1. International Data Transfers: Required if employee data may be transferred outside Hong Kong

2. Sensitive Personal Data: Required if collecting sensitive data like medical information or biometric data

3. Monitoring and Surveillance: Required if workplace monitoring or surveillance systems are in place

4. Remote Working Provisions: Required if employees work remotely and handle data outside the office

5. Third-Party Processing: Required if third-party service providers process employee data

6. Industry-Specific Requirements: Required for regulated industries with additional data protection requirements

1. Schedule 1: Categories of Personal Data: Detailed list of all types of personal data collected and processed

2. Schedule 2: Data Processing Activities: Comprehensive list of processing activities and their purposes

3. Schedule 3: Security Measures: Detailed description of technical and organizational security measures

4. Schedule 4: Retention Periods: Specific retention periods for different categories of personal data

5. Schedule 5: Approved Third-Party Processors: List of approved third-party processors and their roles

6. Appendix A: Data Subject Access Request Form: Standard form for employees to request access to their personal data

7. Appendix B: Data Breach Reporting Form: Standard form for reporting potential data breaches

8. Appendix C: Privacy Policy: Company's general privacy policy referenced in the agreement