The Data Privacy Addendum is essential for businesses operating in or with Hong Kong that engage in personal data processing activities. This document supplements primary service agreements where one party processes personal data on behalf of another, ensuring compliance with Hong Kong's Personal Data (Privacy) Ordinance and related regulations. It becomes necessary when organizations outsource data processing activities, use cloud services, or engage third-party service providers who will have access to personal data. The addendum defines crucial aspects such as data handling responsibilities, security requirements, breach notification procedures, and cross-border transfer mechanisms. It's particularly important given Hong Kong's unique position as a global business hub and its data protection requirements that bridge international standards with local and regional considerations, including interaction with mainland China's data protection regime.

1. Parties: Identification of the parties, including their roles as data controller(s) and/or data processor(s)

2. Background: Context of the addendum, reference to the main agreement, and purpose of the data processing relationship

3. Definitions: Key terms aligned with PDPO definitions, including Personal Data, Processing, Data Subject, Data User, Data Processor

4. Scope and Purpose of Processing: Detailed description of the personal data to be processed and permitted processing purposes

5. Obligations of the Data Processor: Specific duties including security measures, confidentiality, breach notification, and compliance with data protection principles

6. Obligations of the Data Controller: Responsibilities including lawful instructions, cooperation, and compliance with PDPO requirements

7. Cross-border Data Transfers: Rules and safeguards for transferring data outside Hong Kong

8. Security Measures: Technical and organizational measures required to protect personal data

9. Data Breach Notification: Procedures and timeframes for reporting data breaches

10. Audit Rights: Controller's rights to verify compliance and processor's obligations to demonstrate compliance

11. Term and Termination: Duration of the addendum and specific termination provisions

12. Return or Deletion of Data: Obligations regarding personal data upon termination of services

13. Governing Law and Jurisdiction: Confirmation of Hong Kong law governance and jurisdiction