Legal update: New recommended model clauses for cross-border transfer of personal data

09Jun2022

In this snapshot legal update, we report that on 12 May 2022 the Privacy Commissioner for Personal Data (“PCPD”) published new guidance on recommended model contractual clauses for cross-border transfers of personal data (“Model Contractual Clauses Guidance”). This supplements prior guidance published by the PCPD on cross-border personal data transfers in December 2014, and which we briefly touched upon in our Q&A here.

The Model Contractual Clauses Guidance provides two sets of recommended model contractual clauses (“RMCs”) to address two different scenarios in cross-border personal data transfers, being:

  1. from one data user to another data user; and
  2. from a data user to a data processor.

The RMCs are free-standing clauses that the parties to the personal data transfer can incorporate into their agreements, whether data processing agreements or general service agreements. The PCPD also advocates in the Model Contractual Clauses Guidance that the data transferor should incorporate additional contractual measures in respect of reporting, audit and inspection rights, notification of breach, and compliance support and cooperation.

To date, there is no direct statutory restriction in Hong Kong on the transfer of personal data outside of Hong Kong. Adoption of the recommended model clauses is considered best practice, rather than a mandatory obligation. The advantage of adopting the RMCs is that it will support a data user to demonstrate that it has considered the potential risks of cross-border personal data transfers and has taken appropriate measures to ensure compliance with general statutory obligations on data protection. This will be one of the factors the PCPD will consider in its investigation of an alleged breach of data protection principles and general statutory obligations.

Pádraig Walsh, Tara Chan and Samantha Chan

If you would like to discuss any of the matters raised in this article, please contact:

Pádraig Walsh
Partner | E-mail

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication.