Drafting Service Agreements and Terms of Business for Hong Kong Companies

Hong Kong Service Agreements and Terms of Business

A well-drafted service agreement is the foundation of any commercial relationship involving a Hong Kong company. General contract law principles apply. Hong Kong service agreements must also address specific statutory requirements under the Personal Data (Privacy) Ordinance (Cap. 486) and the rules governing intellectual property ownership. The clauses that follow are not drafting suggestions. They are what the PDPO and common law demand: data handling, IP assignment, and the mandatory Personal Information Collection Statement.

Key Clauses in a Hong Kong Service Agreement

A service agreement between a Hong Kong company and its client should cover the scope of work, payment terms, liability limits, and termination rights. Two areas routinely receive insufficient attention: how personal data is handled and who owns the intellectual property created during the engagement. These are legal requirements under the PDPO and common law principles that the Intellectual Property Department oversees. They are not optional extras.

Hong Kong Terms of Business

The terms of business that a Hong Kong company presents to its clients should be set out in a clear, written document. These terms include the service description, fees, payment schedules, and dispute resolution mechanisms. For a service provider handling client data, the terms must also incorporate a Personal Information Collection Statement (PICS) as required by the PDPO. The PICS must inform the data subject, the client or their employees, of the purpose of data collection, the classes of persons to whom the data may be transferred, and the data subject’s right to access and correct their data. Without this statement at the point of collection, the data user (the service provider) may be in breach of data protection principle 1.

Service Agreement Hong Kong Requirements

The requirements for a service agreement in Hong Kong are shaped by both common law and statute. The Companies Ordinance (Cap. 622) does not prescribe a standard form for service contracts. The PDPO imposes specific obligations when personal data is involved. A service agreement that involves processing client data must include:

• A clause identifying the data user and the data subject.
• A statement of the purpose for which personal data is collected.
• A retention period or criteria for determining retention.
• A mechanism for the data subject to make a data access request.
• Provisions for data security, consistent with data protection principle 4.

Failure to include these elements can expose the company to enforcement action by the Privacy Commissioner for Personal Data.

Hong Kong Company Service Contract

When a Hong Kong company enters into a service contract with another business, the contract should address intellectual property ownership explicitly. Under Hong Kong law, copyright arises automatically on creation. There is no registration system. A service provider that creates original works, software, marketing materials, or designs, will own the copyright unless the contract assigns it to the client. The same applies to trade marks and registered designs: the party that files the application with the Intellectual Property Department owns the registration, unless the contract states otherwise.

A well-drafted service contract should include an IP assignment clause transferring all rights in works created during the engagement to the client, a warranty that the service provider has the right to assign the IP, and an indemnity for any third-party IP infringement claims.

Data Handling Clauses and the PDPO

The PDPO (Cap. 486) applies to any data user that collects, holds, processes, or uses personal data in Hong Kong. A service agreement must reflect the six data protection principles:

1. Collection - Personal data must be collected for a lawful purpose directly related to the function of the data user, and the means of collection must be fair.
2. Accuracy and retention - Data must be accurate and not kept longer than necessary.
3. Use - Data may only be used for the purpose for which it was collected or a directly related purpose.
4. Security - Data must be protected against unauthorised access or processing.
5. Openness - The data user must make its policies and practices known.
6. Access and correction - Data subjects have the right to access and correct their data.

A service agreement should specify which party is the data user and which is the data processor. If the service provider processes data on behalf of the client, the contract should include a data processing clause that limits the provider’s use of the data to the agreed purpose and requires compliance with the PDPO.

Personal Information Collection Statement

The Personal Information Collection Statement (PICS) is a mandatory document under the PDPO. It must be provided to the data subject at or before the time of collection. In a service agreement context, attach the PICS as a schedule or incorporate it by reference. It must state the name and contact details of the data user, the purpose of data collection, the classes of persons to whom the data may be transferred, the data subject’s right to request access to and correction of their data, and the person to whom access requests should be addressed.

A Hong Kong company providing IT support services would need to inform its client’s employees that their personal data, login credentials and usage logs, will be collected for system maintenance purposes and may be shared with subcontractors.

Consent and Direct Marketing

If the service agreement involves direct marketing, the PDPO imposes additional requirements. The data user must inform the data subject that their data will be used for direct marketing and obtain consent. The data subject has the right to opt out at any time. The data user must comply without charge. A service agreement that includes a direct marketing clause should set out the consent mechanism and the opt-out procedure.

Intellectual Property Ownership

The Intellectual Property Department registers trade marks, patents, and registered designs. A service agreement that involves creating new IP should specify whether the IP is assigned to the client or retained by the service provider, the class of goods or services under the Nice Classification if a trade mark is involved, and the specification of the IP, such as the technical features of a patent or the appearance of a registered design.

For copyright, which arises automatically, the contract should include an assignment clause. Without it, the creator retains ownership. That may not be what the client expects.

Retention and Data Access

The PDPO requires data users to retain personal data only for as long as necessary. A service agreement should state the retention period or the criteria for determining it. It should also provide a mechanism for the data subject to make a data access request. The data user must respond within 40 days. The data subject may request correction of inaccurate data.

Practical Considerations for Business Owners

When drafting a Hong Kong service agreement, business owners should identify all personal data that will be collected, used, or disclosed. Include a PICS as a schedule to the agreement. Specify IP ownership and assignment. Address direct marketing consent and opt-out rights. Set out data retention and access procedures.

These clauses are not merely good practice. They are legal requirements under the PDPO and common law. A service agreement that ignores them risks enforcement action and disputes over IP ownership.