Where a cross-border SaaS or data agreement touching the United Kingdom stands now

A SaaS contract between a Hong Kong-based provider and a United Kingdom counterparty looks, on its face, like a bilateral commercial arrangement. It is not. The moment personal data crosses the boundary – or the moment a regulated activity is delivered as a hosted service – at least two comprehensive regulatory regimes engage simultaneously, and the question of which one governs which layer of the relationship is rarely answered by the contract itself.

A cross-border SaaS or data agreement touching the United Kingdom sits at the intersection of the United Kingdom's post-Brexit data protection statute, the UK's digital markets and AI regulation agenda, and Hong Kong's own data privacy and technology licensing rules – three distinct bodies of law that must be reconciled before the commercial terms are settled. The governing instruments are the UK UK GDPR (the retained and amended version of the EU General Data Protection Regulation applied in UK domestic law), the UK Data Protection Act 2018, and, on the Hong Kong side, the Personal Data (Privacy) Ordinance (Cap. 486). The interface bites at contract execution, at data-transfer mechanism selection, and at every significant modification to the service scope thereafter.

This analysis maps the commercial stakes, the governing instruments, the comparative read across Hong Kong and the United Kingdom, and the risk points that most cross-border technology teams overlook. It is written for general counsel and technology principals who are already inside the relationship – not deciding whether to enter it.

What is actually at stake commercially – and why the regulatory dimension is inseparable from it

The commercial value of a cross-border SaaS or data agreement is almost always contingent on data. Whether the product is a business-intelligence platform, a payroll engine, a CRM system or a cloud-hosted compliance tool, the service delivers value precisely because it processes information about people, organisations or transactions. That processing is the regulated act.

For a Hong Kong provider serving UK customers, the exposure is direct. UK users whose data is processed, UK businesses whose employee or customer data is handled, UK regulators who have extraterritorial reach – all sit on the opposite side of the contractual boundary. The UK Information Commissioner's Office, the regulator responsible for enforcing the UK GDPR and the Data Protection Act 2018, has published enforcement positions asserting jurisdiction over overseas controllers and processors where they offer goods or services to individuals in the United Kingdom, or where they monitor the behaviour of individuals located there.

The commercial stakes are therefore not theoretical. A SaaS provider that misprices the regulatory cost – by omitting a data processing agreement, by selecting an inadequate international-transfer mechanism, or by failing to appoint a UK representative where one is required – faces the prospect of enforcement, service suspension and contract termination claims from the counterparty. In our cross-border practice, we see technology groups lose revenue not because their product failed but because their contract structure created a liability that the customer's legal team identified in a due-diligence audit.

Conversely, a UK provider deploying a SaaS solution into a Hong Kong operating entity faces its own exposure. The Personal Data (Privacy) Ordinance applies to any data user who controls the collection, holding, processing or use of personal data in Hong Kong, regardless of where the data user is incorporated. The extraterritorial reach runs in both directions.

The governing instruments: what the United Kingdom regime actually requires of a cross-border arrangement

The UK GDPR and the Data Protection Act 2018 together form the primary legal instrument governing personal data processing for any controller or processor that offers services to UK data subjects or monitors their behaviour. Brexit created a divergent path from the EU GDPR: the United Kingdom now maintains its own adequacy decisions and its own international-data-transfer regime, operating independently of the European Data Protection Board.

The practical consequences for a cross-border SaaS arrangement are significant. First, a Hong Kong provider is not automatically covered by an EU adequacy decision; it requires a separate UK adequacy assessment. The United Kingdom has not issued a formal adequacy decision in respect of Hong Kong as at the date of this analysis – parties should verify the current position before relying on it. In the absence of adequacy, the primary transfer mechanism available to a Hong Kong processor receiving UK personal data is the International Data Transfer Agreement (the IDTA), the UK-specific contractual instrument that replaced the old EU standard contractual clauses for UK-origin transfers.

Second, the UK GDPR requires that where a controller or processor is not established in the United Kingdom but falls within the regime's scope, it must designate a UK representative in writing. This is a hard requirement, not a soft recommendation, and it is one of the most frequently overlooked compliance obligations in Hong Kong-based SaaS structures. The representative must be named in the privacy notice and must be accessible to UK data subjects and the Information Commissioner.

