How to approach data, confidentiality and IP clauses in cross-border contracts

A cross-border commercial contract can survive many imperfections. A badly drafted confidentiality or intellectual property clause is rarely one of them. For in-house counsel managing supply chains, joint ventures or technology arrangements across Greater China and the offshore holding centres, the drafting decision taken at inception is the one that determines what can be enforced – and where – years later.

Data, confidentiality and IP clauses in cross-border contracts require a structured approach that begins with the governing-law and forum choice and runs through to the day-two operating reality of the arrangement. The governing instrument in Hong Kong is the common-law contract, supported by the courts' strong tradition of upholding party autonomy on jurisdiction and choice of law; but for arrangements touching the Mainland, the BVI, or other offshore centres, each layer of the structure creates a separate set of enforcement considerations. Getting the sequence right at the drafting stage is materially easier than correcting it after a breach.

This guide sets out the steps in order, identifies the gate at each stage, and flags the most common structural mistake that in-house counsel make when contracting across the Mainland–Hong Kong interface.

Step 1: Frame the commercial question before touching the clause

The direct question at this stage is not "what should the NDA say?" but "what are we protecting, in which jurisdictions does that protection need to hold, and who will enforce it?"

These are distinct questions and they rarely have the same answer. A technology licensing arrangement between a Hong Kong entity and a Mainland operating company involves at least two legal systems with materially different approaches to trade-secret protection, data-localisation obligations and IP ownership on termination. A manufacturing arrangement through a BVI holding vehicle adds a third layer.

In our cross-border practice, the most productive first step is a jurisdiction map: identify every territory in which (a) protected information will be generated, (b) protected information will be received, (c) assets that embed the IP will be located, and (d) a breach could realistically occur. That map then drives every subsequent drafting decision. Without it, the clause is written blind.

Consider the commercial stakes early. A confidentiality breach in a consumer-technology arrangement can destroy a market position overnight. An IP-ownership dispute in a joint-development structure can immobilise a product line for the duration of litigation. Loss-aversion framing is appropriate here: the cost of a well-structured clause is trivial relative to the cost of litigating a poorly defined one across two or more systems.

Step 2: Settle the governing law and forum before drafting the substantive clauses

Governing law and forum selection must be resolved first – they are not boilerplate to be agreed at the end. The choice of governing law determines what the substantive clause can and cannot achieve; the forum choice determines where and how a breach can be remedied.

Hong Kong common law is a defensible governing-law choice for many Greater China cross-border arrangements. The courts are experienced in commercial contract disputes, English is an official working language of the proceedings, and judgments can be enforced in the Mainland under the registration mechanism introduced by the Mainland Judgments in Civil and Commercial Matters (Reciprocal Enforcement) Ordinance, which came into force on 29 January 2024. That ordinance removed the prior requirement for an exclusive jurisdiction clause and replaced it with a connection-based test – a significant practical development for in-house counsel structuring mixed Mainland–Hong Kong arrangements.

Hong Kong arbitration is a parallel option. An arbitration clause gives access to the HKIAC Administered Arbitration Rules and, for Mainland asset enforcement, to the interim-measures arrangement in effect since 1 October 2019, which allows a party to a Hong Kong-seated arbitration to seek Mainland court interim measures before or during the proceedings. For confidentiality disputes where speed matters – injunctive relief to prevent further disclosure – the combination of Hong Kong-seated arbitration and the interim-measures mechanism is materially more powerful than a dispute-resolution clause that routes everything to a single domestic jurisdiction.

The gate at this step: do not begin drafting the NDA body or the IP assignment clause until the governing-law and forum choices are finalised. Changing them after the substantive provisions are drafted creates inconsistencies that are expensive to unwind.

For a deeper treatment of the transactional infrastructure that sits around these clauses, see our Corporate Counsel practice overview.

The sequence above describes the standard position. Your matter turns on the documents, the jurisdictions actually engaged, and the order of steps – which is where the route is won or lost. To discuss the governing-law and forum question for your cross-border arrangement, write to us at info@lockhartyip.com.

Step 3: Define the protected information with precision

A confidentiality clause that defines protected information as "all information disclosed by either party" is, in practice, close to unenforceable in its current form – not because the courts will not honour it, but because the party seeking to enforce it cannot identify, in evidence, what is and what is not covered.

The standard approach in a cross-border arrangement is a two-layer definition. The first layer is a category list: technical data, commercial pricing, customer lists, product roadmaps, manufacturing processes, software source code, financial information not in the public domain. The second layer is a marking or designation mechanism, whether physical (a "Confidential" stamp) or procedural (a written confirmation within a defined period after oral disclosure).

