Cross-border Personal Data Transfers in the Greater Bay Area

This article investigates how regulatory fragmentation across Mainland China, Hong Kong, and Macao shapes cross-border transfers of personal data in the Guangdong–Hong Kong–Macao Greater Bay Area (GBA) and its impact on data-intensive sectors such as finance, digital services. As next-generation wireless communication networks and electromagnetic information transmission technologies increasingly support cross-border digital infrastructure, establishing secure and legally compliant data flows has become an essential prerequisite for regional digital integration. Adopting a doctrinal and comparative approach, this study analyses the Personal Information Protection Law (PIPL), Hong Kong’s Personal Data (Privacy) Ordinance (PDPO), Macao’s Personal Data Protection Act (PDPA), and the GBA Standard Contract. It identifies three major fault lines involving export pathways and procedures, definitions and lawful bases for processing, and enforcement architecture across the three jurisdictions. These divergences generate duplicative compliance obligations, increase operational costs, and impede data mobility for finance, research, services. The article further evaluates the GBA Standard Contract as a pragmatic sub-regional mechanism that simplifies compliance while preserving local autonomy and proposes a roadmap based on minimum-standard harmonisation, mutual recognition, coordinated complaint handling, third-party certification, technical safeguards including encryption and anonymisation, and sectoral pilot sandboxes. The proposed legal framework facilitates secure and efficient cross-border data flows while supporting interoperable digital infrastructures under the “one country, two systems” framework.