DPA Addendum Template for Hong Kong

A Data Processing Addendum (DPA Addendum) is a supplementary legal agreement that governs the relationship between a data controller and data processor under Hong Kong's data protection laws. When you engage a third-party service provider to process personal data on your behalf, this document ensures compliance with the Personal Data (Privacy) Ordinance (PDPO) and establishes clear obligations for both parties regarding data handling, security, and privacy protection.

When do you need this document?

You need a DPA Addendum whenever your Hong Kong business outsources any personal data processing activities to external service providers. This includes cloud storage services, IT support providers, marketing agencies, payroll processors, or any vendor that will access, store, or process personal data on your behalf. The document is particularly crucial when engaging international service providers, as Hong Kong's PDPO requires specific safeguards for cross-border data transfers. You also need this addendum when your existing service agreements don't adequately address data protection obligations, or when you're updating contracts to reflect current PDPO compliance requirements following recent regulatory updates.

Key legal considerations

Your DPA Addendum must clearly define the scope and purpose of data processing activities, ensuring the processor only handles data for specified, legitimate purposes. The document should establish robust data security measures, including encryption, access controls, and incident response procedures that meet PDPO standards. You need to include specific clauses addressing data subject rights, such as access, correction, and erasure requests, with clear procedures for handling these requests within statutory timeframes. The addendum must also cover data breach notification requirements, establishing immediate notification procedures to both you as the controller and potentially to the Privacy Commissioner. Sub-processor arrangements require careful consideration, with your processor needing written authorization before engaging additional parties and ensuring equivalent protection standards throughout the processing chain.

Legal requirements in Hong Kong

Under Hong Kong's PDPO, your DPA Addendum must comply with the six Data Protection Principles, particularly focusing on purpose limitation, data security, and retention limits. The document must address cross-border transfer requirements if data will be processed outside Hong Kong, ensuring adequate protection through approved transfer mechanisms or Privacy Commissioner guidance compliance. You need to establish clear data retention and deletion schedules aligned with PDPO requirements and your business needs. The addendum should include audit rights allowing you to verify the processor's compliance with data protection obligations, including the right to conduct inspections and receive compliance reports. Your agreement must also address the processor's obligations to assist with data protection impact assessments when required and to provide necessary information for Privacy Commissioner inquiries or investigations.