NDA Hong Kong: Confidentiality Agreement, Cap. 486

A non-disclosure agreement in Hong Kong is a private contract, nothing more. No ordinance creates it, no registry records it and no official form exists. Its force comes from the common law of contract, so the ordinary ingredients have to be present: offer, acceptance, consideration and an intention to create legal relations. Practitioners also call it a confidentiality agreement, or a confidentiality and standstill agreement when it restricts approaches to shareholders and staff.

What matters most is the difference between the agreement and the underlying equitable duty. Even with nothing signed, Hong Kong courts recognise a duty of confidence in equity, following the three limbs of Coco v A N Clark (Engineers) Ltd [1969] RPC 41 and applied locally in China Light and Power Co Ltd v Ford [1996] 1 HKLRD 57: the information must have the necessary quality of confidence, it must have been received in circumstances importing an obligation, and there must be unauthorised use to the discloser's detriment. A written NDA does not replace that claim. It removes the argument about whether an obligation existed and fixes the remedies in advance, which is why a signed agreement is worth far more in an urgent injunction application than a well-remembered conversation. Companies that negotiate often keep one beside their other business and incorporation documents for Hong Kong companies.

No single ordinance governs confidentiality agreements here. Enforceability rests on general contract principles, while a statutory layer shapes the drafting. The first question is consideration. Where one party discloses and the other simply promises silence, that promise may be unsupported by anything of value. The orthodox answer is to execute the document as a deed, which dispenses with consideration. An individual executes a deed under section 19 of the Conveyancing and Property Ordinance (Cap. 219) by signing an instrument expressed to be a deed before an attesting witness; a company executes under sections 127 and 128 of the Companies Ordinance (Cap. 622). The choice also changes the limitation period, since the Limitation Ordinance (Cap. 347) allows six years for a simple contract and twelve for a specialty.

The second layer is data protection. If the confidential information includes personal data, the disclosing party remains the data user and stays answerable for what its counterparty does. DPP2(3) and DPP4(2) of the Personal Data (Privacy) Ordinance (Cap. 486) require a data user engaging a data processor to adopt contractual or other means against excessive retention and unauthorised access, and section 65(2) makes a principal liable for the acts of its agent. The confidentiality clause and the data protection clause do different jobs, and both have to be there. The Privacy Commissioner's guidance on the six data protection principles sets the standard the regulator applies.

Three further points shape the text. The Contracts (Rights of Third Parties) Ordinance (Cap. 623) lets a third party enforce a term that purports to benefit it, so the agreement must either extend protection to group companies deliberately or exclude the Ordinance. Electronic execution falls under the Electronic Transactions Ordinance (Cap. 553), subject to its Schedule 1 exclusions. An NDA is not a chargeable instrument under the Stamp Duty Ordinance (Cap. 117), so it needs no stamping and no filing. Where the counterparty is an employee, section 70 of the Employment Ordinance (Cap. 57) stops any term cutting statutory entitlements, a point that runs through employment contracts and HR documents drafted for Hong Kong.

Commercial due diligence is the classic trigger. Before a buyer sees management accounts, customer contracts or margin data, the seller wants a signed one-way NDA on file, and if the buyer discloses its own funding structure the document becomes mutual. Supplier and contractor relationships come next, where a manufacturer in the Pearl River Delta, a software developer or an outsourced payroll provider receives specifications, drawings or staff records. Investor conversations come third, though most institutional venture funds in Hong Kong decline to sign at the pitch stage.

Employment and consultancy sit slightly apart. During employment an implied duty of fidelity already restricts disclosure, but after termination that protection narrows sharply, which makes an express and carefully particularised confidentiality clause the only reliable route. The same logic covers non-executive directors, advisers and volunteers, including those on the committees of societies and charities that rely on their own governance documents for Hong Kong non-profit organisations.

Two edge cases deserve a second look. The first is the beauty parade, where an agency or an architect pitches for work and hands over a concept the client later builds in-house; only a signed NDA turns that into a claim. The second is the family business succession discussion, where valuations and shareholding intentions circulate among relatives who sign nothing. Silence between family members is not a defence to disclosure, and the missing document is what makes those disputes so hard to run.

