PCPD: guidance on the GBA Standard Contract
The Hong Kong Privacy Commissioner's guidance on cross-boundary data transfer under the contract.
Mainland data in Hong Kong, lawfully.
Personal information can leave Mainland China only by a route the PIPL allows, such as the Greater Bay Area Standard Contract for Hong Kong.
Fill Easy transfers under its own filed contract (Filing No. 202500031), so you file nothing.
Three routes out, and one built for the Bay Area.
The Personal Information Protection Law requires a lawful route out of the Mainland (a security assessment, certification or a standard contract) plus the individual's separate consent.
The Standard Contract for Cross-boundary Flow of Personal Information within the Greater Bay Area, adopted by the Mainland and Hong Kong in December 2023, simplifies transfers between the Bay Area's Mainland cities and Hong Kong. Fill Easy transfers under its filed contract, inspected by the Privacy Commissioner for Personal Data.
At a glance
- Law
- Personal Information Protection Law of the PRC, in force 1 November 2021
- Route
- GBA Standard Contract (Mainland, Hong Kong), from December 2023; open to all sectors in Hong Kong since 1 November 2024
- Fill Easy filing
- Filing No. 202500031
- Inspection
- Completed by the Office of the Privacy Commissioner for Personal Data, 2026
Data and third-party risk
What a lawful transfer needs.
The conditions a transfer from the Mainland to Hong Kong must meet.
| Obligation | What it asks | What Fill Easy returns |
|---|---|---|
| A lawful route | A standard contract, certification or security assessment | Fill Easy's filed GBA Standard Contract (Filing No. 202500031) |
| Separate consent | The individual agrees to the transfer itself | Consent captured in the China eID flow before any data moves |
| Protection in Hong Kong | The recipient protects the data to the contract's standard | Zero human access, least privilege, end-to-end encryption, reviewed by the PCPD |
| Onward sharing | Limits on sharing beyond Hong Kong | Summaries and anonymised results only for overseas head offices |
A summary, not legal advice: the official text governs, and your compliance team decides what your policies require.
Read the source
The official text.
Digital Policy Office: cross-boundary data
The Hong Kong government's page on the GBA Standard Contract and its implementation guidelines.
Questions about PIPL and the GBA Standard Contract
Not covered here? Ask our team
Does Fill Easy make us compliant with PIPL and the GBA Standard Contract?
No. The due diligence duty sits with your firm under PIPL and the GBA Standard Contract, and your policies decide what is enough. Fill Easy supplies the evidence those policies rely on: records from the government or registry source, each showing where and when it was retrieved.
Do we need our own Standard Contract?
No. The transfer from the Mainland to Hong Kong runs under Fill Easy's filed contract. Your firm receives the result in Hong Kong.