¶¶Òõ¶ÌÊÓƵ

1. Cross-border Transfers: Required when personal data will be transferred outside of Hong Kong, detailing transfer mechanisms and safeguards

2. Data Protection Impact Assessments: Include when processing is likely to result in high risk to individuals, outlining processor's obligations to assist with DPIAs

3. Special Categories of Personal Data: Include when sensitive personal data will be processed, specifying additional safeguards

4. Insurance Requirements: Include when specific insurance coverage for data protection incidents is required

5. Processor Personnel: Include when specific requirements for staff training, screening, or confidentiality agreements are needed

6. Business Continuity and Disaster Recovery: Include when specific business continuity requirements are needed for critical processing activities

1. Schedule 1 - Processing Activities: Detailed description of processing activities, including categories of data subjects, types of personal data, and processing purposes

2. Schedule 2 - Technical and Organizational Measures: Detailed specification of security measures, access controls, and other protective measures

3. Schedule 3 - Approved Sub-processors: List of pre-approved sub-processors and their processing activities

4. Schedule 4 - Data Transfer Mechanisms: Details of cross-border transfer mechanisms and safeguards if applicable

5. Appendix A - Security Breach Response Plan: Detailed procedures for handling and reporting security incidents and data breaches

6. Appendix B - Audit Requirements: Specific procedures and requirements for conducting compliance audits