Skip to main content
project@netbasejsc.com
Mon–Sat: 9:00–18:15, Sun: closed
91 Nguyen Chi Thanh, Hanoi
Facebook X (Twitter) LinkedIn YouTube

What are you looking for?

Explore our services and discover how we can help you achieve your goals

Hong Kong software delivery: the PDPO, cross-boundary data, FPS and iAM Smart

A Hong Kong-facing software project turns on five decisions before a proposal is comparable: how the Personal Data (Privacy) Ordinance governs a product's data handling, whether any data crosses into the mainland part of the Greater Bay Area, whether FPS belongs at checkout, whether iAM Smart log-in is in scope, and when Traditional Chinese interfaces are required.

Submit a project Explore custom engineering

Reviewed by Huy Nguyen (David), CEO · Updated 24 Oct 2026 · 12 min read

star

OutsourcingVN is operated by Netbase JSC, and this guide is written by a supplier that would welcome your project. It separates what Hong Kong's own regulators and infrastructure operators publish from what Netbase can evidence about its own practice, with government sources named throughout for your own legal and tax advisers to verify. The guides index covers other markets, and the market index shows which question each one answers first.

Contents

Who enforces data protection for a Hong Kong-facing product?

The Personal Data (Privacy) Ordinance, Cap. 486, is Hong Kong's data protection law, administered by the Privacy Commissioner for Personal Data. Its six Data Protection Principles, in Schedule 1, cover the purpose and manner of collection, accuracy and duration of retention, use, security, openness and transparency, and access and correction, and the Ordinance applies to both the private and the public sectors. Data processors are not directly regulated: the data user must use contractual or other means to make its processors meet the retention and security requirements, which is where an offshore supplier's obligations sit.

A buyer should decide early who inside the organisation owns compliance with these principles, and whether any part of the product moves personal data out of Hong Kong before discovery starts, not after a defect surfaces.

What does the cross-boundary data flow arrangement cover?

Hong Kong's Innovation, Technology and Industry Bureau and the Cyberspace Administration of China signed a memorandum of understanding on cross-boundary data flow within the Guangdong-Hong Kong-Macao Greater Bay Area on 29 June 2023, and under it announced a Standard Contract for the Cross-boundary Flow of Personal Information on 13 December 2023, which the Digital Policy Office administers in Hong Kong. Adoption of the standard contract is voluntary, and it applies only to transfers between Hong Kong and nine named mainland cities: Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing. The party providing the data completes a personal information protection impact assessment within three months before filing, and the Hong Kong party files the signed contract with the Digital Policy Office within 10 working days of signing.

The Digital Policy Office notes that personal data processed and exported from Hong Kong stays regulated by the PDPO, and a Hong Kong-facing product that keeps its data inside Hong Kong does not need the standard contract at all. Decide first whether your product's data model actually reaches the mainland side of the Greater Bay Area before scoping this chapter.

What can Netbase evidence for a Hong Kong brief?

Procurement, security and data protection reviewers tend to ask for the same statements. These are the ones Netbase can give.

  • Security practices. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. A data processing agreement written for the Hong Kong-facing system sits on top of this baseline.
  • Markets and hours. Netbase clients are in the United States, Europe and Asia-Pacific, and most projects come from clients outside Vietnam. Netbase has worked with clients in 80 countries. The Hanoi office works Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7), and support coverage follows those days. Hong Kong is one hour ahead of Hanoi all year, with no seasonal clock change on either side, so that working day runs 10:00-19:15 Hong Kong time.

Which requirement sits with which decision owner?

A Hong Kong brief spans several owners inside the buying organisation, and a proposal that conflates them is the fastest way to miss one once the contract is signed.

