IT Support Agreement (Hong Kong)

An IT Support Agreement in Hong Kong records the terms the parties accept and the commitments each makes to the other.

Section 5 of the Supply of Services (Implied Terms) Ordinance (Cap. 457) implies into every business-to-business IT support contract a term that the provider will carry out services with reasonable care and skill — the standard expected of a reasonably competent IT support professional. Section 6 implies a term of performance within a reasonable time where no time is fixed. These implied terms set the statutory floor for IT support quality in Hong Kong; express SLA provisions in the agreement give contractual specificity to these obligations and establish agreed remedies (typically service credits) for non-performance.

The Personal Data (Privacy) Ordinance (Cap. 486) is directly relevant to IT support because support providers routinely access client systems containing personal data of the client's employees, customers, and counterparties. Data Protection Principle 4 (DPP 4) of the PDPO requires the client (as data user) to take all practicable steps to confirm that personal data in its systems is protected against unauthorised access — including by its IT support provider. The Privacy Commissioner for Personal Data has published guidance recommending that data processing obligations of service providers be set out in written contracts. A compliant IT Support Agreement includes provisions restricting the provider's use of personal data, requiring appropriate security measures, and obligating prompt breach notification.

The Copyright Ordinance (Cap. 528) governs ownership of scripts, code patches, configurations, and technical documentation created by the IT support provider during the engagement. Under section 11(1) of Cap. 528, copyright in works created by an independent contractor vests in the contractor rather than the client, unless a written assignment complying with section 22 of Cap. 528 is executed. Clients who require ownership of bespoke support tools and scripts created for their systems should confirm the IT Support Agreement includes an express copyright assignment.

The Control of Exemption Clauses Ordinance (Cap. 71) governs the enforceability of liability limitation clauses in Hong Kong IT support contracts. Liability caps and exclusions of consequential loss are generally enforceable between commercial parties where they satisfy the reasonableness test in Cap. 71. Liability for death or personal injury caused by negligence cannot be excluded under Cap. 71 regardless of contractual terms.

Hong Kong imposes no GST or VAT. All support fees, call-out charges, and parts costs are expressed in HKD. For clients in regulated sectors — banking (supervised by the HKMA), securities (supervised by the SFC), and insurance (supervised by the Insurance Authority) — the relevant regulator's outsourcing guidelines impose additional requirements on IT support arrangements, including risk assessments, regulatory notification, and mandatory contractual provisions.

An IT Support Agreement in Hong Kong is needed whenever a business engages an external IT support provider on an ongoing or retainer basis, replacing informal verbal arrangements that leave both parties legally exposed.

A small or medium-sized enterprise (SME) in Hong Kong engaging a local IT support firm for monthly helpdesk, desktop support, and network maintenance services requires a written IT Support Agreement to document the scope of services, the monthly retainer in HKD, SLA response times, and the provider's obligations under the Personal Data (Privacy) Ordinance (Cap. 486). Without a written agreement, the client's only protection is the implied term of reasonable care and skill under section 5 of the Supply of Services (Implied Terms) Ordinance (Cap. 457) — a lower standard of protection than express contractual SLAs.

A company operating in a regulated sector — such as a licensed bank under the Banking Ordinance (Cap. 155), a licensed corporation under the Securities and Futures Ordinance (Cap. 571), or an authorised insurer under the Insurance Ordinance (Cap. 41) — must confirm its IT support arrangements comply with the relevant regulator's outsourcing requirements. The HKMA's Supervisory Policy Manual module SA-2 requires authorised institutions to assess and manage risks associated with IT outsourcing, and mandates specific contractual provisions including audit rights and business continuity requirements.

A company experiencing rapid growth whose IT needs have outgrown informal arrangements should formalise its IT support engagement before system failures or data incidents expose it to liability. A written IT Support Agreement establishes clear accountability for system availability, incident response, and data protection.

A business that provides IT support services to multiple clients — whether as a managed services provider (MSP), IT consulting firm, or freelance IT professional — needs a standard-form IT Support Agreement to establish consistent terms across all client relationships, manage liability exposure through limitation clauses under Cap. 71, and satisfy its obligations under the Personal Data (Privacy) Ordinance (Cap. 486) as a data processor handling client data.

