Skip to content

Guidance Notes

Guidance Notes

Fact Sheet No. 1, April 1997

TRANSFER OF PERSONAL DATA OUTSIDE HONG KONG: SOME COMMON QUESTIONS

Model Contract

Below sets out a model contract which may be adapted by parties wishing to transfer personal data outside Hong Kong in accordance with section 33(2)(f) of the Personal Data (Privacy) Ordinance.

Applicable law

The parties are free to choose the law applicable to the contract between the transferor and transferee. The applicable law should be explicitly stated in the contract.

The terms of the model contract are as follows:

1. Obligations of the Transferor

The Transferor represents and warrants to the transferee that the personal data is lawfully transferred to the transferee and that in accordance with data protection principle 3 in Schedule 1 of the Personal Data (Privacy) Ordinance ("the Ordinance"):

  • the personal data have been collected in accordance with data protection principle 1 of the Ordinance;
     
  • all reasonably practicable steps have been taken to ensure their accuracy in accordance with data protection principle 2 of the Ordinance.
     
  • the data has not been retained longer than is necessary for the fulfillment of the purpose (including any directly related purpose) for which the data is to be used.
     
  • the transfer of the personal data is permitted by data protection principle 3 of the Ordinance.

2. Obligations of the Transferee

The transferee represents and warrants for his part that in using the data he will respect in all regards the principles set out in the representations and warranties of the transferor and that he will prohibit any processing or use of the data that would not be in accordance with the contract. For this purpose, the transferee undertakes in particular to respect the following non-exhaustive list of obligations:

  • the transferee will use the data for the following purpose[s] to the exclusion of any other purpose, namely [ the purpose[s] in question should be listed].
     
  • the transferee shall hold the data securely in accordance with the requirements of data protection principle 4 of the Ordinance.
     
  • the data shall not be retained longer than is necessary for the fulfillment of the purpose (including any directly related purpose) for which the data is to be used.
     
  • the transferee shall use the data exclusively for his own purposes and shall not transfer or disclose, either free of charge or in return for payment, the data to any other legal or natural person, except when there is an obligation under his domestic law, which shall be specified.
     
  • the transferee shall immediately rectify, erase and complete the data on receiving instructions to this effect from the transferor. The transferee undertakes in particular to rectify, erase or complete all or part of the data if it appears that such measures are required by the requirements of the Ordinance.

The transferee undertakes to ensure that data subjects have rights of access to and correction of their data in the same way as they would have had under the Ordinance.

Should the transferee refuse to allow data subjects to exercise their rights of access and correction of personal data as aforesaid, the transferor shall

- either terminate purely and simply the contract, on the conditions and with the consequences which result from this as mentioned in clause 5.

- or set in motion the procedure for designation of an arbitrator as mentioned in clause 4.

3. Liability and indemnity

The transferee shall be liable for the processing and use of the data which has been transferred by the transferor

The transferee undertakes to indemnify the transferor for any breach resulting from his obligations under the contract or for any fault or negligence arisen from the execution of the contract.

4. Settlement of disputes

Any dispute or difference arising out of or in connection with this contract shall be referred to and determined by arbitration at the Hong Kong International Arbitration Centre and in accordance with the UNCITRAL Arbitration Rules.

5. Termination of the contract

Should the transferee show bad faith in the execution of the contract or refuse to respect, in particular, the decision of the arbitrators, the transferor reserves the right to terminate the contract by registered letter with recorded delivery, or by any other equivalent means, and without prejudice to any claim for damages and interest.

On termination of the contract, the transferee shall destroy the data and inform the transferor accordingly.

In case of failure to respect the preceding clause, the transferee undertakes to pay to the transferor the sum of [to be specified].

 

Data Protection Principles

Introduction