Decision area What Hong Kong rules and infrastructure expect What a supplier can evidence Who decides
Data protection Compliance with the Data Protection Principles under the PDPO A data processing agreement, an access matrix, a tested breach-response plan Data protection officer
Cross-boundary flow A signed standard contract and a filed impact assessment, only where data moves to the nine mainland GBA cities A documented data map showing whether the flow applies at all Data protection officer
Payments FPS for real-time transfers by phone number, email or QR code, alongside card payments Payment flows tested against the agreed rails, with a fallback for a failed transfer Product owner with payments provider
Identity iAM Smart log-in for government, public and private-sector services, where a product chooses to accept it A tested integration where the product reaches the iAM Smart flow Product owner
Accessibility The Disability Discrimination Ordinance's duty on services, and the government's WCAG-based web accessibility guidelines Per-journey test results with assistive technology, a defect log Product or service owner
Language A Traditional Chinese and English boundary the buyer's legal adviser confirms A named Traditional Chinese copy owner and a tested translation workflow Localisation owner

Ask for this table filled in, not just a general compliance statement, before shortlisting a supplier.

Which steps come before a Hong Kong-facing launch?

  1. Map data against the PDPO principles

    Write down what personal data the product collects, keeps and discloses, and who owns compliance with each Data Protection Principle.

  2. Check whether any data reaches the mainland GBA cities

    If it does, scope the standard contract, the impact assessment and the Digital Policy Office filing; if it does not, record that decision and move on.

  3. Add FPS alongside cards

    Offer FPS at checkout using a phone number, email address or QR code as a second payment rail.

  4. Scope iAM Smart log-in

    Decide whether any journey should accept iAM Smart, and test the integration against a real account.

  5. Decide go-live readiness

    Check the data map, the cross-boundary decision and the payment and language scope against the plan, and record the decision with its owner.

  6. Launch and keep the record current

    Publish or update the accessibility statement, keep the FPS integration tested, and review all items again at the next major release.

Diagram of a Hong Kong-facing launch pipeline: map PDPO principles, check the cross-boundary flow, add FPS alongside cards and scope iAM Smart log-in, then decide readiness before launch and keep the record current
Diagram of a Hong Kong-facing launch pipeline

Worked scenario: a Hong Kong shopper pays with FPS

A subscription retailer launches a Hong Kong storefront where shoppers pay with FPS alongside cards.

  1. FPS selected

    The shopper picks FPS at checkout instead of entering card details

    Owner
    Engineering

  2. Proxy identifier used

    The shopper's bank or e-wallet app sends the payment using the merchant's registered phone number, email address or FPS QR code

    Owner
    Shopper's bank or e-wallet

  3. Settlement confirmed

    The payment settles almost in real time between the banks and e-wallets connected to FPS

    Owner
    Payment infrastructure

  4. Timeout handled

    If the payment is not confirmed in time, the checkout falls back to a card retry rather than leaving the order stuck

    Owner
    Product owner

  5. Receipt issued

    The confirmation and receipt are sent in the shopper's chosen language, with the amount, order number and support contact

    Owner
    Localisation owner

  6. Support view

    An agent can see the payment status for a ticket, not the underlying banking details

    Owner
    Support lead

A proposal that cannot describe step 4, specifically what the checkout does when an FPS payment does not confirm in time, has not yet scoped Hong Kong payments for this product.

What has Netbase built that is relevant to a Hong Kong brief?

Netbase has delivered product personalisation on client print stores, including online designers and configurators for business cards, stickers, banners, photo books and mugs, for print-commerce clients in Singapore, Switzerland, Hong Kong, Germany, China, the United Kingdom, the Netherlands, the United States, Poland, France and Portugal. The online designer feature builds record describes related engineering work on custom online-designer and order-flow features for print businesses, and the product personalisation and online design solution scopes configurator work of this kind.

Which questions should you ask a supplier?

