¶¶Òõ¶ÌÊÓƵ

1. Cross-border Data Transfers: Required when personal data will be transferred outside Hong Kong, including to Mainland China

2. Sub-processing: Include when the processor may engage sub-processors

3. Direct Marketing: Required when personal data will be used for direct marketing purposes

4. Special Categories of Data: Include when processing sensitive personal data

5. Data Protection Impact Assessment: Required for high-risk processing activities

6. Insurance Requirements: Include when specific insurance coverage is required for data protection

7. Service Levels: Include when specific performance metrics apply to data processing activities

1. Schedule 1: Categories of Personal Data: Detailed list of personal data types being processed

2. Schedule 2: Authorized Processing Activities: Specific processing operations and purposes

3. Schedule 3: Technical and Organizational Security Measures: Detailed security requirements and standards

4. Schedule 4: Approved Sub-processors: List of authorized sub-processors if applicable

5. Schedule 5: Data Transfer Mechanisms: Details of cross-border transfer arrangements if applicable

6. Schedule 6: Service Levels and Metrics: Performance standards and measurement criteria if applicable

7. Appendix A: Data Processing Impact Assessment: Documentation of risk assessment and mitigation measures

8. Appendix B: Security Breach Response Plan: Detailed procedures for handling data breaches