Joint Controller Data Processing Agreement Template for Hong Kong

When your organization collaborates with other entities to process personal data in Hong Kong, you need a Joint Controller Data Processing Agreement to ensure compliance with the Personal Data (Privacy) Ordinance (PDPO). This legal document establishes the framework for shared data processing responsibilities and protects all parties from regulatory violations while maintaining transparent data protection practices.

When do you need this document?

You require this agreement whenever two or more organizations jointly determine how and why personal data is processed. Common scenarios include joint ventures where partners share customer databases, collaborative research projects involving participant data, shared services arrangements between affiliated companies, and marketing partnerships that involve data exchange. The agreement is also essential when organizations co-develop products or services that require shared access to personal data, or when multiple entities provide integrated services to the same data subjects. Without this agreement, you risk unclear accountability, regulatory non-compliance, and potential disputes over data protection responsibilities.

Key legal considerations

Your agreement must clearly define each controller's specific roles, responsibilities, and decision-making authority over the shared data processing activities. Include detailed provisions for data security measures, breach notification procedures, and individual rights fulfillment processes. Address liability allocation between joint controllers, ensuring fair distribution of potential penalties or compensation obligations. The document should establish clear communication protocols for regulatory interactions and specify which controller will serve as the primary contact point with Hong Kong's Privacy Commissioner. Additionally, include termination clauses that address data deletion, return, or continued processing rights when the joint controller relationship ends.

Legal requirements in Hong Kong

Under the PDPO, your agreement must ensure compliance with all six Data Protection Principles, particularly regarding lawful and fair collection, accuracy, and security safeguards. The document must address cross-border data transfer requirements if either controller operates outside Hong Kong, incorporating appropriate safeguards as outlined in PCPD guidance. Include provisions for data subject rights fulfillment, specifying how individuals can access, correct, or request deletion of their personal data from either controller. The agreement should also establish data breach handling procedures that comply with PCPD guidelines, including notification timelines and responsibility allocation. Ensure your document addresses data retention periods, processing limitations, and consent management where applicable under Hong Kong law.