Intercompany Data Processing Agreement Template for Hong Kong

An Intercompany Data Processing Agreement is a legally binding contract that governs how personal data is processed between affiliated companies within a corporate group under Hong Kong law. When one group entity acts as a data processor on behalf of another group entity serving as the data controller, this agreement ensures compliance with the Personal Data (Privacy) Ordinance (PDPO) and establishes clear responsibilities for data protection obligations.

When do you need this document?

You need an Intercompany Data Processing Agreement when your Hong Kong group company processes personal data on behalf of another group entity, such as when a subsidiary handles customer data for its parent company or when centralised HR departments process employee information across multiple group entities. This document is essential for shared services arrangements, including IT support, payroll processing, customer service operations, or marketing activities conducted by one group company for another. The agreement becomes particularly important when personal data crosses jurisdictional boundaries within your corporate group, ensuring compliance with Hong Kong's transfer requirements and maintaining adequate protection standards. Even though the entities are related, Hong Kong's PDPO requires formal documentation of processing arrangements to demonstrate accountability and establish clear data protection responsibilities.

Key legal considerations

The agreement must clearly define the roles of data controller and data processor, specifying the scope and purpose of processing activities in detail. Essential clauses include data security measures that meet PDPO requirements, breach notification procedures with specific timeframes, and audit rights allowing the controller to verify compliance. The document should address data retention periods, deletion requirements, and procedures for handling data subject requests including access, correction, and erasure rights. Sub-processing arrangements must be carefully regulated, requiring prior written consent and ensuring adequate protection when other group entities are involved. Liability allocation between group companies requires careful consideration, balancing commercial relationships with regulatory compliance obligations. The agreement should include termination provisions specifying data return or destruction requirements and survival clauses for ongoing obligations.

Legal requirements in Hong Kong

Under Hong Kong's Personal Data (Privacy) Ordinance, the agreement must ensure compliance with all six Data Protection Principles, particularly focusing on security safeguards and data quality requirements. The document must address cross-border data transfer requirements, incorporating appropriate safeguards when personal data moves between Hong Kong and other jurisdictions within the group structure. Specific provisions are needed for handling data subject requests, ensuring responses within the statutory timeframe of 40 days unless exemptions apply. The agreement should incorporate Privacy Commissioner guidelines on data processing and transfer, particularly the Transfer of Personal Data Guidelines for international group structures. Documentation requirements under the Companies Ordinance must also be considered, ensuring proper corporate authorisation and record-keeping for intercompany agreements involving data processing activities.