kong, “same jurisdiction” means Hong Kong), and the methods and procedures for exercising their rights as personal information subjects, etc. If notice is not required under the relevant laws and regulations of the jurisdiction concerned, such provisions shall prevail (Article 2(2) of the GBA SC refers).
• Prior to the cross-boundary transfer of personal information to the recipient, the consent of personal information subjects should be obtained in accordance with the laws and regulations of the jurisdiction concerned (Article 2(3) of the GBA SC refers).
• Personal information subjects should be informed that they will be a third-party beneficiary as agreed by the personal information processor and the recipient under the GBA SC; if a personal information subject does not explicitly reject this term within 30 days, he/she shall enjoy the rights of a third-party beneficiary in accordance with the GBA SC (Article 2(4) of the GBA SC refers).
• Conduct a personal information protection impact assessment on the intended transfer of personal information to the recipient. The impact assessment should focus on the following, and the personal information protection impact assessment report should be retained for at least 3 years:
  • The legality, legitimacy and necessity of the purposes and means, etc. of processing personal information by the personal information processor and recipient;
  • The impact on and security risks to the rights and interests of personal information subjects;
  • Whether the obligations undertaken by the recipient, as well as its management, technical measures and capabilities, etc. to perform the obligations, can ensure the security of personal information transferred across the boundary.
  (Article 2(8) of the GBA SC refers)

For recipients, their obligations and responsibilities under the GBA SC include (but are not limited to):

• The recipient shall not provide personal information received in accordance with the GBA SC to organisations or individuals outside the GBA (Article 3(7) of the GBA SC refers).
• The recipient may only provide personal information to a third party in the same jurisdiction of the Mainland cities within the GBA or the Hong Kong Special Administrative Region (if the recipient is registered (applicable to organisations) or located (applicable to individuals) in a Mainland city within the GBA, “same jurisdiction” means all Mainland cities within the GBA; if the recipient is registered (applicable to organisations) or located (applicable to individuals) in Hong Kong, “same jurisdiction” means Hong Kong) if all of the following conditions are met:
  • There is a business need for the transfer.
  • The personal information subject has been informed of the third party’s name and contact information, purposes of processing, means of processing, categories of personal information, retention period(s) and methods and procedures for exercising their rights as a personal information subject, etc. If notice is not required under the relevant laws and regulations of the jurisdiction of the personal information processor, such provisions shall prevail.
  • Consent has to be obtained from the personal information subject in accordance with the laws and regulations of the jurisdiction of the personal information processor, if the processing of personal information is based on the consent of the individual.
  • The personal information is provided to a third party in the same jurisdiction in accordance with the terms set out in “Description of cross-boundary transfer of personal information” in Appendix I of the GBA SC.
  (Article 3(8) of the GBA SC refers)
• If the recipient receives a request from a government department or judicial body of the jurisdiction where it is located to provide personal information received under the GBA SC, it should immediately notify the personal information processor (Article 3(13) of the GBA SC refers).

Please click here to download the GBA SC.

The Implementation Guidelines on the Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong) (the Implementation Guidelines on the GBA SC) are guidelines established by the governments of the Mainland and Hong Kong for the implementation of the GBA SC. The Implementation Guidelines on the GBA SC came into operation on 13 December 2023. Personal information processors and recipients in the GBA may, in accordance with the requirements of the Implementation Guidelines on the GBA SC, conduct cross-boundary flows of personal information between the Mainland cities within the GBA and Hong Kong by entering into a Standard Contract¹⁵⁰.

Please click here to download the Implementation Guidelines on the GBA SC.

To help organisations in Hong Kong understand the applicability of the GBA SC and the relationship between the GBA SC and other Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data issued by the PCPD, the PCPD has issued the “Guidance on Cross-boundary Data Transfer: Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”.

Please click here to download the “Guidance on Cross-boundary Data Transfer: Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”.

Please click here to browse the thematic website set up by the Office of the Government Chief Information Officer of the Hong Kong Special Administrative Region (OGCIO) to obtain further information.

Further, please click the links below for the reference materials published by the regulatory authorities under the GBA SC:

VI. Other Significant Regulatory Developments Relating to Personal Information Protection