Hong Kong IP, contracts and data compliance for companies

Hong Kong IP, Contracts and Data Compliance for Companies

A Hong Kong company operates within three legal frameworks: intellectual property, contracts, and data privacy. These are not separate streams. They are the rules that determine whether the company owns what it creates, can enforce its agreements, and handles personal data lawfully. Get one wrong and the other two unravel.

Practitioners call this intersection Hong Kong IP contracts data compliance. Trade marks, patents, designs and copyright are territorial, each requiring active registration or deliberate awareness. Contracts must allocate IP ownership, confidentiality and liability with precision. The Personal Data (Privacy) Ordinance (Cap. 486) imposes obligations on every data user, no exceptions. Treat these as silos and the consequences are concrete: lost trade mark rights, a PDPO breach, or a contract that signs away the company’s own inventions.

Hong Kong Intellectual Property Protection

IP protection in Hong Kong is territorial. A trade mark registered here confers rights only within the Hong Kong Special Administrative Region. It offers no protection in mainland China, Macau, or anywhere else. The Intellectual Property Department administers the trade mark, patent and registered design systems.

Trade marks are registered by class under the Nice Classification. File an application covering the classes your goods or services occupy. The registry examines the application, publishes it for opposition, and registers it if unopposed or if opposition fails. Registration gives the owner the exclusive right to use the mark for the goods or services in the specification. A mark that is not inherently distinctive can still be registered if the applicant proves it has acquired distinctiveness through use in Hong Kong before the application date. The registry will refuse a mark that is identical or confusingly similar to an earlier registered mark for the same or similar goods or services. If a third party uses an identical or confusingly similar mark without consent, the registered owner can bring an action for infringement. Without registration, the only recourse is the common law action of passing off, which requires proof of goodwill, misrepresentation and damage. That is a heavier burden.

Patents come in two forms. A standard patent requires a designated patent office application, the UK, European Patent Office or China, and is re-registered in Hong Kong. A short-term patent is an original grant. It does not need a prior filing abroad. It lasts eight years. File both with the Intellectual Property Department. A standard patent can last up to 20 years, subject to payment of renewal fees. The re-registration process has two stages: filing a request to record the designated patent application within six months of its publication, and filing a request for registration and grant within six months of the designated patent being granted. If either deadline is missed, the application is deemed withdrawn. A short-term patent is granted after a formality examination only. The registry does not examine its validity. If the owner wishes to enforce it, a court or the Registrar will require a substantive examination first. An unsuccessful enforcement action can result in the patent being revoked.

Registered designs protect appearance: shape, configuration, pattern or ornament. Registration is with the Intellectual Property Department. Protection lasts up to 25 years, renewed every five years. The design must be new at the filing date. A design is not new if it has been disclosed to the public anywhere in the world before the filing date, unless the disclosure was in confidence or at an official international exhibition and the application is filed within six months. The registry examines for formality, not novelty. A third party can apply to revoke the registration on the ground that the design was not new.

Copyright arises automatically on creation of an original work. There is no registration system. There is no register to search. Copyright protects literary, dramatic, musical and artistic works, plus films, sound recordings and broadcasts. The owner files nothing. Proving ownership in a dispute means producing evidence of creation and authorship. The first owner of copyright is generally the author. The critical exception is works made by an employee in the course of employment. In that case, the employer is the first owner, subject to any agreement to the contrary. For commissioned works, the commissioner does not own the copyright unless it is assigned in writing. A business that commissions a logo, website or software from a contractor without a written assignment owns nothing. The contractor retains copyright and can license the same work to a competitor.

For detailed steps on trade mark registration, patent types, registered designs and copyright, see the dedicated pages linked from this section.

Hong Kong Data Privacy Ordinance

The Personal Data (Privacy) Ordinance (Cap. 486), the PDPO, governs the collection, use and handling of personal data. It applies to any data user who collects, holds, processes or uses personal data in or from Hong Kong. A data user is any person or organisation that controls the collection and use of personal data.

