On September 25, 2024, the Digital Policy Office of the Hong Kong Special Administrative Region Government published updated filing guidelines on the Standard Contract for the Cross-boundary Flow of Personal Information in the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong) (the GBA Standard Contract). The Annex of the guidelines also includes a template filing form.

Scope

The guidelines guide personal information processors and recipients in filing procedures under the GBA Standard Contract. They apply to the Hong Kong contracting parties under the GBA Standard Contract, regardless of whether they are the personal information processor or recipient.

Filling process

Following the guidelines, the personal information processor and recipient of Hong Kong must file the following documents, among others, by post or in-person to the Digital Policy Office within 10 working days from the signing date of the GBA Standard Contract:

• completed filing form;
• proof of identity;
• signed original copy of the GBA Standard Contract; and
• original copy of the undertaking.

The Digital Policy Office will proceed to check for completeness of the submission, and if needed will ask for supplementary documents to be provided within 10 days. If the filing requirements are fulfilled a filing reference number will be issued to the personal information processor or an acknowledgement to the recipient.

Lastly, the guidelines outlined that in case of changes to the cross-boundary transfers of personal information, such as in terms of purpose, scope, categories, means, or retention schedules, the personal information processor must:

• re-conduct a personal information protection impact assessment;
• sign a supplementary agreement or enter into a new GBA Standard Contract; and
• conduct the corresponding filing procedures.

You can read the guidelines here.