Matter note: data, confidentiality and IP clauses

A contract that works in one jurisdiction can fail quietly in another. For international groups using Hong Kong as a hub for Greater China operations, the point of failure is rarely the commercial terms. It is the governing-law clause, the confidentiality undertaking drafted without the cross-border enforcement reality in mind, and the IP ownership provision that reads clearly in English but produces a different result when tested against Mainland Chinese law. The structural complexity is real, and it surfaces at the worst possible moment: after a breach, not before.

Data, confidentiality and IP clauses in cross-border contracts governed by Hong Kong law require careful calibration against the legal systems where the contract will actually be performed and where remedies will need to be enforced. The Companies Ordinance (Cap. 622) and the broader common-law contract framework give Hong Kong courts strong tools, but those tools only operate effectively when the clause drafting accounts for the Mainland Chinese regulatory environment, the relevant offshore holding structure, and the specific enforcement route available in each jurisdiction involved. Since the Mainland Judgments in Civil and Commercial Matters (Reciprocal Enforcement) Ordinance (Cap. 645) came into force on 29 January 2024, the enforcement dimension of Hong Kong-seated commercial arrangements has become materially clearer – though it does not remove the need for precise drafting at the outset.

This matter note sets out an anonymised situation from our cross-border corporate counsel practice. It covers the issue that arose, the route chosen, the sequence of steps, and the transferable lesson for international groups structuring similar arrangements through Hong Kong.

The situation: an international group and a Mainland operating partner

The client was a European industrial group with a holding entity in the BVI and an operating subsidiary in Hong Kong. In late 2025, the group entered a technology-sharing and distribution arrangement with a Mainland Chinese counterparty. The arrangement involved the transfer of proprietary process data, access to source documentation, and a joint development element – meaning that IP created during the relationship would be owned or licensed across the two entities.

The contract was drafted by the group's European external counsel. It was governed by Hong Kong law. The confidentiality clause followed a standard template: obligations of non-disclosure, a carve-out for publicly available information, a three-year post-termination tail, and a remedies clause pointing to injunctive relief. The IP ownership provision assigned all jointly developed IP to the European group, with a licence back to the Mainland counterparty for use within the People's Republic of China.

On paper, the structure was reasonable. The group's European advisers were experienced in commercial contracts. But the contract had been drafted as if the governing-law clause solved the cross-border enforcement question. It did not. Two questions were effectively unanswered: first, what would a Hong Kong court actually be able to do if the Mainland counterparty used the confidential data in breach and the assets were all in the Mainland? Second, was the IP assignment enforceable under Mainland Chinese IP law as written, or would local mandatory rules affect the result?

The cross-border problem: three clauses, two legal systems

Our desk was instructed shortly after execution, when the group's in-house team asked for a read on the "day-two operating reality" – a phrase that captures exactly the right question. The contractual rights looked sound. The enforcement chain did not.

The confidentiality clause presented the first difficulty. It was drafted for a single-jurisdiction relationship. The carve-outs and the definition of "confidential information" were standard for a UK or Hong Kong commercial contract. But the counterparty's obligations would be performed in the Mainland, and any breach would occur there. The clause gave the Hong Kong courts jurisdiction but did not address how an injunction or damages award from those courts would be enforced against the Mainland entity.

Under Cap. 645, a Hong Kong court judgment – including a monetary judgment and, importantly, a non-monetary judgment such as an injunction – can now be registered and enforced in the Mainland, provided the judgment falls within the scope of the Ordinance and meets the conditions for registration. That is a significant development. But the clause had not been drafted to optimise for it. There was no explicit Hong Kong exclusive-jurisdiction clause. The governing-law clause was present, but jurisdiction was expressed as "non-exclusive". That drafting choice meant that the enforcement route under Cap. 645 was available in principle but was weaker in practice, because a Mainland court might take concurrent jurisdiction and apply a different analytical approach to the obligations.

