All entities licensed by the Hong Kong SFC and storing data in the cloud must urgently review their data storage arrangements in light of a new circular from the SFC on the “Use of external electronic data storage”. This circular introduces strict new conditions on both cloud users and cloud vendors (named “external electronic data service providers” or “EDSPs”).

Licensed corporations must put in place the following measures without undue delay, and in any case by no later than 30 June 2020:

It will be interesting to see how cloud data storage providers will respond to these new requirements. Nevertheless, licensed corporations should act now to address the above, given these potentially onerous new compliance steps.