Data Processing Agreement (Hong Kong)

A Data Processing Agreement (DPA) in Hong Kong is a legally binding contract between an organisation that controls personal data (the data user) and a third party that processes personal data on the data user's behalf (the data processor). The DPA is the primary contractual mechanism through which the data user extends its obligations under the Personal Data (Privacy) Ordinance (Cap. 486) to its processors, documenting the controls, restrictions, and security requirements governing the processor's handling of personal data.

Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486), enacted in 1995 and effective from December 1996, is administered by the Office of the Privacy Commissioner for Personal Data (PCPD). The PDPO's six Data Protection Principles (DPPs) in Schedule 1 apply to data users — organisations that control personal data — but the practical enforcement of those principles frequently depends on what processors do with the data. Data Protection Principle 4 (DPP4) requires data users to take all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss, or use. Where a data user engages a processor, DPP4 compliance requires contractual controls on the processor's data handling conduct.

The 2021 amendments to Cap. 486 — the Personal Data (Privacy) (Amendment) Ordinance 2021 — significantly expanded the PCPD's powers in relation to data processors. The PCPD can now investigate data processors and issue enforcement notices against processors who contravene the PDPO. The 2021 amendments also introduced the doxxing offence under Section 64 of Cap. 486 and strengthened the PCPD's investigation and enforcement tools. These amendments increase the regulatory stakes for organisations that engage processors without adequate contractual safeguards.

The PCPD's Guidance on Data Processors recommends that data users enter into written contracts with processors specifying: the purposes for which personal data may be processed; the security measures required; the processor's obligations on breach notification; restrictions on sub-processing; data deletion obligations at contract end; and audit rights. While Cap. 486 does not prescribe a mandatory DPA format comparable to the EU GDPR's Article 28 requirements, the PCPD's guidance makes a written DPA the expected standard of good practice for any data user engaging a processor.

Data subject access and correction rights under Section 18 and Section 22 of Cap. 486 must also be addressed in the DPA — the processor must be contractually obligated to assist the data user in responding to access and correction requests within the 40-day statutory period. The PCPD may investigate failures by processors that result in the data user being unable to meet this statutory obligation.

Hong Kong organisations that also handle personal data of European Union individuals must comply with the GDPR's mandatory data processing agreement requirements under Article 28, which are more prescriptive than PDPO guidance. A DPA designed to satisfy GDPR Article 28 will also satisfy PDPO DPP4 requirements — organisations subject to both regimes should draft DPAs to the higher GDPR standard. forms-legal.com provides this Data Processing Agreement template for Hong Kong organisations compliant with PDPO DPP4 and aligned with GDPR Article 28 requirements.

A Data Processing Agreement in Hong Kong is needed whenever a data user engages a third party to process personal data on its behalf — any outsourcing arrangement where the service provider accesses, stores, analyses, or otherwise handles personal data belonging to the data user's customers, employees, or other data subjects.

Cloud computing and SaaS platform engagements are the most common trigger. When a Hong Kong organisation uploads personal data to a cloud storage service (AWS S3, Microsoft Azure Blob, Google Cloud Storage), a cloud-based CRM (Salesforce, HubSpot), an HR management system (Workday, SAP SuccessFactors), or any other SaaS platform, the cloud provider processes that personal data on the organisation's behalf. A DPA must be in place before the first data upload. The PCPD's guidance on cloud computing specifically addresses the obligations of data users when personal data is stored in cloud infrastructure, including infrastructure located outside Hong Kong.

Payroll and HR outsourcing engagements require a DPA because they involve processing of particularly sensitive employee personal data — HKID numbers, MPF account details, bank account numbers, salary records, tax filing data, and medical information. Payroll processors in Hong Kong frequently handle IRD tax reporting data and MPFA-related contribution records — the sensitivity of this data and its regulatory context make a written DPA with strong security and confidentiality obligations essential.

Marketing, analytics, and advertising technology engagements require a DPA when a marketing agency, analytics provider, or programmatic advertising platform processes customer personal data. DPP3 of Cap. 486 restricts use of personal data to the purpose of collection — a marketing processor must be contractually bound to use customer data only for the specific marketing purposes authorised by the data user, and not for the processor's own commercial use.

