NDA — Non-Disclosure Agreement (Hong Kong)

A NDA — Non-Disclosure Agreement in Hong Kong binds the parties to keep specified information confidential and limits its disclosure to authorised recipients. It restricts disclosure and use of designated confidential information between the disclosing and receiving parties.

Hong Kong's legal framework for protecting confidential information is among the most developed in Asia. The equitable duty of confidence was received from English law during the colonial era and remains fully operative under Article 8 of the Basic Law, which preserves Hong Kong's pre-handover common law. The Court of Final Appeal — which includes distinguished overseas judges from leading common law jurisdictions — regularly develops and applies this body of law at the highest level. The Court of First Instance and the Court of Appeal provide an intermediate tier of rigorous judicial analysis, drawing on English, Australian, Canadian, and Singaporean authorities where relevant.

The leading test for the equitable duty of confidence, established in Coco v AN Clark (Engineers) Ltd [1969] RPC 41 and consistently applied in Hong Kong proceedings by the Court of First Instance, requires three elements: the information must have the necessary quality of confidence (not in the public domain); the information must have been imparted in circumstances importing an obligation of confidence; and there must be unauthorised use causing detriment to the disclosing party. A written NDA supplements this equitable protection by providing contractual certainty about the scope of protected information, the permitted purpose, and the agreed remedies. The Limitation Ordinance (Cap. 347) gives a six-year limitation period for contractual claims, so NDA obligations remain actionable for up to six years after breach.

For Hong Kong businesses sharing information across borders — particularly with mainland China counterparties — the NDA must also address data protection compliance. The Personal Data (Privacy) Ordinance (Cap. 486), enforced by the Privacy Commissioner for Personal Data (PCPD), imposes obligations on the collection, use, retention, and security of personal data under its six Data Protection Principles. Data Protection Principle 4 requires that security measures appropriate to the sensitivity of the data be taken. Where the confidential information includes personal data of individuals — such as customer records, employee files, or health data — the receiving party's obligations under the NDA must align with the PDPO framework. Mainland China's Personal Information Protection Law (PIPL) applies separately to any processing of personal information within mainland China's jurisdiction.

The short-form NDA is also widely used in Hong Kong's active startup ecosystem. Cyberport and the Hong Kong Science Park host hundreds of technology startups that regularly share proprietary technology, algorithms, and business models with potential investors, strategic partners, and corporate collaborators. A short-form NDA signed before such discussions confirms the developer retains protection for trade secrets and proprietary know-how that may not yet qualify for formal intellectual property registration under the Trade Marks Ordinance (Cap. 559), the Patents Ordinance (Cap. 514), or the Copyright Ordinance (Cap. 528).

Hong Kong NDA (short form) is needed whenever commercially sensitive information changes hands in a context where a full-length agreement would be disproportionate or impractical to negotiate.

Before any preliminary business meeting or pitch. When founders, executives, or advisers meet to explore a potential transaction — whether a partnership, investment, acquisition, or strategic alliance — the short-form NDA should be signed before substantive discussions begin. Hong Kong's Investment Promotion Agency and the Hong Kong Trade Development Council (HKTDC) support thousands of such meetings annually, and an NDA signed at the outset protects both parties' interests from the first exchange of information.

During vendor and supplier evaluations. When a company is assessing potential suppliers, IT service providers, or outsourcing partners, it typically shares information about its internal systems, processes, pricing benchmarks, and technical requirements. The vendor simultaneously shares proprietary product specifications and pricing. A short-form mutual NDA signed before the evaluation process protects both sides. The Companies Ordinance (Cap. 622) governs the corporate status of parties, and correct company identification in the NDA is important for enforcement.

Before product demonstrations and technology showcases. Hong Kong's technology sector — spanning fintech, insurtech, proptech, and biotech — generates frequent situations where developers demonstrate proprietary products to potential customers or partners. A short-form NDA signed before the demonstration confirms that the demonstrated technology, unreleased product features, and performance data are protected. Where the product incorporates registered intellectual property, the Trade Marks Ordinance (Cap. 559) and Patents Ordinance (Cap. 514) provide parallel protection.

