¶¶Òõ¶ÌÊÓƵ

1. Cross-border Transfers: Provisions for transfers of personal data outside Hong Kong, required if either party may transfer data internationally

2. Sub-processing: Terms governing the appointment of sub-processors, needed if either controller may engage third parties

3. Data Protection Impact Assessments: Procedures for conducting DPIAs, relevant for high-risk processing activities

4. Audit Rights: Rights and procedures for conducting audits of data protection compliance, useful for higher-risk relationships

5. Insurance: Requirements for maintaining specific insurance coverage, relevant for high-value or high-risk data processing

6. Cost Allocation: Provisions for sharing costs related to compliance and data subject requests, relevant when significant costs anticipated

1. Schedule 1 - Categories of Personal Data: Detailed list of personal data categories to be shared between the controllers

2. Schedule 2 - Purposes of Processing: Comprehensive list of approved processing purposes and activities

3. Schedule 3 - Technical and Organizational Measures: Detailed security measures and controls implemented by both parties

4. Schedule 4 - Data Subject Rights Procedures: Detailed procedures for handling data subject requests

5. Schedule 5 - Breach Response Plan: Detailed protocol for responding to and managing data breaches

6. Appendix A - Contact Details: Key contacts for operational, legal, and breach notification purposes

7. Appendix B - Standard Forms: Templates for regular communications, including breach notifications and data subject request handling