Third, the contract itself must contain a compliant data processing agreement if the Hong Kong entity processes data on behalf of a UK controller. The agreement must specify the subject matter, duration, nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. A commercial SaaS subscription agreement without these terms embedded – or without a separate data processing addendum that is properly incorporated by reference – is non-compliant from day one.

Hong Kong's data privacy regime: the parallel obligation that the United Kingdom side rarely reads

The Personal Data (Privacy) Ordinance is older than the EU GDPR and structurally different from it. It operates on a set of six data protection principles rather than a rights-and-lawful-basis architecture. The principles govern collection, accuracy, use, security, openness and access – and they bind any data user processing personal data in Hong Kong, or processing personal data originating in Hong Kong regardless of where the processing occurs.

For a cross-border SaaS arrangement, the Ordinance engages in at least three ways. Where the UK counterparty transfers personal data of Hong Kong data subjects to the Hong Kong provider for processing, the Ordinance applies to the provider's handling of that data. Where a Hong Kong provider transfers data to a UK subprocessor or cloud infrastructure provider, the transfer-restriction provisions of the Ordinance apply. And where the service involves any collection of personal data from Hong Kong data subjects – even incidentally, through system logs or behavioural analytics – the collection and use principles apply regardless of what the contract says.

Critically, the Ordinance's transfer-restriction provisions require that a data user may only transfer personal data to a place outside Hong Kong if the transfer meets one of the permitted conditions. These conditions include consent, necessity for a contract to which the data subject is party, and – importantly – the receiving jurisdiction offering a level of protection that is not materially less than that provided under the Ordinance. What this means in practice is that a Hong Kong data user exporting UK personal data must conduct its own adequacy-style assessment of the UK regime. In our experience, this second-level analysis is almost never documented in the contracts our desk reviews.

How does the cross-border element affect a cross-border SaaS or data agreement touching the United Kingdom?

The cross-border element does not simply add a compliance checklist. It creates a layered structure of obligations that can conflict with each other in ways that neither party's domestic counsel is trained to anticipate.

Consider a scenario drawn from the type of matter our desk sees in practice. A Hong Kong-based analytics platform contracts with a UK financial services firm to provide a hosted customer-intelligence service. The UK firm is the controller; the Hong Kong platform is the processor. The contract is governed by English law. The data flows: UK customer data goes to Hong Kong for processing; the processed outputs return to the UK. On one reading, this is a simple processor engagement governed by the UK GDPR. On a second reading, the Hong Kong platform is also a data user under the Ordinance, holding and processing UK-origin data in Hong Kong. On a third reading – relevant if the platform uses any Hong Kong-based subprocessors – the UK firm may be an overseas data user under the Ordinance in relation to any Hong Kong data subjects whose information appears in the dataset.

The conflict potential is real. The UK GDPR requires the processor to act only on documented instructions from the controller. The Ordinance requires the data user to comply with the data protection principles regardless of instructions. Where the controller's instructions conflict with the Ordinance's requirements – for example, on retention periods or on the scope of permitted use – the Hong Kong platform faces a genuine legal tension that the contract does not resolve.

Dispute resolution is a related pressure point. English law is the instinctive choice for a UK-counterparty agreement. But a dispute about data processing obligations arising from the Ordinance is a Hong Kong statutory matter; it cannot be resolved simply by applying English law, and the Information Commissioner's enforcement powers extend to the UK GDPR layer regardless of contractual choice-of-law. A well-drafted agreement needs to address this jurisdictional asymmetry explicitly – not leave it to the governing-law clause to absorb.

Licensing posture, AML obligations and the regulator that actually applies

A SaaS or data agreement that touches regulated activities adds a further dimension. In Hong Kong, the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) applies to financial institutions and designated non-financial businesses and professions (DNFBPs) – a category that includes certain technology service providers where their services constitute a regulated financial activity. The question of whether a SaaS product constitutes a regulated activity in Hong Kong depends on the function the software performs, not on how the commercial relationship is labelled.

Where the SaaS product facilitates virtual-asset trading, handles payment instructions, or provides credit-related analytics used in lending decisions, the licensing question arises immediately. The Securities and Futures Commission (SFC) is the relevant licensing authority for activities involving securities and futures, including virtual assets that qualify as securities. The Hong Kong Monetary Authority regulates deposit-taking and certain payment-system participants. A SaaS provider that delivers a hosted product performing a licensable function to a UK customer is not exempt from licensing merely because its primary commercial relationship is offshore.

