Data Cross-border Flow in the Guangdong-Hong Kong-Macao Greater Bay Area: Governance Model Evolution and Institutional Reflection

Core Question: As the most typical experimental field of “one country, two systems, three jurisdictions,” the Guangdong-Hong Kong-Macao Greater Bay Area (GBA) has witnessed its cross-border data governance evolve through stages of institutional exploration, rule alignment, and multi-track parallel operation. However, the compliance barriers formed by legal differences and regulatory fragmentation among the three jurisdictions have yet to be fundamentally resolved. Based on the Technology-Institution-Organization (TIO) analytical framework, this paper conducts a systematic assessment of institutional texts, practical explorations, and governance effectiveness. Major Findings: (1) The GBA’s governance model has undergone a phased evolution from “consultative exploration” to “standardized contracts,” and then to the “negative list and whitelist multi-track parallel” stage. This evolution is driven by a triple interaction of central authorization, enterprise compliance pressure, and technological imperative. (2) Each model has its strengths and limitations in bridging legal differences: standardized contracts initially provide a unified compliance tool but only cover personal information and lack cross-regional regulatory coordination; the negative list and whitelist model inaugurates a scenario-based, differentiated governance phase but faces risks of fragmentation and absence of mutual recognition mechanisms. (3) The latest initiatives, such as the Tianhe Consensus and the GBA Data Special Zone Innovation Cooperation Center, reflect a conceptual shift from “rule export” to “collaborative legislation,” yet still face triple challenges at the implementation level concerning institutional coherence, organizational capacity, and whitelist coverage. Pathways for Resolution: A three-track parallel approach encompassing technological empowerment (cross-border data verification platforms and privacy-enhancing technologies), institutional innovation (industry-specific whitelists and sandbox mechanisms), and organizational coordination (regularized dialogue mechanisms). Drawing on the EU-Japan adequacy decision as a reference for a tiered mutual recognition pathway, the approach should commence with industry-level equivalence assessments and progressively expand to rule-level alignment.