GBA Contract simplifies data transfers for Hong Kong businesses

New regime streamlines cross-border data compliance.

The first phase of the GBA Standard Contract implementation has launched in the banking, credit referencing, and healthcare sectors, with expansion to additional sectors expected soon.

Before 2023 ended, the Cyberspace Administration of China (CAC) and Hong Kong's Innovation, Technology & Industry Bureau introduced the Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (GBA Standard Contract). 

This new arrangement is set to simplify cross-border data transfers between Hong Kong and the nine Mainland China cities within the Greater Bay Area (GBA), offering significant advantages to Hong Kong businesses with cross-border data needs.

According to James Gong, Legal Director at Bird & Bird, the GBA Standard Contract provides Hong Kong companies with a streamlined alternative to the national data export regime. "It simplifies the data export procedures, reduces the number of materials to be submitted, and shortens the time it takes to file," Gong said. 

Dora Si, Partner for Intellectual Property Department at Deacons, highlighted that the GBA arrangement offers a more relaxed compliance regime compared to the broader Personal Information Protection Law in mainland China. "The arrangement is beneficial especially to those focusing on the GBA market as it applies regardless of the volume of personal information being transferred," Si explained. This flexibility is crucial for businesses handling large volumes of personal data, such as financial institutions and healthcare providers.

Gong noted that industries with a strong need for cross-border data transfers, like finance and healthcare, would gain the most from the GBA Standard Contract. Si added that the arrangement would also aid businesses in the innovation and technology sector, which often require substantial amounts of personal information for development.

Despite being a voluntary arrangement, experts believe that many companies will opt for the GBA Standard Contract, particularly those with high cross-border data demands. Gong pointed out that the regime is most suitable for companies whose data transfers are confined within the GBA. 

For businesses with lower data transfer needs, the GBA Standard Contract might not be an immediate priority, but it remains a recommended consideration for future-proofing operations. Si emphasised the importance of regular data audits and maintaining strong cybersecurity and organisational measures. "It will be in the interest of Hong Kong companies to look into the GBA standard contract arrangement sooner than later," she concluded.