In professional services engagements. When lawyers, accountants, management consultants, or other professional advisers conduct initial consultations, they often receive sensitive client information before a formal engagement letter or retainer agreement is in place. A short-form NDA bridges this gap, confirming that obligations of confidence attach from the moment information is shared.

For startup fundraising in Hong Kong. When a startup incorporated under the Companies Ordinance (Cap. 622) approaches venture capital funds, angel investors, or family offices for seed or growth funding, a short-form NDA protects the pitch deck, financial projections, customer data, and proprietary technology shared during due diligence. The Securities and Futures Commission (SFC) regulates investment activities in Hong Kong under the Securities and Futures Ordinance (Cap. 571).

For joint research and development discussions. When companies at the Hong Kong Science Park or universities such as the University of Hong Kong, HKUST, or CUHK explore collaborative research, a short-form NDA protects preliminary disclosures before a formal collaboration agreement or material transfer agreement is concluded.

A valid Hong Kong short-form NDA must contain the following essential components to provide enforceable protection under Hong Kong law, including the Personal Data (Privacy) Ordinance (Cap. 486) and common law principles confirmed by the Court of First Instance.

Party Identification. Full legal names of both parties — for companies, the registered name and Companies Registry number under the Companies Ordinance (Cap. 622); for individuals, full name and Hong Kong Identity Card (HKID) number as issued under the Registration of Persons Ordinance (Cap. 177). Clear designation of disclosing party and receiving party, or mutual designation in a mutual NDA where both parties simultaneously disclose.

Type of NDA. Express statement of whether the NDA is one-way (unilateral) — where only one party discloses confidential information — or mutual (bilateral) — where both parties simultaneously disclose and receive confidential information. Most preliminary business discussions warrant a mutual NDA to protect both sides equally.

Definition of Confidential Information. A specific definition covering technical data, business plans, financial information, customer and supplier lists, pricing strategies, software and source code, formulas, prototypes, and any other information marked as confidential or disclosed in circumstances importing an obligation of confidence under the equitable duty recognised by the Court of First Instance. Express carve-outs for: information already in the public domain (not through breach of the NDA); information already known to the receiving party independently before disclosure; information independently developed by the receiving party without reference to the disclosed information; and disclosures required by Hong Kong law, court order, the Securities and Futures Commission (SFC), the Hong Kong Monetary Authority (HKMA), or other regulatory authority.

Permitted Purpose. Specific description of the commercial or professional purpose for which the confidential information is being shared. The receiving party's use is strictly limited to this stated purpose, consistent with Data Protection Principle 3 of the Personal Data (Privacy) Ordinance (Cap. 486) Schedule 1.

Core Obligations. Non-disclosure to third parties without prior written consent; use only for the permitted purpose; application of at least the same standard of care as applied to the receiving party's own confidential information; limitation of internal disclosure on a strict need-to-know basis. Data Protection Principle 4 of Cap. 486 requires security measures appropriate to the sensitivity of any personal data included in the confidential information.

Duration. The agreed period of confidentiality obligations, expressed as a fixed term from the date of disclosure or as continuing for as long as the information retains its confidential character. The Limitation Ordinance (Cap. 347) Section 4 provides a six-year limitation period for contract claims, meaning NDA obligations must be pursued within six years of breach.

Data Protection Compliance. Where confidential information includes personal data, an express clause requiring compliance with the Personal Data (Privacy) Ordinance (Cap. 486), its six Data Protection Principles under Schedule 1, and any guidance issued by the Privacy Commissioner for Personal Data (PCPD).

Remedies and Jurisdiction. Acknowledgment that breach entitles the disclosing party to seek injunctive relief from the Court of First Instance (High Court) and other equitable remedies, with governing law being the laws of the Hong Kong Special Administrative Region. Parties may also specify the Hong Kong International Arbitration Centre (HKIAC) as the dispute resolution forum.

