Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Macao)
To promote the safe and orderly cross-boundary flow of personal information within the Greater Bay Area (GBA), and to implement the cooperation measures of “jointly formulating the standard contract for the cross-boundary flow of personal data within the Guangdong-Hong Kong-Macao Greater Bay Area and organizing the implementation, and enhancing the filing management of standard contract for the cross-boundary flow of personal information” in the Memorandum of Understanding on Facilitating Cross-Boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area between the Cyberspace Administration of the People’s Republic of China and the Secretariat for Economy and Finance of the Government of the Macao Special Administrative Region, the Cyberspace Administration of China joined hands with Macao’s Economic and Technological Development Bureau (DSEDT) and Personal Data Protection Bureau (DSPDP) to formulate and introduce the facilitation measure of the “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Macao)” (the “GBA Standard Contract”).
Starting from 10 September 2024, enterprises or organizations of the nine Mainland cities of the GBA (i.e. Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing) and of Macao may conduct cross-boundary flow of personal information between each other within the GBA by means of entering into a GBA Standard Contract and filing the contract with the Cyberspace Administration of Guangdong Province or the DSPDP.
Comparing to the Mainland’s prevailing framework for management of safety of cross-boundary data, the GBA Standard Contract lifts the restriction on the volume of cross-boundary flow of personal data that a Personal Information Processor can transfer and simplifies the assessment areas of Personal Information Protection Impact Assessment. The GBA Standard Contact regulates the obligations and responsibilities of the Personal Information Processor and recipient, the rights of the personal information subject, termination of contract, liability for breach of contract, and means of dispute settlement, among others, to provide a basis for the cross-boundary flow of personal data within the GBA.
The measure will be conducive to the safe and orderly flow of cross-boundary personal information data between the Mainland cities of the GBA and Macao, thereby supporting the innovation of data application and the development of Macao’s digital economy, as well as facilitating the work and lives of citizens in the GBA.
For the implementation guidelines on and details of the GBA Contract, please refer to the DSPDP’s website: www.dspdp.gov.mo.