On the UK side, the Financial Conduct Authority (FCA) has published its own positions on the territorial scope of the financial promotions and regulated-activity regimes. A Hong Kong SaaS provider that communicates a financial promotion to a person in the United Kingdom, or that carries on a regulated activity in the UK by way of business, may require FCA authorisation or an applicable exemption. Cloud-hosted delivery does not resolve the territorial question; it is the location of the recipient and the nature of the activity that matters to the FCA.

The interaction between the two licensing regimes is where foreign technology groups most frequently miscalculate. In our cross-border practice, we see product teams assume that because their server infrastructure is located outside the United Kingdom, or because the contract is governed by Hong Kong law, they are operating outside UK regulatory reach. Neither assumption is correct. The FCA and the Information Commissioner both assert jurisdiction on the basis of the location and activities of the data subject or regulated-activity recipient, not the location of the provider's infrastructure.

For a more detailed read on the licensing and AML position as it applies to technology and Web3 products from a Hong Kong base, see our Tech & Web3 practice overview.

The comparative read: where Hong Kong and United Kingdom obligations diverge most sharply

Three divergence points stand out in practice.

The first is the lawful-basis architecture. The UK GDPR requires a controller to identify a lawful basis for every processing activity before processing begins. The Personal Data (Privacy) Ordinance does not operate on the same lawful-basis structure; it requires that data be collected for a lawful purpose and not collected by unlawful means, but it does not prescribe a menu of lawful bases in the same way. A Hong Kong provider drafting its privacy documentation to satisfy UK GDPR requirements may therefore satisfy one regime without satisfying the other if the underlying Ordinance obligations on collection purpose and notification are not separately addressed.

The second divergence is on data subject rights. The UK GDPR provides a comprehensive suite of individual rights: access, rectification, erasure, restriction, portability, objection and rights in relation to automated decision-making. The Ordinance provides access and correction rights, but does not provide a right to erasure, a right to portability or the full suite of rights against automated decision-making. A SaaS product built to satisfy UK-GDPR individual-rights requests may not have the same functionality for Ordinance-compliant requests, and vice versa. A cross-border deployment requires both sets to be operationally supported.

The third divergence is on breach notification. The UK GDPR requires notification to the Information Commissioner within 72 hours of becoming aware of a personal data breach that meets the notification threshold, and notification to data subjects where the breach is likely to result in a high risk to their rights and freedoms. The Ordinance's mandatory data breach notification provisions impose different thresholds and timelines – parties should verify the current requirements before building their incident-response procedure, as this area has seen legislative development. A single incident affecting both UK and Hong Kong data subjects triggers two parallel notification obligations running to different regulators on different timelines.

This comparative divergence is also analysed in our related piece on cross-border SaaS and data agreements touching the Mainland, where the divergence from Hong Kong's own Ordinance takes a different form.

Where the risk sits now: our view on the current exposure map

Regulatory enforcement in the data-privacy space has moved from theoretical to operational. The Information Commissioner has issued substantial fines and enforcement notices against organisations in a range of sectors, including technology and financial services. The trend line in UK enforcement is upward, and the extraterritorial reach of the UK GDPR means that Hong Kong-headquartered organisations are not insulated simply by their location.

In Hong Kong, the Office of the Privacy Commissioner for Personal Data has also signalled a more assertive enforcement posture. The statutory power to conduct compliance investigations, issue enforcement notices, and – following the 2021 amendments to the Personal Data (Privacy) Ordinance that introduced the doxxing provisions – refer matters for criminal prosecution, represents a materially stronger toolkit than existed a decade ago. For a cross-border SaaS provider, both regulators are live enforcement risks.

Our read of the current position is this: the risk is concentrated in three places. First, the documentation gap – contracts that do not contain a compliant data processing agreement or an IDTA where one is required. Second, the representative gap – controllers and processors not established in the United Kingdom who are within scope of the UK GDPR but have not appointed a UK representative. Third, the subprocessor gap – SaaS providers who have agreed to restrictions on subprocessing in their customer contracts but whose actual cloud-infrastructure arrangements involve subprocessors in jurisdictions that have not been assessed or disclosed.

A secondary but increasingly significant risk sits in the AI Act dimension. The United Kingdom has signalled its intent to regulate high-risk AI systems, and where a SaaS product incorporates AI decision-making affecting UK individuals – in hiring, credit, or access to services – the regulatory trajectory points toward mandatory transparency, audit and impact-assessment requirements. Groups deploying AI-enabled SaaS into the United Kingdom from a Hong Kong base should be mapping this exposure now, not after a product launch.