• The definition of confidential information wins or loses the case. Our template pairs a broad description of the categories covered with a mechanism for marking written material and confirming oral disclosures in writing within a fixed window. A clause that simply says "all information" invites a court to read it down, as in Conpak Management Consultants Ltd v Luk Wai Ting [2024] HKCU 3803, where ordinary client contact details were held not confidential.
• The permitted purpose limits use of the material to the transaction under discussion. Without it, a receiving party can keep the information secret and still use it for a competing venture, the most common gap in short form NDAs circulated by email.
• The exclusions cover information already public, independently developed, lawfully received from a third party or known before disclosure, plus disclosure compelled by law or by a regulator, subject to prompt notice to the discloser.
• The permitted recipients clause names who may see the material, typically directors, employees on a need to know basis and professional advisers, and makes the receiving party answerable for their breaches. It carries the Cap. 486 obligations down the chain.
• The survival period sets how long the duty runs after discussions end, with a separate and unlimited term for trade secrets and personal data, backed by a right to demand delivery up or certified destruction of the material.
• The remedies and dispute resolution clauses record that damages alone are inadequate, preserve injunctive relief, and select Hong Kong law with either the local courts or arbitration under the Arbitration Ordinance (Cap. 609).

Financial services work carries a regulatory overlay a generic template ignores. Licensed corporations answer to the Securities and Futures Commission under the Securities and Futures Ordinance (Cap. 571), and banks owe a common law duty of secrecy to customers. The compelled disclosure carve-out must therefore be wide enough to allow a response to a regulator without notice where tipping off is prohibited.

Cross-boundary arrangements with the Mainland are the second pressure point. Where information moves to a group company or supplier north of the boundary, the Mainland's Personal Information Protection Law applies to the recipient while Cap. 486 continues to bind the Hong Kong data user, so the transfer clause has to work under both regimes. Hong Kong law with a Hong Kong seated arbitration is the usual answer, since the arrangement on interim measures between the two jurisdictions opens access to Mainland court preservation orders.

Technology and life sciences disclosures raise the residual knowledge problem. Receiving parties often ask for a clause allowing staff to use unaided memory, which sounds harmless and quietly guts the agreement. Our template omits it, and states that disclosure grants no rights under the Patents Ordinance (Cap. 514) or the Copyright Ordinance (Cap. 528).

Property and agency deals rely on confidentiality agreements more than people expect, particularly for off market portfolio sales, tenant mix data and rent rolls shown to prospective purchasers. They usually pair the NDA with the instruments in our Hong Kong tenancy and property agreements collection.

You begin by choosing between the one-way and the mutual structure, and the form adapts every downstream clause to that choice. Next you identify the parties properly. For a Hong Kong incorporated company that means the full registered name and the Companies Registry number, not the trading name on the website, because an agreement signed by a business that does not legally exist binds nobody. You then describe the permitted purpose in one or two concrete sentences, naming the transaction rather than the vague phrase "potential business relationship".

The remaining screens deal with scope and duration. You set the survival period, decide whether trade secrets and personal data run without limit, and choose whether oral disclosures must be confirmed in writing. You pick the governing law and the dispute resolution route, then indicate whether the document is signed as a simple contract or as a deed, which adds the attestation block for the witness. The finished agreement arrives in Word and PDF, through the same guided route as the full catalogue of Hong Kong legal templates.

The most frequent error is a definition of confidential information so wide that no court will enforce it. Drafters copy a clause covering every communication of any kind, then find in court that the material they care about was never marked and sits beside publicly available price lists. Second comes the missing purpose limitation, which turns the agreement into a document that stops publication but permits competition. Third is the survival period trap, where a five year term expires quietly and takes a genuine trade secret with it, because trade secrets were never carved out of the general clock.

Two mistakes are specific to Hong Kong practice. Signing a one-way agreement as a simple contract with no consideration moving from the discloser leaves an obvious line of defence open, and the fix costs nothing beyond a witness signature. Treating a confidentiality clause as a substitute for a non-compete is the other, and it fails reliably. Post-termination restrictions are prima facie void as restraints of trade unless the employer proves a legitimate proprietary interest and reasonable limits on scope, duration and geography. Parties also forget that delay defeats urgency: a discloser who waits three months after learning of a leak will struggle to persuade a judge that an injunction is needed today.