  • Who owns compliance with the Data Protection Principles, and who signs the data processing agreement? Expect a clear answer before contract, not during a breach.
  • Does our product's data ever reach the mainland part of the Greater Bay Area? A supplier should help you answer this from your own data map, not assume either way.
  • How does checkout handle FPS alongside cards, and what happens when a payment does not confirm in time? A vague answer usually means the path has not been tested.
  • Does our product need iAM Smart log-in, and who holds that integration? This usually stays with the buyer, with the supplier building inside the access granted.
  • Who owns the Traditional Chinese copy, and how does a change reach production? Translation drift is easiest to catch before launch, not after.
  • How do you test against Hong Kong's web accessibility guidelines? Ask for real assistive-technology testing, not a tool report alone.

What usually goes wrong?

  • A PDPO statement is lifted from a company page and dropped into a proposal unchanged. Signal: nobody on the project has run this specific product's data flows, access rules or breach-response plan through a real test. Owner: the data protection officer, confirmed before any flow is built.
  • The cross-boundary question is never asked. Signal: nobody can say whether the product's data reaches the mainland GBA cities at all. Owner: the data protection officer, scoping this at discovery.
  • FPS is treated as a nice-to-have bolted onto a cards-only checkout. Signal: adding it later forces a rework of the payment flow instead of a clean addition. Owner: the product owner, who should size both rails into the same estimate.
  • Traditional Chinese copy translated once and never re-tested. Signal: error messages and generated documents drift out of Traditional Chinese after the first release. Owner: the localisation owner.

How this guide is sourced and where it stops

This guide draws on the Privacy Commissioner for Personal Data's own summary of the PDPO, the Hong Kong Monetary Authority's own description of the Faster Payment System, the Digital Policy Office's own pages on iAM Smart, the Greater Bay Area cross-boundary data flow facilitation measure and web accessibility guidelines, all checked on 2026-10-24, together with company statements and delivery evidence approved in the OutsourcingVN claim register. It is written for product, procurement and operations leads scoping a Hong Kong-facing brief; it does not decide which cross-boundary route or language scope fits your organisation.

Plan the next step for your project

Submit a project Explore custom engineering

Common questions

No. The Personal Data (Privacy) Ordinance is its own Hong Kong statute, built around its own Data Protection Principles and administered by the Privacy Commissioner for Personal Data; check the current guidance rather than assuming it mirrors another jurisdiction's rules.

No. The standard contract only matters where personal data actually moves between Hong Kong and the nine named mainland Greater Bay Area cities; a product that keeps its data inside Hong Kong does not need it.

No. FPS is a real-time transfer method that sits alongside cards rather than replacing them, so scope both rails from where your customers actually pay.

Only if a journey in the first release needs it. iAM Smart supports log-in to government, public and private-sector services where a business chooses to accept it, and many products add it once the integration and the access it needs are ready.

Not always. Many buyers ship the journeys Hong Kong customers use most in Traditional Chinese and keep less-used screens in English, provided the boundary is written down, your legal adviser confirms which consumer-facing texts must be in Traditional Chinese, and a named owner reviews copy before each release.

Yes, when the payment flow, the identity flow and the fallback behaviour are scoped with the same care as any other method, and tested against real accounts before launch.

Plan the first release

Bring your PDPO compliance owner, your cross-boundary data decision, your FPS and iAM Smart scope, and your Traditional Chinese language boundary. The data security and compliance guide lists the contract questions behind the data protection row, and the time zone and collaboration guide covers how overlap and handoff are agreed for a market with near-full overlap with Hanoi. For other Asia-Pacific markets, the Singapore guide covers phased redevelopment and identity data, and the South Korea guide covers PIPA and Korean-language interfaces; for a European market, the Switzerland guide covers the revised FADP and the federal e-ID.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your Hong Kong-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Custom product engineering for a bounded release outcome Custom product engineering for a bounded release outcome

One defined release of your product, built to named outcomes and handed over with acceptance evidence.

Learn More
line

Sources

91 Nguyen Chi Thanh, Hanoi

+84 937 869 689

Tell us what you want to build or automate.

Submit a project