A Hong Kong group with an Indian subsidiary will handle personal data under two regimes: Hong Kong's Personal Data (Privacy) Ordinance (PDPO), built on six data protection principles, and India's Digital Personal Data Protection Act, 2023, whose Rules were notified on 13 November 2025 with the main duties starting 13 May 2027. The Indian Act uses consent and legitimate-use grounds, gives individuals rights, requires reasonable security and breach intimation, and allows penalties up to INR 250 crore. Cross-border transfers from India are allowed except to countries the government restricts; Hong Kong's cross-border transfer section of the PDPO has not been brought into force. Map data flows, prepare notices and agreements, and review before May 2027.
← Back to the complete guide: How to Set Up a Subsidiary in India from Hong Kong
Key facts
| Hong Kong law | Personal Data (Privacy) Ordinance (Cap. 486) with six data protection principles; Privacy Commissioner for Personal Data |
|---|---|
| Indian law | Digital Personal Data Protection Act, 2023; Rules notified 13 November 2025 |
| Timeline | Main duties apply from 13 May 2027 under the staged commencement |
| Penalties | Up to INR 250 crore for failure to take reasonable security safeguards |
| Transfers from India | Permitted except to restricted countries notified by the government; sector laws may be stricter |
| Transfers from Hong Kong | Section 33 of the PDPO (cross-border) not in force; Commissioner recommends model clauses and due diligence |
| Processors | Written contract; the fiduciary stays accountable |
| Breach | Notify the Data Protection Board and affected individuals under the Indian Rules; the PDPO regime on breach notification is guidance-based |
Side-by-side
| Topic | Hong Kong PDPO | India DPDP Act |
|---|---|---|
| Base of processing | Collection must be lawful, fair and for a purpose directly related to a function; notice at collection | Consent or specified legitimate uses; notice in clear language |
| Individual rights | Access and correction | Access, correction, erasure, grievance redressal, nomination |
| Security | Practicable steps to protect data | Reasonable security safeguards; breach intimation |
| Cross-border | Section 33 not in force; guidance on model clauses | Allowed except to notified restricted countries |
| Regulator | Privacy Commissioner for Personal Data | Data Protection Board of India |
| Penalty | Offences and enforcement notices; compensation claims | Monetary penalties up to INR 250 crore |
Typical data flows in a Hong Kong-India group
- Employee data shared with the Hong Kong parent for payroll, HR and performance reviews.
- Customer data held by Hong Kong marketing or CRM systems and processed by Indian support teams.
- Shared services (finance, IT, analytics) performed in India for Hong Kong entities, making the Indian company a processor.
- Cloud hosting and group tools that move data between regions.
Practical steps
- Map what data moves between Hong Kong and India, who controls it and who processes it.
- Update notices and consent flows for the Indian rules before May 2027.
- Put processor and intra-group data transfer agreements in place with security, breach and audit terms.
- Set up a breach response plan covering both regulators.
- Review retention and deletion so that old Indian personal data is not kept without purpose.
Sector rules
Financial, health, telecom and government-linked data may be subject to sector rules, including localisation requirements in some regulated sectors. Check your sector regulator's directions before moving data abroad.
Official sources
Check the rules at the primary sources: Income Tax Department (India), Reserve Bank of India, Ministry of Corporate Affairs, Inland Revenue Department (Hong Kong), Companies Registry (Hong Kong) and the Ministry of External Affairs (India).
Frequently asked questions
Does the PDPO apply to my Indian subsidiary?
The PDPO applies to data users who control the collection, holding, processing or use of data in or from Hong Kong. Indian processing for a Hong Kong group still needs contractual protections. Take Hong Kong advice on scope.
When do the Indian data protection duties start?
The Rules were notified on 13 November 2025 and the main duties apply from 13 May 2027.
Can I send Indian personal data to Hong Kong?
Generally yes, because the Act restricts transfers only to countries the government notifies. Sector rules can be stricter.
What is the maximum penalty in India?
Up to INR 250 crore for failing to take reasonable security safeguards to prevent a personal data breach.
Is Hong Kong's cross-border transfer rule in force?
Section 33 of the PDPO has not been brought into force. The Commissioner has issued guidance and model clauses.
Do I need a data processing agreement?
Yes. A written contract with the processor covers purpose, security, breach and return or deletion of data.
Who regulates data protection?
The Privacy Commissioner for Personal Data in Hong Kong and the Data Protection Board of India.
Related guides
Hiring Staff in India as a Hong Kong-Owned Company: Employment Contracts, Provident Fund, ESI, Gratuity and Labour Codes
How a Hong Kong-owned Indian subsidiary hires locally: offer and employment contracts, payroll taxes, provident fund, ESI, gratuity, labour codes, shops and establishments law, notice periods, POSH and differences from Hong Kong practice.
Read the guide →Contracts and Dispute Resolution for Hong Kong Companies in India: Governing Law, HKIAC Arbitration, Enforcing Hong Kong Judgments and Awards
How to draft and enforce contracts between a Hong Kong company and Indian counterparties: governing law, HKIAC or SIAC seats, Hong Kong as a reciprocating territory under Section 44A, enforcing awards under the New York Convention, stamp duty and limits on interim relief.
Read the guide →Compliance Calendar: Indian Deadlines and the Hong Kong Filings They Feed
A month-by-month compliance calendar for an Indian subsidiary of a Hong Kong parent: TDS, GST, PF and ESI, advance tax, AGM, AOC-4, MGT-7, FLA return, approval conditions and the Hong Kong-side annual return and profits tax filings.
Read the guide →Twelve Common Mistakes Hong Kong Companies Make in India and How to Avoid Them
The most common mistakes of Hong Kong companies entering India: skipping Press Note 3, thin hub structures, late FEMA filings, weak treaty paperwork, secondment tax errors, stale apostilles, unstamped contracts and ignoring the Indian calendar.
Read the guide →Sources
Last updated 26 October 2026. General information only, not legal or tax advice. Indian and Hong Kong rules change often; confirm current requirements before acting.