Legal, accounting, and professional services engagements where advisers are given access to personal data as part of their work — conducting due diligence, preparing tax returns, auditing financial records — should be governed by a DPA to document the purpose limitation and confidentiality obligations.

Healthcare IT system vendors and diagnostic laboratories that access or process patient health information on behalf of hospitals, clinics, or insurance companies require a DPA addressing the heightened sensitivity of health data under PCPD guidance and the Hospital Authority's data governance requirements.

The DPA should be executed and signed by both parties before any personal data is transferred to or accessed by the processor. Retroactive DPAs — executed after processing has commenced — leave the data user exposed to regulatory risk for the period of uncontrolled processing.

A Data Processing Agreement for Hong Kong organisations under the Personal Data (Privacy) Ordinance (Cap. 486) must address the following essential elements to satisfy DPP4 obligations and PCPD guidance on data processor contracts.

Parties and Roles identifies the data user (the organisation that controls personal data and gives instructions to the processor) and the data processor (the third party that processes data on the data user's behalf), together with their Hong Kong business registration numbers, registered addresses, and designated data protection contacts. The distinction between data user and data processor should be clearly stated, as the 2021 amendments to Cap. 486 now enable the PCPD to directly regulate and enforce against data processors.

Scope and Purpose of Processing defines precisely what personal data the processor will handle — the categories of personal data (names, HKID numbers, financial records, health data), the categories of data subjects (customers, employees, patients), the purposes of processing (payroll administration, customer analytics, cloud storage), and the duration of processing. Processing outside the defined scope is prohibited without the data user's prior written instruction, consistent with DPP3 of Cap. 486.

Processor Obligations requires the processor to: process personal data only on the documented instructions of the data user; require all personnel with access to personal data to be bound by confidentiality obligations; implement and maintain appropriate technical and organisational security measures consistent with DPP4; assist the data user in complying with data subject access and correction requests under sections 18 and 22 of Cap. 486 within the 40-day statutory period; not engage sub-processors without the data user's prior written consent; and cooperate with PCPD investigations involving the processed data.

Security Requirements specifies the minimum security standards the processor must maintain — encryption of personal data in transit and at rest, role-based access controls, regular vulnerability assessments, staff security training, and physical security for data centres. The standards should reflect the sensitivity of the personal data involved and align with PCPD security guidance under DPP4 and, where applicable, HKMA technology risk management expectations.

Data Breach Notification requires the processor to notify the data user without undue delay — typically within 24 to 48 hours — upon discovering any actual or suspected personal data breach, providing sufficient detail for the data user to assess the breach and decide whether to voluntarily notify the PCPD and affected individuals under the PCPD's data breach guidance. As of 2026, PDPO does not mandate breach notification, but HKMA-regulated data users must report material incidents to the HKMA within specified timeframes.

Sub-Processing Controls specify whether the processor may engage sub-processors, the requirement for the data user's prior written approval, and the obligation to impose equivalent data protection obligations on sub-processors. The data user should maintain a current list of approved sub-processors.

Data Return and Deletion requires the processor to securely delete or return all personal data at the end of the agreement and certify in writing that deletion has been completed. Deletion must be by a method that prevents reconstruction of the data (for electronic records: secure erasure software, degaussing, or physical destruction of media; for paper records: cross-cut shredding).

Audit Rights entitle the data user to audit the processor's compliance with the DPA — by questionnaire, third-party audit report, or on-site inspection — at reasonable intervals and on reasonable notice. The processor must cooperate fully with audits and provide access to relevant records and systems.

Governing Law and Liability specifies Hong Kong law as the governing law, the data user's right to terminate the DPA and the underlying service agreement for material processor breach of the DPA, and the allocation of liability between the parties for PDPO enforcement costs and third-party claims arising from processor non-compliance. The forms-legal.com Data Processing Agreement (Hong Kong) template covers the mandatory elements under Personal Data (Privacy) Ordinance (Cap. 486).