The GBA Standard Contract is a contract form and a set of implementation guidelines issued jointly on 13 December 2023 by the Cyberspace Administration of China and Hong Kong's Innovation, Technology and Industry Bureau, under the memorandum of understanding on cross-boundary data flow signed in June 2023. It gives personal information handlers in the nine Mainland cities of the Greater Bay Area (Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing) and recipients in Hong Kong a lawful route under Article 38 of the PIPL, and the same form covers transfers from Hong Kong to those cities.
How it differs from the national contract
The national standard contract is only available below volume thresholds, above which a security assessment is required. The GBA contract has no volume threshold, so a bank or insurer with many Mainland customers can use it. It is not available for personal information that the authorities have notified or published as important data, and data received under it may not be passed to anyone outside the Greater Bay Area. The impact assessment is simplified compared with the national route. The signed contract is filed within ten working days of taking effect (the signing date), with the Guangdong provincial cyberspace administration on the Mainland side and with the Digital Policy Office in Hong Kong, not the Privacy Commissioner. The scheme opened to banking, credit referencing and healthcare first, from December 2023, and to all sectors from 1 November 2024.
Why it matters
For a Hong Kong firm, the contract is the practical way to receive Mainland identity, company and claims data about Mainland residents lawfully, without a Mainland entity or a security assessment.
How Fill Easy relates to it
Fill Easy (Nansha), in Guangzhou, is the Mainland handler and Fill Easy in Hong Kong the recipient under Filing No. 202500031. Clients receive Mainland data under that filing through China Cross-Border Data and China eID verification, and file nothing themselves. See PIPL and the GBA Standard Contract.