A company that has experienced a data breach or system failure caused by an IT provider without a written agreement should immediately formalise the arrangement with an IT Support Agreement containing clear security obligations, breach notification requirements, and liability provisions aligned with the PDPO (Cap. 486) and Hong Kong common law.

A business entering into a new lease for commercial premises in Hong Kong that requires IT infrastructure setup, cabling, and ongoing support should obtain an IT Support Agreement from the provider before work commences, addressing both the installation project and ongoing support obligations.

Any business whose IT support provider has access to personal data of customers, employees, or business partners — which describes virtually all IT support arrangements — needs written data processing provisions compliant with DPP 4 of the PDPO (Cap. 486) to avoid regulatory action by the Privacy Commissioner for Personal Data.

A professionally drafted IT Support Agreement for Hong Kong must include the following key elements to satisfy statutory requirements and provide meaningful protection for both the client and the service provider.

Party identification: the full legal names and Companies Registry registration numbers (for corporate parties under the Companies Ordinance, Cap. 622) of both the IT support provider and the client; their registered or principal addresses in Hong Kong; and the contact details of the designated representatives for day-to-day communications and formal notices.

Service scope: a detailed description of the technical support services included within the agreement — helpdesk support (phone, email, remote access), on-site support, network monitoring, server administration, hardware maintenance, software updates, and backup management. The agreement must clearly specify what is excluded from the scope (e.g. major infrastructure upgrades, new software implementations) to prevent scope creep disputes. Covered systems — specific servers, workstations, network devices, and software applications — should be listed in a schedule.

Service level agreements (SLAs): measurable performance standards that give contractual specificity to the standard of reasonable care and skill implied by section 5 of the Supply of Services (Implied Terms) Ordinance (Cap. 457). SLAs should cover: incident priority classification (Critical, High, Medium, Low with defined criteria); response time targets per priority (e.g. Critical: 1 hour, High: 4 hours, Medium: 1 business day); resolution time targets; system availability commitments (e.g. 99.5% monthly uptime for monitored systems); planned maintenance windows with advance notice requirements; and service credit remedies for SLA breaches (e.g. 5% of monthly fee per missed SLA metric, capped at 20% per month).

Fees and payment: the monthly retainer or per-incident fees in HKD (no GST or VAT applicable in Hong Kong); any additional charges for out-of-hours support, on-site visits, or hardware parts; invoicing schedule; payment terms (typically 30 days from invoice date); and late payment interest provisions (since Hong Kong has no statutory late payment interest regime for commercial contracts, the agreed rate should be specified).

Data protection provisions: obligations complying with the Personal Data (Privacy) Ordinance (Cap. 486). The provider must process personal data only for the purpose of providing IT support (DPP 3); implement technical and organisational security measures including access controls, encryption of sensitive data, and activity logging (DPP 4); notify the client promptly of any actual or suspected data breach; prohibit transfer of personal data outside Hong Kong without client consent (DPP 3); return or securely delete all personal data on termination and provide written confirmation.

IP provisions: ownership of pre-existing IP retained by each party; copyright in bespoke scripts, code patches, configurations, and documentation — either assigned to the client under a provision complying with section 22 of the Copyright Ordinance (Cap. 528) or licensed to the client on specified terms; and the provider's right to access and run the client's software solely for support purposes under a limited non-exclusive licence.

Liability and indemnity: limitation of liability to an agreed cap (typically 12 months' fees) under the Control of Exemption Clauses Ordinance (Cap. 71); exclusion of indirect and consequential loss; and client indemnities for claims arising from the client's own actions or data. Liability for death or personal injury caused by negligence cannot be excluded.

Term and termination: the agreement term (typically 12 months, auto-renewing unless notice given); grounds for early termination (material breach, insolvency, convenience); notice periods; and transition assistance obligations. The free IT Support Agreement template available at forms-legal.com covers all of the above elements in a format suitable for Hong Kong businesses.