Non-Disclosure Agreement (Hong Kong)

A Non-Disclosure Agreement in Hong Kong protects sensitive business information by restricting its disclosure to unauthorised third parties. It restricts disclosure and use of designated confidential information between the disclosing and receiving parties.

Hong Kong's law on confidentiality is grounded in English common law equity, which was received into Hong Kong's legal system during the colonial era and remains fully operative today under the Basic Law. The equitable duty of confidence arises automatically in certain circumstances — for example, when a doctor receives medical information about a patient, or when a company discloses commercially sensitive data to a prospective partner in obvious circumstances of confidence. A written NDA supplements this equitable protection by providing contractual certainty, defined scope, and specific remedies.

Hong Kong is one of Asia's leading centres for international business, finance, and dispute resolution. Its courts — particularly the Court of First Instance and Court of Appeal — have developed a sophisticated and commercial approach to confidentiality law, regularly drawing on English, Australian, and other common law authorities. The Court of Final Appeal, which includes distinguished overseas common law judges, provides a final appellate tier of the highest quality. This well-developed judicial infrastructure makes Hong Kong an excellent choice of governing law and jurisdiction for NDAs.

The Personal Data (Privacy) Ordinance (Cap. 486) — one of Asia's oldest data protection statutes, enacted in 1995 — is relevant to NDAs where the confidential information includes personal data. The PDPO's six Data Protection Principles impose obligations on the collection, use, retention, security, and access rights relating to personal data. Unlike Singapore's PDPA (which has mandatory breach notification and administrative fines), the PDPO as of 2026 does not yet require mandatory breach notification, though proposed amendments to introduce this and other enhancements have been under consideration. Parties handling personal data under an NDA must confirm their practices comply with the current DPPs and any guidance issued by the Privacy Commissioner for Personal Data (PCPD).

For businesses operating across both Hong Kong and mainland China, that mainland China's data protection regime — particularly the Personal Information Protection Law (PIPL) and the Data Security Law — applies to data processing activities within mainland China's jurisdiction, which is separate from Hong Kong's PDPO framework. Cross-border transfers of data between Hong Kong and mainland China require attention to both regimes.

Hong Kong's status as a common law jurisdiction under the Basic Law, with an independent judiciary, makes it particularly attractive as the governing law for NDAs in transactions involving parties from mainland China, Southeast Asia, and other civil law jurisdictions. The Court of Final Appeal's inclusion of distinguished overseas common law judges from Australia, the United Kingdom, and Canada reinforces the quality of Hong Kong's appellate jurisprudence on commercial law matters. The Hong Kong International Arbitration Centre (HKIAC) and the Hong Kong Mediation Centre (HKMC) provide alternative dispute resolution options for parties who prefer confidential resolution of NDA disputes outside the public court system. HKIAC arbitration clauses are particularly common in technology licensing NDAs and M&A confidentiality agreements involving cross-border parties.

A Non-Disclosure Agreement is needed whenever you are sharing, receiving, or accessing information that has commercial or personal value and that you want to keep confidential.

You need an NDA before entering into business negotiations or due diligence. When two companies are exploring a merger, acquisition, joint venture, or strategic partnership — a common occurrence in Hong Kong's active M&A market — each party will typically require the other to execute an NDA before sharing financial statements, customer data, business plans, or technical information. Investment banks and corporate finance advisers in Hong Kong universally require NDAs as a condition of sharing deal-sensitive information. The Securities and Futures Commission (SFC) — established under the Securities and Futures Ordinance (Cap. 571) — requires licensed persons to maintain client confidentiality under its Code of Conduct, and a written NDA reinforces those statutory obligations.

You need an NDA when engaging contractors, consultants, or service providers. When a business engages an IT consultant, management adviser, or specialist service provider who will have access to proprietary systems, client data, or business strategies, an NDA should be signed before work commences. Hong Kong's service-driven economy means this is one of the most frequent NDA use cases. The Companies Registry — administered under the Companies Ordinance (Cap. 622) — maintains records of corporate entities, and confirming the counterparty's registered status before executing an NDA is good practice.

You need an NDA in employment relationships. While Section 6 of the Employment Ordinance (Cap. 57) does not mandate NDAs, employers in Hong Kong routinely include confidentiality obligations in employment contracts or as standalone NDAs. Employees in senior roles with access to trade secrets, client relationships, pricing strategies, or proprietary technology should sign NDAs specifying the scope of protected information and the duration of post-employment obligations. The Labour Tribunal — a specialist tribunal within the District Court system — regularly deals with employment disputes involving alleged misuse of confidential information.