What foreign counsel frequently get wrong in this space is the treatment of the governing-law clause as a complete answer to the regulatory question. A contract governed by English law and subject to English-court jurisdiction does not resolve the Ordinance exposure on the Hong Kong side, and does not relieve the provider of its obligations under the UK GDPR where those obligations arise from the nature of the activity rather than the contractual relationship. The regulatory regime applies to the controller or processor; the contract applies between the parties. These are not the same thing.

For a broader read on IP and technology structuring for groups expanding into the Asia-Pacific region, see our analysis on IP licensing for technology groups expanding into Asia.

The structuring question: which approach reduces aggregate exposure

No single structure eliminates the dual-regime exposure. The objective is to reduce the gap between contractual documentation and actual compliance, and to create a defensible position for both regulators.

For a Hong Kong provider serving UK customers, the minimum defensible structure involves four components. A compliant data processing agreement – either embedded in the master SaaS agreement or in a standalone addendum properly incorporated by reference – that satisfies the UK GDPR's processor requirements. An IDTA covering the transfer of UK personal data to Hong Kong, executed as part of or alongside the data processing agreement. A written designation of a UK representative, reflected in the privacy notice and accessible to data subjects and the regulator. And a technical and organisational measures schedule that reflects the actual security controls the provider operates, not a generic boilerplate schedule.

On the Hong Kong side, the provider's own privacy policy and data processing records must reflect the Ordinance's requirements: a lawful collection purpose, a prescribed notification to data subjects at or before collection, and a transfer-restriction assessment covering any outbound transfer of personal data from Hong Kong.

Where the SaaS product involves a regulated activity – payments, securities analytics, virtual-asset services – the licensing question must be resolved before the contract is signed, not after the first regulatory inquiry arrives. A licensing assessment for both Hong Kong (SFC or HKMA, as applicable) and the United Kingdom (FCA) should be part of the pre-launch checklist for any fintech or data-analytics SaaS product with a cross-border footprint.

The sequence matters. A court or regulator reviewing a compliance failure will look at what the provider knew at the time the agreement was entered, and what steps it took. Documentation produced retrospectively, or a data processing agreement signed two months after the service went live, carries less weight than contemporaneous compliance steps built into the contracting process.

The contextual bridge for any group already inside a cross-border SaaS or data arrangement is this: the sequence above describes the standard position for a new engagement. If the agreement is already live and the documentation is incomplete, the remediation path is different from the initial-compliance path. Identifying the gap, assessing the current exposure, and implementing the missing elements in the right order is where the commercial risk is actually managed.

For a structured review of your cross-border SaaS or data agreement – covering the UK GDPR interface, the Ordinance obligations, the licensing position and the contract documentation – write to us at info@lockhartyip.com.

What the myth of contractual insulation misses

The most persistent misconception our desk encounters is the belief that a well-drafted choice-of-law clause provides effective insulation against the regulatory regimes of jurisdictions the parties have not chosen. It does not.

Regulatory obligations are statutory. They attach to the controller or processor because of what that entity does and where its activities touch, not because of what the contract says. The UK GDPR applies to a Hong Kong processor processing UK personal data because that processor falls within the statute's scope; the Personal Data (Privacy) Ordinance applies to a Hong Kong data user because that data user controls data in Hong Kong. Neither statute gives effect to a contractual choice to apply a different law in preference to the statute's own requirements.

The myth is reinforced by the reality that regulatory enforcement is not universal. Most cross-border SaaS arrangements that lack compliant documentation are never the subject of an enforcement action. But the population of arrangements that have been investigated and sanctioned has one common characteristic: they came to the regulator's attention through a complaint, a breach, an M&A due-diligence process, or a customer audit. For a technology group at the growth stage – one moving toward a fundraising round, a strategic partnership, or a UK market expansion – the data compliance position will be examined, and a gap found at that stage is a negotiating problem as much as a regulatory one.

If an earlier compliance review or contractual arrangement has produced an incomplete result, a second-look analysis can identify the gaps and the remediation steps that remain open. Write to us at info@lockhartyip.com to discuss the position.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Cross Border Saas Or Data Agreement Touching Mainland 3
• Ip Licensing Technology Group Expanding Into Asia Analysis

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.