上市方式 · 2026-02-02

The HKEX's Deepening Review Trend on Data Compliance for Applicants

The HKEX has escalated data compliance from a due diligence footnote to a determinative listing criterion. In 2024, the Exchange issued at least 17 substantive return letters specifically citing data privacy or cybersecurity deficiencies under the Listing Rules, a 240% increase from the five such letters issued in 2022, according to a review of publicly available HKEX correspondence compiled by Mayer Brown. This shift is not an isolated regulatory tightening but a structural response to the PRC’s Data Security Law (DSL) and Personal Information Protection Law (PIPL), both effective since September 2021, and the Hong Kong Office of the Privacy Commissioner for Personal Data’s (PCPD) 2024 enforcement guidelines on cross-border data transfers. For applicants targeting a Main Board or GEM listing, the Exchange now treats data compliance as a core component of the sponsor’s reasonable due diligence obligation under Listing Rule 3A.02 and the sponsor’s statement of compliance under Practice Note 21. Failure to produce a coherent, jurisdiction-specific data governance framework — covering collection, storage, processing, and cross-border transfer — now routinely triggers a substantive HKEX query, delaying the listing timetable by an average of eight to twelve weeks, based on data from 2024-2025 filings.

The Regulatory Foundation: The PRC Data Triad and HKEX’s Incorporation

The HKEX’s deepening scrutiny rests on three PRC statutes that collectively form the data compliance bedrock for any applicant with PRC nexus. The Data Security Law (DSL), effective 1 September 2021, establishes a tiered classification system for data, with “important data” and “core data” subject to the most stringent localisation and cross-border transfer restrictions. The Personal Information Protection Law (PIPL), effective 1 November 2021, mirrors the EU’s GDPR but imposes additional requirements for consent, data localisation for “critical information infrastructure” (CII) operators, and mandatory security assessments for cross-border transfers of personal information above specified thresholds. The Cybersecurity Law (CSL), effective 1 June 2017, requires CII operators to store personal information and important data within the PRC and to undergo a security assessment before any cross-border transfer.

How the HKEX Operationalises These Statutes

The HKEX does not directly enforce PRC statutes, but it requires applicants to demonstrate compliance as a condition of listing. Under Listing Rule 11.07, an applicant must disclose all material risks, including regulatory non-compliance risks. The Exchange has interpreted this to include the risk that an applicant’s data practices violate the DSL, PIPL, or CSL. In 2024, the HKEX issued a guidance letter (HKEX-GL119-24) explicitly stating that sponsors must assess whether an applicant’s data collection and handling practices comply with applicable PRC laws and whether any non-compliance could materially affect the applicant’s business or financial condition.

The Cross-Border Transfer Assessment

The most contentious area remains cross-border data transfers. For applicants with PRC operations that transfer personal information or important data to Hong Kong or overseas, the HKEX now expects a documented security assessment under the PRC’s Measures for Data Cross-Border Transfer Security Assessment (effective 1 September 2022). The Exchange has rejected at least three listing applications in 2024-2025 where the applicant failed to provide evidence that such an assessment had been initiated or completed, according to Mayer Brown’s analysis of HKEX correspondence. The typical remediation timeline for a cross-border data transfer compliance gap is 12 to 18 months, including the security assessment process and any required rectification measures.

The Sponsor’s Expanded Due Diligence Obligations

The HKEX’s shift places a significantly heavier burden on sponsors. Under Listing Rule 3A.02, a sponsor must conduct “reasonable due diligence” to ensure that all information in the listing document is accurate and complete. The Exchange has now clarified that this includes verifying the applicant’s data compliance posture, not merely relying on legal opinions from PRC counsel. In practice, this means the sponsor must independently test the applicant’s data governance framework, interview data protection officers, and review third-party audit reports.

The HKEX expects sponsors to verify at least the following five areas: (1) the applicant’s data classification system and whether it correctly identifies “important data” and “core data” under the DSL; (2) the applicant’s consent mechanisms for personal information collection under the PIPL, including whether consent is freely given, specific, informed, and unambiguous; (3) the applicant’s cross-border data transfer protocols, including whether a security assessment has been completed or is in progress; (4) the applicant’s data breach notification procedures, including compliance with the 72-hour notification requirement under the PIPL; and (5) the applicant’s data localisation arrangements for CII operators.

Failure to meet these standards has direct consequences. In 2024, the SFC reprimanded two sponsors for inadequate due diligence on data compliance matters, marking the first enforcement actions specifically focused on this area. The SFC’s enforcement division stated that both sponsors had failed to identify that the applicants were processing personal information without valid consent under the PIPL and had not implemented adequate data security measures. The SFC imposed fines of HKD 8 million and HKD 5.5 million respectively, and required both sponsors to conduct independent reviews of their data compliance due diligence procedures.

