Cross-border Personal Data Transfers in the Greater Bay Area
Main Article Content
Abstract
This article investigates how regulatory fragmentation across Mainland China, Hong Kong, and Macao shapes cross-border transfers of personal data in the Guangdong–Hong Kong–Macao Greater Bay Area (GBA) and its impact on data-intensive sectors such as finance, digital services. As next-generation wireless communication networks and electromagnetic information transmission technologies increasingly support cross-border digital infrastructure, establishing secure and legally compliant data flows has become an essential prerequisite for regional digital integration. Adopting a doctrinal and comparative approach, this study analyses the Personal Information Protection Law (PIPL), Hong Kong’s Personal Data (Privacy) Ordinance (PDPO), Macao’s Personal Data Protection Act (PDPA), and the GBA Standard Contract. It identifies three major fault lines involving export pathways and procedures, definitions and lawful bases for processing, and enforcement architecture across the three jurisdictions. These divergences generate duplicative compliance obligations, increase operational costs, and impede data mobility for finance, research, services. The article further evaluates the GBA Standard Contract as a pragmatic sub-regional mechanism that simplifies compliance while preserving local autonomy and proposes a roadmap based on minimum-standard harmonisation, mutual recognition, coordinated complaint handling, third-party certification, technical safeguards including encryption and anonymisation, and sectoral pilot sandboxes. The proposed legal framework facilitates secure and efficient cross-border data flows while supporting interoperable digital infrastructures under the “one country, two systems” framework.
Downloads
Article Details
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).
References
J. Chaisse, “Special Economic Zones in the Greater Bay Area,” IEEM Policy Paper (June 2025), Institute of East Asian Economics and Management, 2025, [Online]. Available: https://ieem.org.mo/wp-content/uploads/2025/12/June-2025-Policy-paper-SEZs-in-GBA1.pdf (accessed 20 February 2026).
J. Chaisse, G. Dimitropoulos, and I. Mosquera, “Law and Digital Transformation in the Indo-Pacific: An International Economic Law Perspective,” The Journal of World Investment & Trade, vol. 26, no. 4, pp. 575-620, 2025, doi: 10.1163/22119000-12340376.
A. Adam and W. Normann, “Data Flows and Data Protection in the Greater Bay Area: The Need for a Coordinated Legal Framework,” The Chinese Journal of Comparative Law, vol. 12, cxae013, 2024, doi: 10.1093/cjcl/cxae013.
I. Calzada, “Citizens’ Data Privacy in China: The State of the Art of the Personal Information Protection Law (PIPL),” Smart Cities, vol. 5, pp. 1129-1150, 2022, doi: 10.3390/smartcities5030057.
Y. C. Chin and J. Zhao, “Governing Cross-Border Data Flows: International Trade Agreements and Their Limits,” Laws, vol. 11, p. 63, 2022, doi: 10.3390/laws11040063.
L. Hao, “Research on the Cross-boundary Data Transfer within the Greater Bay Area,” Science of Law, vol. 6, pp. 79-94, 2024.
J. Wu, “The Legal Framework for Cross-border Data Transfer Between Mainland China and the Hong Kong Special Administrative Region,” Journal of International Commercial Law, vol. 3, pp. 420-589, 2025.
Y. Zhang, “Personal Data Protection and Data Transfer Regulation in China,” Brussels Privacy Hub Working Paper, vol. 10, no. 3, pp. 1-36, 2024, [Online]. Available: https://brusselsprivacyhub.com/wp-content/uploads/2024/04/Personal-Data-Protection-in-China.pdf (accessed 20 February 2026).
M. Du, “From market access to regulatory cooperation in the Greater Bay Area (GBA): an international economic law perspective,” Asia Pacific Law Review, pp. 1-21, 2025, doi: 10.2139/ssrn.5412005.
S. Liao, “AI-Driven Media Compliance: Technical Innovations and Regulatory Challenges in Hong Kong-Mainland Data Flows,” Journal of Education, Humanities and Social Sciences, vol. 52, pp. 117-125, 2025, doi: 10.54097/3fz2aq70.
D. W. Arner, G. G. Castellano, and Selga Eriks, “The Transnational Data Governance Problem,” Berkeley Technology Law Journal, vol. 37, no. 2, pp. 623-699, 2021.
G. Greenleaf, “Personal Data Localization and Sovereignty along Asia’s New Silk Roads,” in Data Sovereignty: From the Digital Silk Road to the Return of the State, A. Chander and H. Sun, Eds. Oxford, UK: Oxford University Press, 2023, p. 301.
M. Taylor, “Transatlantic Jurisdictional Conflicts in Data Protection Law: Fundamental Rights, Privacy and Extraterritoriality,” Cambridge University Press, 2023, pp. 193-195, doi: 10.1017/9781108784818.
A. H. Zhang, “High Wire: How China Regulates Big Tech and Governs Its Economy,” Oxford, UK: Oxford University Press, 2024, p. 57, doi: 10.1093/oso/9780197682258.001.0001.
J. Gao, “Global Governance of Cross-border Data Flows and China’s Response,” Journal of Information Economics, vol. 3, no. 2, p. 47, 2025, doi: 10.58567/jie03020001.