Legal Precedent and Enforcement Framework. The equitable duty of confidence underpinning every Hong Kong NDA traces directly to the three-limb test in Coco v AN Clark (Engineers) Ltd [1969] RPC 41, which Hong Kong courts have adopted and applied consistently. Beyond the equitable claim, the Court of First Instance has confirmed that Section 21 of the Personal Data (Privacy) Ordinance (Cap. 486) empowers the Privacy Commissioner to investigate and issue enforcement notices where personal data shared under an NDA is mishandled, adding a regulatory enforcement layer on top of contractual remedies. Section 50 of Cap. 486 allows the Commissioner to serve enforcement notices requiring specific remediation steps, while Section 64 creates a private right of action in damages for individuals who suffer loss through contravention of the Ordinance. Section 4 of the Limitation Ordinance (Cap. 347) confirms the six-year window for contractual NDA claims, and Section 5 preserves the court's equitable jurisdiction to grant injunctions at any stage before that period expires. Together, these statutory and equitable instruments give Hong Kong NDAs a layered enforcement framework that makes breach an expensive proposition for any receiving party.

Forms-legal.com users can generate this short-form NDA instantly, customise the type, purpose, and duration, and download in PDF or Word format ready for signature.

Hong Kong short-form NDAs are frequently undermined by avoidable drafting errors and procedural omissions that render the agreement unenforceable or commercially inadequate. The following mistakes appear repeatedly in disputes before the Court of First Instance.

1. Vague definition of confidential information. Describing protected material as 'all information shared' without specifying categories creates ambiguity about what is actually covered. Courts applying the three-limb Coco v AN Clark test require the information to have the 'necessary quality of confidence' — an undefined catch-all does not satisfy this requirement. The correct approach is to list categories expressly (technical data, business plans, pricing, customer lists, source code) and to include a residual clause for information marked confidential in writing at the time of disclosure.

2. No exclusions clause. Failing to carve out information that is already publicly known, independently developed, or required to be disclosed by law exposes the receiving party to claims even over information it encountered through entirely legitimate channels. Every enforceable Hong Kong NDA must include the standard four carve-outs: public domain, prior knowledge, independent development, and regulatory compulsion.

3. Mutual NDA signed where the arrangement is actually one-way. Where only one party discloses confidential information, a mutual NDA may create obligations and potential liabilities for the disclosing party that it did not intend. The agreement type must match the commercial reality of the relationship.

4. No stated permitted purpose. An NDA that does not specify the purpose for which confidential information is shared cannot limit the receiving party's use to that purpose — a requirement of Data Protection Principle 3 under Schedule 1 of the Personal Data (Privacy) Ordinance (Cap. 486). Without a defined purpose, the receiving party may argue it is free to use the information for any lawful purpose.

5. Perpetual duration without qualification. Imposing confidentiality obligations indefinitely on all categories of information — including information that naturally enters the public domain — risks the duration clause being construed as an unenforceable perpetual restraint. Duration should be fixed for general commercial information (typically two to three years) and indefinite only for genuine trade secrets, linked expressly to the information's continuing confidential character.

6. Wrong governing law or no governing law clause. An NDA between a Hong Kong party and a mainland China counterpart that omits a governing law clause may be subject to expensive litigation over which system applies. The NDA should expressly designate the laws of the Hong Kong Special Administrative Region, supplemented by a dispute resolution clause specifying HKIAC arbitration or Hong Kong court jurisdiction.

7. Inadequate party identification. Using a trading name rather than the registered company name and Companies Registry number, or failing to include HKID numbers for individual signatories, creates difficulties in enforcement proceedings. The Court of First Instance requires correct identification of parties before it will issue injunctive relief or enter judgment.

8. No data protection clause where personal data is involved. Where the confidential information includes customer records, employee files, or health data, the NDA must address the obligations of each party under the Personal Data (Privacy) Ordinance (Cap. 486). Omitting this clause exposes the receiving party to enforcement action by the Privacy Commissioner and potential damages claims under Section 66 of Cap. 486 even where the NDA itself was not breached.

9. Failure to include an injunctive relief acknowledgment. Without an express acknowledgment that damages are an inadequate remedy for breach and that the disclosing party is entitled to seek immediate injunctive relief, the receiving party may contest the ex parte injunction application and delay interim protection. Including this acknowledgment strengthens the disclosing party's position before the Court of First Instance.

10. Signing by an unauthorised representative. Where a company signatory lacks authority to bind the company under its articles of association and the Companies Ordinance (Cap. 622), the NDA may be unenforceable against the company. Verify that the signatory holds a director, authorised signatory, or power of attorney from the company before execution.