Software Development Agreement (Hong Kong)

A Software Development Agreement in Hong Kong records the terms the parties accept and the commitments each makes to the other.

Intellectual property ownership is the most commercially critical element of any Hong Kong Software Development Agreement. Under Section 5 and Section 14 of the Copyright Ordinance (Cap. 528), software qualifies as a literary work protected by copyright from creation. Where a developer is engaged as an independent contractor rather than an employee, copyright in the software vests in the developer as author, not in the client who commissioned and paid for the work. Section 36 of Cap. 528 requires that any assignment of copyright must be in writing and signed by the assignor. Without a written assignment in the Software Development Agreement, the client has at best an implied licence to use the software for its original commissioned purpose — but cannot sublicense it, adapt it for new purposes, or claim exclusive rights against the developer.

Hong Kong's software development market is substantial and growing, driven by the Innovation and Technology Bureau, the Hong Kong Science Park, Cyberport, and the government's commitment to financial technology (FinTech) and smart city initiatives. Banks regulated by the Hong Kong Monetary Authority (HKMA), licensed corporations supervised by the Securities and Futures Commission (SFC), and insurers under the Insurance Authority (IA) regularly commission bespoke software for trading platforms, client onboarding systems, regulatory reporting tools, and mobile banking applications. Software built for financial institutions in Hong Kong must comply with applicable regulatory circulars, including HKMA's Supervisory Policy Manual TM-G-1 on technology risk management and the SFC's guidelines on electronic trading.

Where the software processes personal data of Hong Kong individuals — customer records, employee data, health information, or financial profiles — the Personal Data (Privacy) Ordinance (Cap. 486) applies. The software must be designed in compliance with DPP4 (data security), DPP1 (purpose limitation), and DPP2 (retention limitation) of Schedule 1 to Cap. 486. The Office of the Privacy Commissioner for Personal Data (PCPD) expects data-processing systems to embed privacy by design principles, which should be contractual obligations in the Software Development Agreement.

Hong Kong software contracts rely on the Copyright Ordinance (Cap. 528), the Control of Exemption Clauses Ordinance (Cap. 71), the Contracts (Rights of Third Parties) Ordinance (Cap. 623), and general common law contract principles developed by the Court of First Instance and Court of Appeal. Dispute resolution for software development disputes typically proceeds through the Commercial List of the High Court or through arbitration under the Hong Kong International Arbitration Centre (HKIAC) rules, given the technical complexity of many software disputes. Forms-legal.com provides this Software Development Agreement template aligned with Hong Kong's Copyright Ordinance and technology regulatory expectations.

Hong Kong's technology sector is supported by the Innovation and Technology Commission (ITC), which administers the Innovation and Technology Fund (ITF) for technology development projects. Software developed with ITF grant funding is subject to specific intellectual property terms — the Government typically retains rights to results and may require open access to funded software. The Hong Kong Science Park and Cyberport provide co-working, incubation, and acceleration programmes that frequently involve software development agreements between tenant companies and their technology partners.

A Software Development Agreement in Hong Kong is needed before any custom software project commences — regardless of project size or the parties' prior working relationship.

Startups at the Hong Kong Science Park or Cyberport commissioning a mobile application, SaaS platform, or API integration from a freelance developer or development agency must execute a Software Development Agreement before any code is written. Without a written agreement, disputes about scope, delivery dates, and copyright ownership are common and costly to resolve. Under Section 36 of the Copyright Ordinance (Cap. 528), the client cannot obtain ownership of the source code without a written signed assignment — a verbal agreement that the client 'owns' the software has no legal effect.

Financial institutions licensed by the HKMA or the SFC engaging developers to build trading systems, client portals, or regulatory reporting tools need a Software Development Agreement that addresses technology risk management requirements under HKMA's Supervisory Policy Manual TM-G-1. The agreement must specify security standards, penetration testing requirements, and disaster recovery capabilities consistent with HKMA expectations.

Healthcare providers — including hospitals under the Hospital Authority and private clinics — commissioning electronic health record systems, telemedicine platforms, or patient management software need a Software Development Agreement that addresses compliance with the Personal Data (Privacy) Ordinance (Cap. 486), the Code on Hospital Practice issued by the Department of Health, and the Hospital Authority's IT governance standards.

