The GBA Standard Contract is filed twice, once on each side of the boundary.
The GBA Standard Contract supports eligible transfers between the nine Mainland GBA cities and Hong Kong. Filing, consent and onward-transfer restrictions apply within its defined scope.
By Matthew Lee
Personal information cannot leave Mainland China without a lawful route.
The GBA Standard Contract (粤港澳大湾区（内地、香港）个人信息跨境流动标准合同) is a route for eligible transfers between the Mainland Greater Bay Area and Hong Kong. It is one option alongside the national routes and applicable exemptions.
The routes under PIPL Article 38
The Personal Information Protection Law of the PRC (PIPL) came into force on 1 November 2021. Article 38 says that a personal information processor that needs to provide personal information outside the Mainland must satisfy one of the following, unless a treaty or agreement provides otherwise:
| Route | What it involves | Who it suits |
|---|---|---|
| Security assessment | Assessment organised by the Cyberspace Administration of China (CAC) | Critical information infrastructure operators and large-volume transfers |
| Certification | Personal information protection certification by a professional body under CAC rules | Group transfers and transfers under one set of rules |
| Standard contract | CAC standard contract, filed with the provincial cyberspace administration | Eligible transfers within the applicable thresholds |
| Other conditions | Conditions set by other laws, administrative regulations or the CAC | Specific cases the CAC provides for |
Whichever route is used, Article 38 also requires the processor to take the measures needed so that the overseas recipient meets the protection standard of the law.
Article 39 requires the individual's separate consent to the transfer, after being told who will receive the data, for what purpose, by what means, which categories, and how to exercise their rights.
The GBA Standard Contract is a variant of the standard contract route for one corridor: a template and a filing procedure built for transfers between the Mainland part of the Greater Bay Area and Hong Kong.
What the contract is
The contract is voluntary and does not change the law in either place; a Hong Kong recipient remains subject to the Personal Data (Privacy) Ordinance.
Article 6 of the guidelines says the contract must be concluded strictly on the published template and that transfers start only after it takes effect. The parties may agree other terms so long as they do not conflict with it.
Who can use it
Article 2 of the guidelines requires both parties to be registered (organisations) or located (individuals) in the nine Mainland GBA cities or in Hong Kong. The nine cities are Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing.
The Digital Policy Office adds that each contract covers one direction only, so a two-way flow needs two contracts, and that Macao is not within the scope.
What it excludes
Personal information notified or published by the relevant authorities as important data is excluded. The parties, location, purpose and remaining legal requirements also determine whether this route is available.
The guidelines do not carve out sensitive personal information as a category. Sensitive data still carries the PIPL's own requirements of separate consent and a necessity test.
Article 5 requires a personal information protection impact assessment before any transfer, covering the lawfulness and necessity of the processing, the effect on individuals and the recipient's ability to meet its obligations. The Digital Policy Office says the assessment must be completed within three months before the filing date.
Article 4 restricts onward transfer. Personal information received under a GBA Standard Contract may not be provided to any organisation or individual outside the Greater Bay Area, which the Digital Policy Office says includes a parent or subsidiary outside Hong Kong.
The CAC's policy questions and answers of 30 January 2026 confirm that a processor that has filed a GBA Standard Contract still has to complete a security assessment, a national standard contract or certification before it sends the data beyond the GBA.
Filing in Guangdong
Under Article 8 of the guidelines, the Mainland party files the contract with the Guangdong provincial cyberspace administration (广东省互联网信息办公室) within 10 working days of the contract taking effect.
The documents are a copy of the legal representative's identity document, the undertaking on the published template, and the contract itself. The impact assessment report is not filed, although the assessment must have been done. The ITIB describes the assessment as simplified compared with the national standard contract.
The Guangdong administration's announcement of 4 January 2024 sets out the procedure. The party submits electronic copies to the cyberspace office of its city for a completeness check and pre-review, then sends the bound paper documents to the provincial office.
The provincial office completes its check within 10 working days of receiving the paper documents and notifies the result. A processor whose filing passes receives a filing number; a recipient receives a notification.
A filing number for a processor takes the form 粤港澳合同备 followed by digits and 号. Ours is 粤港澳合同备 202500031 号, shown on this site as Filing No. 202500031.
Filing in Hong Kong
On the Hong Kong side, the filing authority is the Digital Policy Office (DPO), formerly the Office of the Government Chief Information Officer, not the PCPD.
According to the DPO's filing guidelines (31 March 2026 version), the Hong Kong party, whether processor or recipient, files within 10 working days of the contract's effective date, which is the date of signing. The documents are:
- The filing form: completed in its current version, signed and stamped with the company chop.
- Identity proof of the legal representative: for an organisation, a copy of the business registration certificate or certificate of incorporation stamped with the company chop, and a certified copy of the proof that the authorised representative may act for the company.
- The contract: the signed original, in Chinese (Traditional or Simplified) or in a bilingual Chinese and English version. A Hong Kong recipient submits the Simplified Chinese version.
- The undertaking: the signed and chopped original.
Filing is by e-Form with the signed hard copies mailed afterwards, or by hand or post. Both parties are responsible for the authenticity of what they file.
The DPO checks the documents for completeness within 10 working days of receipt. If it asks for more, the party has 10 working days to supply them or the filing is terminated.
Where the filing meets the requirements, the DPO issues a filing reference number to a processor or an acknowledgement to a recipient. The impact assessment report is not part of the Hong Kong filing.
The PCPD's role
The PCPD inspected our transfer platform through document examination, enquiries and an on-site inspection. The news post describes what was reviewed and the practices the Commissioner recognised.
What to ask a vendor
If a vendor says it brings Mainland data to Hong Kong under the GBA Standard Contract, ask for:
- The filing: the filing number and the name of the Mainland entity that filed it. Check that the entity is registered in one of the nine cities.
- The scope: the categories of personal information and purposes listed in the contract annex, so that your use case is inside them.
- Consent: how separate consent is captured from each individual, and where that record is kept.
- Onward transfer: identify every intended recipient and location, including overseas head offices. A summary can still contain personal information; onward sharing needs an applicable lawful route or effective anonymisation.
- The Hong Kong side: the DPO's filing reference number or acknowledgement for the Hong Kong party, and confirmation that the impact assessment was completed within three months before filing.
- Security: evidence for the receiving system: access controls, encryption, audits, any PCPD inspection and an ISO 27001 certificate.
A vendor that cannot answer these questions is asking you to carry the compliance risk of its transfer.
How Fill Easy fits in
Our China Cross-Border Data service uses our filed GBA Standard Contract (Filing No. 202500031) for transfers within its documented scope. We confirm the data categories, parties, purposes and consent process for each use case. Your firm must assess its own recipient obligations and any further filing requirements.
The trust page sets out the receiving platform’s security controls, ISO 27001 certification and PCPD inspection. Summarising a record does not anonymise it: identifiable information sent beyond the permitted area needs an applicable lawful route.
The PIPL and GBA Standard Contract page summarises the rule, and the Mainland company verification guide shows what the data looks like when it arrives.
Under which filing number does Mainland personal information reach your firm today?