The IP ownership clause presented a second and distinct problem. The Mainland Chinese regulatory environment imposes mandatory rules on the assignment and licensing of certain categories of technology to or from foreign entities. These rules operate independently of the governing-law clause. A contract governed by Hong Kong law does not displace Mainland mandatory IP and technology-transfer rules where those rules apply by their own terms to the subject matter. The assignment provision in the contract had not been reviewed against those rules. The result was a clause that was valid and enforceable under Hong Kong law but potentially void or subject to regulatory challenge in the Mainland on specific categories of the jointly developed IP.

The third issue was the data-handling provision. The Mainland Personal Information Protection Law and the Data Security Law impose obligations on entities handling Mainland-sourced data, and those obligations cannot be contracted out of regardless of the governing law. The contract had no provision addressing cross-border data flows, data localisation, or the notification and approval requirements that apply to certain outbound data transfers. This was not a drafting error in the English-law sense. It was a gap that only appeared when the cross-border interface was examined.

The sequence and the turning point

We conducted a structured cross-border review of the three clauses against Hong Kong law and the Mainland regulatory environment. This was not a re-drafting exercise for its own sake. The question was specific: what was the group's actual enforcement and compliance position, and what amendments were necessary to protect it?

On the jurisdiction clause, the route was clear. The non-exclusive jurisdiction provision was replaced with an exclusive Hong Kong jurisdiction clause. This change mattered for two reasons. First, it sharpened the enforcement route under Cap. 645, because the registration mechanism operates most cleanly where there is no parallel Mainland proceeding and no jurisdictional ambiguity. Second, it reduced the risk of a Mainland court taking concurrent jurisdiction over a dispute and applying different substantive standards to the confidentiality obligations.

We also reviewed whether an arbitration clause would have been preferable. For some cross-border arrangements with Mainland counterparties, arbitration under the HKIAC Administered Arbitration Rules offers structural advantages: the 1999 Arrangement and the 2020 Supplemental Arrangement provide a mutual enforcement mechanism for arbitral awards between Hong Kong and the Mainland, and simultaneous enforcement applications have been permitted since the 2021 amendment. In this matter, the group had already executed the contract. The focus was on optimising the existing litigation route rather than substituting it.

The IP ownership clause required more careful handling. We identified the categories of jointly developed IP that fell within the scope of Mainland technology-transfer rules and restructured the ownership and licensing provisions to address them separately. For categories where outright assignment to the foreign group was problematic under Mainland mandatory rules, the structure was amended to a co-ownership arrangement with an exclusive licensing arrangement governing use. This preserved the group's economic interest and control while reducing the regulatory risk in the Mainland. The changes required agreement from the counterparty, and the negotiation of the amendment was conducted by the group's in-house team with our cross-border drafting support.

The data clause was the turning point in terms of the group's internal risk position. The in-house team had not identified the data-transfer gap before our review. Once identified, the parties agreed to add a data-handling annex addressing the applicable Mainland requirements for cross-border data flows. The annex required input from Mainland-qualified advisers working alongside our desk. The result was a provision that acknowledged the applicable regulatory regime, set out the applicable consent and notification steps, and preserved the group's ability to use the data for the purposes of the arrangement.

Qualitative outcome and the transferable lesson

The arrangement proceeded. The group had a clear enforcement route, a defensible IP ownership structure, and a data-handling position that reflected the applicable regulatory requirements on both sides of the boundary. No litigation arose. The more important point is structural: the issues identified in this matter are not unusual. They appear regularly in cross-border technology and commercial arrangements where one party is in the Mainland and the contract has been drafted primarily through a Hong Kong or European lens.

The transferable lesson is this. A governing-law clause selects the system of law that determines the contract's interpretation and enforceability between the parties. It does not displace the mandatory rules of other systems that apply by their own terms to the subject matter. For cross-border arrangements involving Mainland counterparties, at least three mandatory-rule systems operate in parallel: Mainland Chinese IP and technology-transfer rules, Mainland data-protection rules, and the procedural framework that governs how a Hong Kong judgment or award is recognised and enforced in the Mainland. Each of these operates independently of the governing-law choice. The contract needs to address all three, not just the first.