Retail and e-commerce businesses commissioning customer-facing applications that process payment card data must address Payment Card Industry Data Security Standard (PCI-DSS) requirements in the Software Development Agreement, alongside PDPO compliance for customer personal data under Cap. 486.

Government contractors and NGOs receiving Innovation and Technology Fund grants from the Innovation and Technology Bureau to develop technology projects must execute Software Development Agreements that address government-specific intellectual property requirements, audit rights, and open data obligations consistent with their grant conditions.

A Software Development Agreement is also needed when a legacy system reaches end-of-life — replacing outdated compliance systems or first-generation mobile apps requires the agreement to address data migration, parallel running, cutover planning, and decommissioning of the legacy system. Any scope changes after project commencement must be governed by a formal change control clause, formalising what additional features are included and at what additional cost.

A Software Development Agreement for use in Hong Kong must address the following core elements under the Copyright Ordinance (Cap. 528), the Control of Exemption Clauses Ordinance (Cap. 71), and Hong Kong contract law.

Project scope and specifications must be defined with precision. The scope of work — whether a functional specification document, user stories, wireframes, or a technical architecture document — should be attached as a schedule to the agreement. Scope creep is the leading cause of software development disputes brought before the Commercial List of the High Court of Hong Kong. Any change to the agreed scope must be governed by a formal change control procedure specifying how requests are submitted, evaluated, priced, and approved before additional work commences.

Milestones and delivery schedule must set out the project timeline in measurable stages: design sign-off, prototype delivery, alpha testing, beta delivery, user acceptance testing completion, and production deployment. Each milestone should specify the deliverable, the acceptance criteria, and the milestone payment amount. Milestone-based payment structure — releasing fees only upon milestone acceptance — protects the client against developer abandonment and gives the developer clear payment triggers.

Intellectual property ownership and assignment must state unambiguously who owns the copyright in the completed software, source code, documentation, and all interim deliverables. For clients who require full ownership, the agreement must include a written assignment of copyright signed by the developer as required by Section 36 of the Copyright Ordinance (Cap. 528). The assignment should expressly cover: the source code and object code; all software documentation; any derivative works; and rights to seek protection of the software in Hong Kong and other jurisdictions. The developer should retain a licence to use pre-existing tools, libraries, and frameworks incorporated in the software, including all open source components.

Open source software disclosure requires the developer to list all open source components incorporated in the software (a Software Bill of Materials), identify their licences, and confirm compliance with each licence's terms. GPL-licensed components in Hong Kong are enforceable as contractual licences under Cap. 528 — their copyleft obligations must be assessed before incorporation into proprietary commercial software.

Acceptance testing provisions must specify: the functional and performance acceptance criteria; the acceptance testing period (typically 10–30 business days from delivery); the defect reporting procedure; the developer's obligation to rectify defects within timeframes classified by severity; re-testing procedures; and the consequences of the developer's failure to achieve acceptance within a long-stop date, including the client's right to terminate and claim a refund under Hong Kong common law.

Warranties must require the developer to warrant that: the software will substantially conform to specifications for a stated warranty period (typically 3–12 months post-acceptance); the software does not infringe any third-party intellectual property rights under Cap. 528; the software complies with the Personal Data (Privacy) Ordinance (Cap. 486) where it processes personal data; and the software does not contain malicious code or security vulnerabilities identified in common vulnerability databases.

Limitation of liability under the Control of Exemption Clauses Ordinance (Cap. 71): developers typically seek to cap liability at the total fees paid and exclude consequential loss. Under Cap. 71, exclusion clauses between commercial parties are enforceable if they satisfy the reasonableness test in Schedule 2 to Cap. 71. Limitations on liability for death or personal injury caused by negligence remain void under Cap. 71 regardless of agreement terms.

Data protection provisions must require the developer to comply with the PDPO (Cap. 486) for any personal data processed during development or testing — including test data that may contain real customer information — and to delete or return all personal data upon project completion.

Post-delivery support and maintenance terms should address: the warranty support period; the scope of post-warranty maintenance including bug fixes, security patches, and compatibility updates; service level agreements for incident response; and pricing for ongoing support engagements. The forms-legal.com Software Development Agreement template is drafted for Hong Kong projects under the Copyright Ordinance (Cap. 528) and pairs with the Non-Disclosure Agreement and Service Agreement available on the platform.