Data Processing Agreement in Hong Kong: Template, Key Clauses and Local Law (2026)

What a data processing agreement does in Hong Kong A data processing agreement (DPA) is the contract that controls how one party (a data processor or service provider) handles personal data on behalf of another (the data user). In Hong Kong the DPA is how a data user meets its duty to protect personal data when it hands processing to a vendor, whether that vendor is in Hong Kong or overseas. ## The Hong Kong law that applies The main law is the Personal Data (Privacy) Ordinance (Cap. 486), known as the PDPO, enforced by the Privacy Commissioner for Personal Data (PCPD). Two points shape a DPA: - Direct duties sit with the data user. The PDPO places its obligations on the data user, not directly on the data processor. So the data user must use contract or other means to make the processor comply.

• Data Protection Principle 2 (retention) and Data Protection Principle 4 (security) require the data user to prevent data being kept longer than necessary and to guard against unauthorised access, loss, or use, including when a processor is involved. Cross-border transfer control under section 33 of the PDPO is not yet in force, but the PCPD recommends best practice, including its recommended model contractual clauses, when personal data leaves Hong Kong. This is general information, not legal advice. Confirm the position with a Hong Kong qualified lawyer before you sign. ## Key clauses to get right - Roles: name the data user and the data processor, and the subject matter and purpose of processing.
• Scope: the data types, data subjects, and duration of processing.
• Security: concrete measures that meet DPP4, with breach notice duties.
• Sub-processing: whether sub-processors are allowed and on what controls.
• Retention and return: deletion or return of data at the end, meeting DPP2.
• Cross-border transfers: safeguards aligned with the PCPD model clauses if data leaves Hong Kong.
• Audit and cooperation: rights to check compliance and help with data access requests. ## A simple DPA skeleton 1. Parties and definitions

2. Subject matter, nature, and purpose of processing
3. Categories of data and data subjects
4. Processor obligations and staff confidentiality
5. Security measures (DPP4)
6. Sub-processing controls
7. Data subject requests and cooperation
8. Breach notification
9. Cross-border transfer safeguards
10. Retention, return, and deletion (DPP2)
11. Audit rights and liability ## Common mistakes - Treating the PDPO like the GDPR and copying GDPR-only duties that do not map onto Hong Kong.

• Leaving sub-processing silent, so the vendor can hand data to anyone.
• No breach notice timeline or contact point.
• Ignoring the PCPD model clauses for overseas transfers. ## One workspace to manage it Privacy terms change as vendors, data flows, and rules change, so stale DPAs are a real risk. A single AI workspace like Adira can store every DPA, flag renewal and review dates, and let you edit a clause in plain language across a set of contracts. Adira is deepest on Indian law today, and wider non-India jurisdiction depth, including Hong Kong, is on its roadmap, so treat local PDPO review as a separate step.