For arrangements touching the Mainland, there is a further consideration. The PRC legal regime governing trade secrets requires, among other things, that the holder take "corresponding confidentiality measures" to maintain secrecy. A clause that does not require the disclosing party to implement internal controls does not, on its own, satisfy this evidentiary standard. The drafting therefore needs to address the obligation of the disclosing party – not only the receiving party – to maintain adequate controls.

Exclusions from the definition matter equally. Standard exclusions for information already in the public domain, information independently developed, and information received from a third party without restriction are well-established. But in a technology or data-sharing arrangement, the independent-development exclusion deserves careful scoping: a receiving party with access to the disclosed material cannot simply assert independent development without evidence of a clean-room process.

Step 4: Address IP ownership, assignment and licence back with explicit language

IP ownership in a cross-border arrangement is the most frequently litigated clause and the most frequently poorly drafted one. The core issue is that IP created under a collaborative arrangement – a joint development, a manufacturing licence, a services contract with a deliverable – does not have a default ownership position that is consistent across jurisdictions.

Under Hong Kong common law, the position on ownership of work created under a services contract will turn on the contract itself; there is no universal employer-owns rule equivalent for independent contractors. Under PRC law, the position on service inventions and commissioned works follows a different statutory structure. In the BVI, the position tracks the common law but the enforcement route is offshore. These are not the same starting point.

A well-structured clause will address at least four questions explicitly. First, who owns IP created solely by each party before the arrangement (background IP). Second, who owns IP created jointly in the course of the arrangement (foreground IP). Third, what licence does each party have to use the other's background IP during the arrangement. Fourth, what happens to licences and assignments on termination or expiry.

The assignment question is particularly important in a Mainland-facing arrangement. An assignment of IP rights that is valid under Hong Kong law may require separate registration steps under PRC rules to be effective against third parties or before the relevant administrative authority. If the arrangement involves patent rights, trade marks or software copyrights with Mainland application, the clause should address registration obligations and responsibility for costs explicitly, or the assignment will have a jurisdictional gap.

A mid-market technology group with a Hong Kong holding entity and a Mainland joint-venture partner came to our desk with a dispute over software developed during the joint venture (summer 2026). The original arrangement had an IP clause that assigned "all intellectual property created under this agreement" to the Hong Kong entity, but it had no provision for Mainland registration of the assignment and no licence-back for the Mainland partner's continuing operations. The enforceability gap was commercially significant. We mapped the ownership position, structured a corrective assignment with an accompanying operational licence, and identified the registration steps required in both jurisdictions. The commercial relationship was preserved.

For arrangements involving BVI or Cayman holding entities above the Hong Kong or Mainland operating companies, see our related guidance on supply or manufacturing contracts with a BVI party.

Step 5: Draft the data-transfer and data-localisation provisions

Data transfer is the clause layer that has changed most significantly in cross-border arrangements over the past several years, and it is the one most often treated as an afterthought in commercial contract negotiations.

For arrangements involving the transfer of personal data between Hong Kong and the Mainland, there is a practical legal interface between the Personal Data (Privacy) Ordinance as it applies in Hong Kong and the data-protection and data-localisation rules that apply on the Mainland. These are different regimes with different definitions, different transfer-mechanism requirements and different enforcement consequences. A contract that is compliant on one side of the boundary is not automatically compliant on the other.

The data-transfer clause should address three things explicitly. First, what categories of personal data (and, where relevant, important data as defined under the applicable Mainland rules) will be transferred and in which direction. Second, what transfer mechanism governs the transfer – a contractual mechanism, an adequacy-equivalent finding, or another basis. Third, what security and storage obligations apply at the destination, including any localisation requirement that would prevent the data from leaving the Mainland in the first instance.

Non-personal data – including commercial data, technical data and aggregated operating data – is increasingly subject to its own governance regime in the Mainland. The contract should not treat all data as equivalent. Where the arrangement involves data generated by Mainland operations, the clause should address whether that data can be transferred offshore for processing, analysis or storage, and on what conditions.

For in-house counsel, the practical gate at this step is a data-flow map: before drafting the data-transfer clause, document what data moves, in which direction, in what volume, and under whose control. Without that map, the clause will be written to the wrong scope.

If a prior contract has left the data-transfer or IP position unresolved, a second read of the structure can identify the exposure and the routes still open. Write to info@lockhartyip.com to discuss the position.

Step 6: Check the enforcement route before execution

A confidentiality or IP clause is only as useful as the enforcement mechanism behind it. For a cross-border arrangement, that means asking – before execution – what a party would actually do if a breach occurred tomorrow.

The enforcement route in a Hong Kong-governed arrangement depends heavily on where the breaching party and its assets are located. If the counterparty and its assets are in Hong Kong, the Court of First Instance is the relevant forum and the remedy toolkit – injunctions, delivery up, damages – is well-developed. If the assets are on the Mainland, the judgment or award needs to travel, and the mechanism for that travel is the registration process under the Cap. 645 ordinance or, for arbitral awards, the 1999 Arrangement and its 2020 Supplemental Arrangement.

For arrangements where the IP itself is the asset at risk – where a breach involves unauthorised use of a patent, trade mark or copyright on the Mainland – enforcement of the intellectual property right is a separate step from enforcement of the contractual confidentiality obligation. The two may be pursued in parallel, but they engage different authorities and different procedures.

The interim-measures mechanism for Hong Kong-seated arbitrations, in effect since 1 October 2019, is particularly relevant for IP and confidentiality disputes. A party can seek a preservation order from a Mainland people's court – covering assets, evidence, or conduct – before the arbitral award is issued. For a dispute involving alleged misappropriation of trade secrets, this can mean an evidence-preservation order at the Mainland counterparty's premises, which is a significantly more effective remedy than a damages claim months or years later.

The gate at this step: ensure the dispute-resolution clause is consistent with the enforcement route the party actually needs. An arbitration clause that routes disputes to a seat outside Hong Kong loses access to the Mainland interim-measures mechanism. A litigation clause in a jurisdiction whose judgments are not recognisable in the Mainland loses the Cap. 645 registration route. These are not abstract points; they determine the practical value of the clause.

Our deeper analysis of how these mechanisms interact is available at our analysis of data, confidentiality and IP clauses in cross-border contracts.

Step 7: Decision checklist – the seven gates

Before executing a cross-border contract with data, confidentiality or IP provisions, in-house counsel should be able to answer yes to each of the following questions. A "no" at any gate identifies a structural gap that warrants attention before signature.

• Is the governing law identified and appropriate for the substantive clauses in the contract?
• Is the forum or seat identified, and does it support the enforcement route the party needs in the jurisdictions where the counterparty and its assets are located?
• Is protected information defined with sufficient precision to support identification in evidence?
• Are IP ownership, assignment, and licence positions addressed explicitly for background IP, foreground IP, and post-termination use?
• Does the IP clause address any registration requirements in each relevant jurisdiction?
• Does the data-transfer clause address the applicable transfer mechanism and any localisation obligation at the destination?
• Has the enforcement sequence been mapped – from breach to interim relief to final remedy – across each jurisdiction in the arrangement?

This checklist is not exhaustive. Complex arrangements – joint ventures, multi-party supply chains, technology licences with sub-licensing rights – will require additional steps. But a contract that clears all seven gates is materially better positioned than one that does not.

What foreign counsel most commonly get wrong

In our cross-border practice, the most frequent structural mistake is treating the confidentiality and IP clauses as standard-form provisions that can be lifted from a domestic template and inserted into a cross-border arrangement with minimal adaptation. They cannot.

The second most frequent mistake is treating the governing-law and forum clause as a boilerplate decision to be agreed at the end of negotiations, after the substantive provisions are already settled. This reverses the correct sequence. The governing law determines what the clause can achieve. The forum determines how the clause can be enforced. Both must be decided before the substantive drafting begins.

A European technology group contracting with a Mainland manufacturer came to our desk after a dispute over trade-secret misappropriation (autumn 2026). Their European counsel had drafted a confidentiality clause governed by a European jurisdiction's law and routed disputes to European courts. When a breach occurred and assets were on the Mainland, the judgment from the European forum had no registration mechanism into the PRC court system and no interim-measures access. The structural error was made at the drafting stage, not the enforcement stage. We restructured the arrangement for the next contracting cycle and identified the parallel IP-registration steps that the original clause had missed.

The third mistake is treating data-transfer provisions as a compliance annex rather than a commercial clause. Data is often the most commercially sensitive element of the arrangement. Treating the data-transfer provisions as an afterthought – to be handled by a generic GDPR addendum – routinely produces clauses that are compliant for a European audience but unworkable for a Mainland-facing arrangement.

Related practices

• Corporate Counsel – cross-border contract structure, governance and operational compliance
• Disputes & Arbitration – enforcement, interim measures and cross-border dispute resolution

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Corporate Counsel
• Data Confidentiality Ip Clauses Cross Border Contracts Analysis
• Supply Or Manufacturing Contract Bvi Party Bvi

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.