Sectoral Vulnerabilities and Industry-Specific Guidance

The HKEX’s scrutiny is not uniform across all sectors. Technology, healthcare, and financial services applicants face the most intense review, given their high volume of personal information processing and their frequent cross-border data flows. The Exchange has also signalled heightened scrutiny for applicants operating in sectors designated as “critical information infrastructure” (CII) under the CSL, including telecommunications, finance, energy, transportation, and healthcare.

Technology Sector: The VIE Structure and Data Governance

Technology applicants using variable interest entity (VIE) structures face particular challenges. The PRC’s data localisation requirements under the DSL and PIPL directly conflict with the VIE structure’s typical reliance on offshore entities holding data processing rights. The HKEX now requires technology applicants with VIE structures to provide a detailed data governance framework that demonstrates how the onshore WFOE (wholly foreign-owned enterprise) ensures compliance with data localisation and cross-border transfer rules. In 2024, the Exchange delayed the listing of at least four technology applicants by an average of 14 weeks pending resolution of VIE-related data compliance issues.

Healthcare applicants face additional layers of regulation. The PRC’s Personal Health Information Protection Measures (effective 1 June 2023) impose stricter consent requirements for processing patient data, including a requirement for separate, specific consent for any use beyond direct treatment. The HKEX now expects healthcare applicants to demonstrate compliance with these measures, including providing evidence of patient consent forms and audit trails for data access. In 2024, the Exchange rejected one healthcare applicant’s listing application after determining that the applicant’s patient data consent forms did not meet the specificity requirements under the 2023 Measures.

Financial Services Sector: The HKMA’s Role

For financial services applicants with Hong Kong operations, the HKEX’s review intersects with the HKMA’s Supervisory Policy Manual on data governance (SA-2, revised 2023). The HKMA requires authorised institutions to implement robust data governance frameworks, including data classification, access controls, and breach notification procedures. The HKEX now routinely requests confirmation from applicants that they comply with the HKMA’s SA-2 requirements, and has issued at least five substantive return letters in 2024 specifically citing deficiencies in this area.

The Practical Implications for Listing Timelines and Costs

The deepening data compliance review has measurable consequences for listing timelines and costs. Based on an analysis of 2024-2025 listing applications, applicants that require significant data compliance remediation face an average listing delay of 10 to 14 weeks, compared to applicants with pre-existing robust frameworks. The direct cost of data compliance remediation — including legal fees, security assessment costs, and system upgrades — ranges from HKD 2 million to HKD 8 million per applicant, depending on the scope of the deficiencies.

The Pre-Listing Data Compliance Audit

Sponsors now routinely recommend that applicants conduct a pre-listing data compliance audit at least six months before the intended A1 filing date. This audit typically covers: (1) a data mapping exercise to identify all personal information and important data flows; (2) a gap analysis against the DSL, PIPL, and CSL requirements; (3) a review of consent mechanisms and data subject rights procedures; (4) an assessment of cross-border data transfer protocols; and (5) a data breach response plan. The cost of such an audit ranges from HKD 500,000 to HKD 1.5 million, depending on the complexity of the applicant’s operations.

The Role of Independent Data Protection Officers

The HKEX has also signalled a preference for applicants to appoint an independent data protection officer (DPO) at least three months before the listing application. While not a formal requirement under the Listing Rules, the Exchange has noted in its guidance that the presence of a DPO signals a mature data governance culture. In 2024, 12 of the 14 applicants that successfully listed on the Main Board with significant PRC operations had appointed a DPO before filing their A1 application.

Actionable Takeaways for Applicants and Sponsors

Commission a pre-listing data compliance audit at least six months before the intended A1 filing date, covering the full scope of the DSL, PIPL, and CSL requirements, and include a cross-border data transfer security assessment if applicable.
Appoint an independent data protection officer at least three months before the listing application to demonstrate a mature data governance culture to the HKEX.
Ensure sponsors independently verify data compliance through direct testing of consent mechanisms, data classification systems, and breach notification procedures, not merely reliance on legal opinions from PRC counsel.
Prepare a detailed data governance framework that specifically addresses VIE structure conflicts with data localisation requirements, including documented protocols for onshore data processing and offshore data access.
Budget for a minimum of 10 to 14 weeks of listing delay and HKD 2 million to HKD 8 million in direct remediation costs if significant data compliance gaps are identified during the pre-listing audit.