A second lesson is the distinction between day-one validity and day-two operating reality. A clause that is valid under its governing law may produce a different result when the enforcement chain is traced across jurisdictions. In our cross-border practice, we regularly see contracts that have been carefully drafted under one system without being stress-tested against the system in which they will actually need to operate. The review is not complex once the right cross-border questions are asked. The cost of not asking them is the difference between a paper right and an enforceable one.

A micro-scenario from a parallel matter illustrates the point from a different angle. A Cayman-headquartered technology group with a Hong Kong subsidiary entered a software development agreement with a Mainland counterparty in early 2026. The IP assignment clause was governed by English law. The clause assigned all work-for-hire IP to the Cayman entity. On review, the assignment was not registered with the relevant Mainland authority, as required by Mainland mandatory rules for certain categories of software IP. The assignment was valid as between the parties under English law but was not enforceable against third parties in the Mainland without registration. A short additional step – registration with the relevant Mainland registry – resolved the issue. It was a step that foreign counsel had not identified because the mandatory-rule framework was not within their field of view.

The sequence in both matters follows the same pattern: well-intentioned drafting under a familiar governing law, no cross-border stress-test, and a gap that only appeared when the actual enforcement and regulatory environment was examined. The solution in both cases was identification followed by a targeted amendment – not a wholesale re-drafting of the contract.

For in-house teams managing cross-border commercial arrangements of this kind, the practical prompt is to treat the governing-law clause as the starting point for the cross-border analysis, not the end of it. The analysis that follows – across the IP, data, and enforcement dimensions – is the part that determines whether the contractual rights are real.

For a structured read on how data, confidentiality and IP clauses in your cross-border contracts sit against the Mainland and Hong Kong regulatory environment, see our overview of corporate counsel services for international groups and our analysis of ongoing corporate counsel for foreign groups in Hong Kong. For joint-venture arrangements where these issues arise in a shareholders' agreement context, our guide to shareholders' agreement terms for cross-border joint ventures addresses the related structuring questions.

The sequence above describes the standard position in matters of this kind. Your situation turns on the specific clauses, the jurisdictions actually engaged, and the regulatory categories that apply to your subject matter – which is where the route is won or lost.

To discuss how a cross-border clause review would apply to your arrangement, contact info@lockhartyip.com.

Related practices

Corporate Counsel – cross-border contract review and ongoing counsel for international groups
Holding Structures – BVI, Cayman and Hong Kong holding vehicle design and review

Frequently asked questions

How does the cross-border element affect data, confidentiality and IP clauses in cross-border contracts?

A governing-law clause does not displace the mandatory rules of other jurisdictions that apply to the subject matter by their own terms. For arrangements involving Mainland Chinese counterparties, at least three parallel systems operate independently: Mainland IP and technology-transfer rules, Mainland data-protection rules, and the procedural framework under the Mainland Judgments in Civil and Commercial Matters (Reciprocal Enforcement) Ordinance (Cap. 645). Each clause needs to be reviewed against all three systems, not only against the chosen governing law. The gap between a paper right and an enforceable one typically appears at this interface.

How long does data, confidentiality and IP clauses in cross-border contracts usually take?

A structured cross-border clause review for an executed or draft commercial contract typically runs over several weeks, depending on the number of clauses, the regulatory categories involved, and whether amendments require negotiation with the counterparty. Where Mainland mandatory-rule issues are identified – for example, technology-transfer registration requirements or data-transfer notification obligations – input from Mainland-qualified advisers working alongside our desk is coordinated, and that adds time to the overall sequence. Parties should verify the current position and timeline with counsel before acting.

Do I need a Hong Kong adviser for data, confidentiality and IP clauses in cross-border contracts?

Where the contract is governed by Hong Kong law or uses Hong Kong as the forum jurisdiction, a cross-border adviser based in Hong Kong is well-placed to assess the enforcement chain under Cap. 645, the interaction with Mainland mandatory rules, and the structural choices available. Lockhart & Yip advises on international and foreign law and works alongside locally licensed Hong Kong firms and allied Mainland counsel on matters requiring admission in those jurisdictions. European or US counsel drafting these contracts without a cross-border review of the Mainland and Hong Kong interface regularly miss the mandatory-rule gaps described in this note.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

Matter note: data, confidentiality and IP clauses in cross-border contracts