Commissioned Data Processing Agreement Template for Hong Kong

The Commissioned Data Processing Agreement is essential for organizations operating in Hong Kong that outsource the processing of personal data to third parties. This document is required to comply with the Hong Kong Personal Data (Privacy) Ordinance (PDPO) and related data protection regulations. It's particularly important in the context of Hong Kong's role as a major international business center, where cross-border data flows are common. The agreement details the obligations of both the data controller and processor, including security measures, confidentiality requirements, breach notification procedures, and audit rights. It should be used whenever an organization (the data controller) engages another party (the data processor) to process personal data on its behalf, whether for cloud services, payment processing, HR management, or other data handling services.

1. Parties: Identification of the data controller and data processor, including full legal names and registered addresses

2. Background: Context of the agreement, relationship between parties, and purpose of the data processing arrangement

3. Definitions: Definitions of key terms used in the agreement, including technical terms and terms defined by the PDPO

4. Scope and Purpose of Processing: Detailed description of the data processing activities, types of data involved, and permitted purposes

5. Duration: Term of the agreement, including commencement date and termination provisions

6. Data Processor Obligations: Core obligations of the processor including security measures, confidentiality, and compliance with instructions

7. Data Controller Obligations: Responsibilities of the controller including providing clear instructions and ensuring lawful basis for processing

8. Security Measures: Technical and organizational security measures required to protect personal data

9. Subprocessing: Conditions and requirements for engaging subprocessors

10. Data Breach Notification: Procedures and timeframes for reporting data breaches

11. Audit Rights: Controller's rights to audit processor's compliance and processor's obligations to demonstrate compliance

12. Return or Deletion of Data: Requirements for handling personal data upon termination of services

13. Liability and Indemnities: Allocation of liability and indemnification obligations

14. General Provisions: Standard contractual provisions including governing law, jurisdiction, and entire agreement