You need an NDA when sharing proprietary technology or intellectual property for evaluation. When a technology developer, startup, or inventor discloses proprietary software, algorithms, or product designs to a potential investor, licensee, or distribution partner for evaluation, an NDA protects the developer's position before any formal agreement is concluded. Hong Kong's status as a technology and innovation hub — with the Innovation and Technology Commission and the Hong Kong Science and Technology Parks Corporation supporting technology transfer — makes this a frequent requirement. Intellectual property rights including copyright under the Copyright Ordinance (Cap. 528) and trade mark rights under the Trade Marks Ordinance (Cap. 559) complement NDA protection by establishing independent statutory rights.

You need an NDA in financial services and banking contexts. Hong Kong is one of the world's leading financial centres, and financial institutions regulated by the Hong Kong Monetary Authority (HKMA) and the Securities and Futures Commission regularly share sensitive client and transaction information with counterparties, advisers, and service providers. NDAs are a standard part of the information-sharing infrastructure in this sector.

Professional services firms — law firms, accounting firms, management consultants, and financial advisers — routinely execute NDAs when onboarding new clients, as client information gathered during an engagement is inherently confidential. Hong Kong professional regulatory bodies including the Law Society of Hong Kong, the Hong Kong Institute of Certified Public Accountants, and the SFC for licensed representatives impose confidentiality obligations as part of their professional codes, supplemented by contractual NDAs.

A well-drafted Hong Kong NDA should contain the following essential elements.

Parties: Full legal names and HKID numbers (for individuals) or company registration numbers (for companies registered under Section 67 of the Companies Ordinance Cap. 622), with addresses, clearly identifying the disclosing party and the receiving party. In mutual NDAs, both parties are simultaneously disclosing and receiving parties.

Definition of Confidential Information: A precise definition specifying what information is covered — technical data, business plans, financial information, customer lists, trade secrets, software, and any information marked as confidential or disclosed in circumstances of confidence. Express exclusions for public domain information, independently developed information, and information known prior to disclosure.

Purpose: The specific commercial or professional purpose for which the confidential information is being shared. The receiving party's use of the information must be limited to this stated purpose.

Obligations of the Receiving Party: The core obligations — to maintain confidentiality, not disclose to third parties without consent, use only for the permitted purpose, and apply at least the same standard of care as applied to the receiving party's own confidential information.

Permitted Disclosures: Carve-outs for disclosures required by Hong Kong law, court order, or regulatory authority — including mandatory disclosure to the Securities and Futures Commission under Section 181 of the Securities and Futures Ordinance (Cap. 571), or to the Hong Kong Monetary Authority under its supervisory powers; disclosures to professional advisers under obligations of confidence; and disclosures to employees on a need-to-know basis.

Duration: The period of confidentiality obligations, expressed as a fixed term or as continuing for as long as the information retains its confidential character.

Data Protection: Where the confidential information includes personal data, a specific clause requiring compliance with Data Protection Principle 4 (DPP4) of the Personal Data (Privacy) Ordinance (Cap. 486), which requires reasonably practicable steps to protect personal data against unauthorised or accidental access. The Privacy Commissioner for Personal Data (PCPD) — the statutory authority established under Section 8 of Cap. 486 — may issue enforcement notices requiring specific remediation steps following a data security failure.

Return and Destruction: Obligation to return or destroy confidential information upon request or completion of the purpose.

Remedies: Acknowledgment of the right to seek injunctive relief from the Court of First Instance and other equitable remedies from Hong Kong courts. The Court of Final Appeal — Hong Kong's apex court — has affirmed that breach of confidence in commercial contexts attracts both injunctive and damages relief.

Governing Law and Jurisdiction: Laws of the Hong Kong Special Administrative Region and the courts of Hong Kong as the forum for disputes. For cross-border transactions, parties may alternatively specify HKIAC arbitration under the HKIAC Administered Arbitration Rules 2018, which provides a confidential, enforceable, and internationally recognised resolution mechanism under the New York Convention on the Recognition and Enforcement of Foreign Arbitral Awards.

Legal Framework for Enforcement. The foundational three-limb test set out in Coco v AN Clark (Engineers) Ltd [1969] RPC 41 — adopted and applied extensively by the Hong Kong Court of First Instance — establishes that: (1) the information must have the necessary quality of confidence; (2) it must have been communicated in circumstances importing an obligation of confidence; and (3) there must be unauthorised use causing detriment to the disclosing party. A written NDA satisfies limbs (1) and (2) by defining the protected information and recording the circumstance of disclosure, leaving only a factual question of unauthorised use in any enforcement action. Section 21 of the Personal Data (Privacy) Ordinance (Cap. 486) further empowers the PCPD to investigate misuse of personal data shared under an NDA, and Section 66 creates a civil damages action for individuals harmed by a contravention of the Ordinance. Section 50 enforcement notices under Cap. 486 can require the breaching party to implement specific technical and organisational security measures. In employment contexts, the Court of First Instance applies the general reasonableness test from common law restraint of trade doctrine to post-employment confidentiality obligations that go beyond protecting genuine trade secrets — an overly broad obligation risks being struck down as an unlawful restraint. The forms-legal.com Hong Kong NDA template is drafted under Hong Kong common law of confidence and Cap. 486, and is suitable for employment, M&A due diligence, technology licensing, and supplier engagement contexts. For cross-border transactions involving mainland China parties, the template should be reviewed by a lawyer familiar with both Hong Kong and mainland data protection requirements, as mainland China's Personal Information Protection Law (effective November 2021) imposes separate obligations. For NDAs involving personal data of Hong Kong residents, the receiving party must also comply with DPP4 of the Personal Data (Privacy) Ordinance (Cap. 486). The PCPD may investigate data security failures even where no formal complaint has been made, and enforcement notices issued under Section 50 of Cap. 486 may require the implementation of specific security measures as a remediation step.

Hong Kong NDAs fail to deliver meaningful protection in practice because of recurring drafting and execution errors. The following ten mistakes are the most consequential.

1. Overly broad or vague definition of confidential information. Courts applying the three-limb test from Coco v AN Clark (Engineers) Ltd [1969] RPC 41 — as received into Hong Kong law — require that the information have the 'necessary quality of confidence'. A definition that encompasses 'all information discussed' without specifying categories may not satisfy this threshold, leaving genuinely sensitive material unprotected while simultaneously creating unworkable obligations over trivial exchanges. Draft specific categories and combine them with a residual clause for information marked confidential at disclosure.

2. Missing standard carve-outs. Every enforceable Hong Kong NDA must exclude: information already in the public domain through no fault of the receiving party; information known to the receiving party before disclosure; information independently developed by the receiving party; and information required to be disclosed by law, court order, or regulatory direction (including mandatory disclosures to the SFC under the Securities and Futures Ordinance Cap. 571). Missing any of these carve-outs exposes the receiving party to claims for conduct it had no power to prevent.

3. No stated permitted purpose. Without a defined purpose, the receiving party's use of the information is not adequately limited. This also conflicts with Data Protection Principle 3 of Schedule 1 of the Personal Data (Privacy) Ordinance (Cap. 486), which prohibits use of personal data for purposes beyond those for which it was collected. A missing purpose clause transforms the NDA from a targeted protection instrument into an unworkable blanket restriction.

4. Unrealistic or perpetual duration. Applying confidentiality obligations of ten or more years to routine commercial information, or using 'in perpetuity' for all categories without qualification, risks having the duration clause construed as an unenforceable restraint by the Court of First Instance. Duration should be calibrated to the actual commercial life of the information: two to three years for general business information, indefinite only for genuine trade secrets linked to their continuing confidential character.

5. Inadequate party identification. Trading names, abbreviations, and generic job titles — instead of registered company names with Companies Registry numbers or full individual names with HKID numbers — create enforcement difficulties. When applying for an injunction from the Court of First Instance, the applicant must correctly identify the respondent or risk the order being ineffective.

6. No data protection clause despite personal data being shared. Where the confidential information includes names, contact details, financial data, or health information of individuals, Section 66 of the Personal Data (Privacy) Ordinance (Cap. 486) creates a private right of action in damages for those individuals if their data is mishandled. The NDA must address DPP4 security obligations and specify what the receiving party may do with any personal data received.

7. Electronic execution without confirming platform compliance. Many Hong Kong NDAs are signed via e-signature platforms, but only platforms whose authentication methods are 'reliable' satisfy the Electronic Transactions Ordinance (Cap. 553). An NDA signed using an unverified digital method may have its authenticity challenged in proceedings, complicating enforcement.

8. No return and destruction obligation. Without a clause requiring the receiving party to return or certify destruction of confidential information on request or at the end of the engagement, disclosed information remains in the receiving party's possession indefinitely, creating ongoing misuse risk.

9. Failure to address cross-border data flows with mainland China counterparties. An NDA between a Hong Kong party and a mainland China counterpart that omits any reference to mainland China's Personal Information Protection Law (PIPL, effective November 2021) leaves the mainland party without a clear contractual framework for processing the Hong Kong party's personal data within the mainland. The PIPL imposes extraterritorial obligations that cannot be addressed solely by reference to the Personal Data (Privacy) Ordinance (Cap. 486).

10. Signing by an officer without board authority. Where a company signatory has not been authorised to bind the company by board resolution or the company's articles of association under the Companies Ordinance (Cap. 622), the NDA is unenforceable against the company. Require a certified copy of the board resolution or signing authority before execution.