The PDPO contains six data protection principles:

1. Collection - Collect personal data for a lawful purpose directly related to the data user's function. The means of collection must be fair and not excessive.
2. Accuracy and retention - Data must be accurate. Keep it no longer than necessary for the purpose.
3. Use - Use personal data only for the purpose for which it was collected or a directly related purpose, unless the data subject gives prescribed consent.
4. Security - Take practicable steps to safeguard personal data from unauthorised access, processing, erasure, loss or use.
5. Openness - Make personal data policies and practices known.
6. Access and correction - A data subject has the right to request access to their personal data and to correct it if inaccurate.

Give a Personal Information Collection Statement (PICS) at or before the time of collection. The PICS must state the purpose of collection, the classes of persons to whom the data may be transferred, and the data subject's right to request access and correction. Failure to provide a PICS that meets the statutory requirements is an offence. The Privacy Commissioner for Personal Data can serve an enforcement notice. Non-compliance with an enforcement notice is itself an offence carrying a fine and imprisonment.

Do not use personal data for direct marketing without informing the data subject and obtaining consent. The data subject may require the data user to cease using their data for direct marketing at any time. The data user must comply without charge. This opt-out right is absolute. The data user must inform the data subject of the right to opt out at the time of the first direct marketing communication. If the data user intends to transfer personal data to a third party for direct marketing, it must inform the data subject of that intention and the identity of the proposed transferee, and obtain separate written consent. Using personal data for direct marketing in breach of these rules is an offence.

A data subject may also make a data access request to obtain a copy of their personal data held by a data user. Comply within the statutory timeframe. You may charge a reasonable fee. The statutory timeframe is 40 calendar days from receipt of the request. If the data user refuses the request, it must give written reasons. The data subject can complain to the Privacy Commissioner, who can investigate and issue an enforcement notice.

For the full application of the six data protection principles, direct marketing rules, cross-border data transfer restrictions and the data access process, see the PDPO compliance page.

Hong Kong Business Contracts Checklist

A Hong Kong company enters into contracts with customers, suppliers, employees, contractors and joint venture partners. Every contract should address the following minimum items:

• Parties - Full legal names and company registration numbers.
• Scope of work or supply - Clear description of goods, services or deliverables.
• Payment terms - Amount, currency, payment schedule and late payment consequences.
• Intellectual property ownership - Who owns IP created before the contract, who owns IP created during the contract, and any licences granted.
• Confidentiality - Definition of confidential information, duration of obligation, and exclusions.
• Limitation of liability - Caps on liability, exclusions for consequential loss, and indemnities.
• Term and termination - Duration, notice periods, and grounds for early termination.
• Governing law and dispute resolution - Hong Kong law is standard; specify arbitration or court jurisdiction.
• Data protection - Clauses addressing PDPO compliance, data processing restrictions, and data subject rights.

For Hong Kong service agreements, address IP ownership and PDPO compliance in specific clauses. Employment contracts must satisfy the Employment Ordinance and MPF requirements. Non-disclosure agreements (NDAs) must define confidential information clearly and specify the duration of the obligation. A contract that omits an IP assignment clause leaves ownership with the creator, even if the company paid for the work. A contract that omits a data processing clause leaves the company exposed if the counterparty mishandles personal data the company supplied. A contract that omits a governing law clause leaves the parties arguing about which jurisdiction’s law applies before they can even argue about the breach.

See the service agreement, NDA and employment contract drafting pages for clause-by-clause guidance.

Hong Kong Company Compliance Requirements

Beyond IP, contracts and data, every Hong Kong company must meet ongoing compliance obligations under the Companies Ordinance (Cap. 622). These include:

• Annual return - File Form NAR1 with the Companies Registry within 42 days of the return date.
• Annual general meeting - Hold an AGM within the statutory period unless the company opts out by written resolution.
• Audited accounts - Prepare audited financial statements and file them with the Inland Revenue Department as part of the tax return.
• Business registration - Renew the Business Registration Certificate annually or every three years.
• Significant controllers register - Maintain a register of persons with significant control over the company.
• Registered office and company secretary - Maintain a registered office address in Hong Kong and appoint a company secretary.

These requirements are separate from IP and data obligations. They intersect with them. A company's contracts must comply with the Companies Ordinance regarding director authority and execution. The PDPO applies to the personal data of directors, shareholders and employees held in company records.

For a full compliance calendar and filing instructions, see the company compliance page.