King & Wood Mallesons (‘KWM”) values your privacy and is committed to protecting your personal data. The following notice sets out how we collect and use your information, the rights you have in relation your information and the legal basis upon which we rely on to process your information.
Personal data includes any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
Data protection laws set out various grounds on which an organisation may lawfully collect and process your personal data. These include:
(a) Consent
We can collect and process your data with your consent. For example, when we are processing sensitive or special personal data, such as information relating to your health or religious beliefs. In many circumstances, if we rely on your consent as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.
(b) Contractual obligations
In many circumstances, we require your personal data to comply with contractual obligations. For example, we collect your identity and contact information when we verify you as a new client. If you are unable to provide such information to us, we may not be able to perform the contract we have with you or your organisation or enter into a contract with you or your organisation.
(c) Legitimate interests
In many situations, we require your personal data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact on your rights, freedoms or interests. For example, it may be in our legitimate interests to use your personal information for marketing purposes to assist us with the growth of our business.
We may collect information from you online through the use of our blog. The information include but not limited to your name, business email address, job title, organisation name and company address, as you disclosed through subscribing this blog. We consider that the collection of this personal data is necessary to pursue our legitimate interests in a way which might reasonably be expected as part of operating and growing our business and which does not materially impact on your rights, freedom or interests.
We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place appropriate technical, physical and managerial procedures to safeguard and protect your personal data. We regularly monitor our system for possible vulnerabilities and attacks, and we carry out penetration testing to identify ways to further strengthen security.
In some circumstances, you can ask us to delete your data.
To facilitate our global operations, KWM may transfer, store and process your information within our group of law firms around the world.
For those individuals residing in the European Economic Area (EEA), this may sometimes involve the transferring of your personal information out of the EEA. Laws in these countries may differ from the laws applicable to your country of residence. Where we transfer, store and process your data outside of the EEA we have ensured that appropriate safeguards are in place to ensure an adequate level of data protection. This may be an adequacy decision of the European Commission confirming an adequate level of data protection in the respective non-EEA country or an agreement on the basis of the EU Model Clauses (a set of clauses issued by the European Commission). Further information on these EU Model Clauses and the rights they provide to data subjects can be found on the European Commission website.
Please contact us if you require further information on the specific mechanism used by us when transferring your personal data outside of the EEA.
Our blog may contain links to third party websites. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. If you follow a link to any third party website, please be aware that these websites have their own privacy notices or policies and we do not accept any responsibility or liability for their policies.
This Privacy Notice was last updated on 15 June 2018. Previous versions can be obtained by contacting us. Should any substantive or material change be made to this Privacy Notice, we will notify you.
- Introduction
King & Wood (“King & Wood”, “we”, “us”, “our”) is committed to protecting your personal data. Please read this privacy notice carefully as it sets out how and why King & Wood uses your personal data when you access our website, services and/or otherwise engage with us, as well as explaining certain legal rights that you have under data protection laws.
If you have any questions or comments about this privacy notice, please find our contact details in section 10 “How can you contact us?”.
Note that we may change this privacy notice from time to time by updating this page. This privacy notice does not apply to any third-party websites, plug-ins or applications to which you may be directed from our website. Clicking on those links or enabling those connections may allow third parties to collect or share data about you and so we encourage you to read the privacy policies/notices on the other websites you visit. We do not accept any responsibility or liability for the privacy practices of such third parties and your use of them is at your own risk.
- Who are we and who is responsible for your personal data?
King & Wood refers to the network of firms in different jurisdictions which are members of the King & Wood network. It has offices in numerous locations across the world, principally in Asia and North America. Further details can be found on our website. Our contact details can be found in section 10 of this privacy notice.
Typically, the King & Wood firm that is legally responsible for handling your personal data will be the firm in the jurisdiction where you are accessing our website and/or otherwise engaging with us. If you have signed an agreement or carried out cooperation with a specific King & Wood firm, such firm shall be the entity legally responsible for the processing of your personal data.
- What personal data do we collect about you and for what purposes?
We may collect personal data from you or individuals working for your organization in various circumstances, including in the provision of legal services, use of our website, attendance at one of our events and/or where we otherwise engage with you, e.g. to procure a service for King & Wood etc. The personal data that we may collect and the reasons for using it will depend on the nature of your relationship with us but may include the types of information and purposes set out below.
- Contact Information
This includes personal data such as your name, title, position, the company you work for, your postal address, email address and phone number. We may also ask about your relationship to another person, for example to establish any conflict of interest that might exist. We require the above information in order to engage with you for business purposes.
- Identification and Verification
We may ask for your passport or other official photographic document to verify your identity, as well as other information relating to your background such as any directorships/financial interests you have. Aside from the data you provide to us directly, and in accordance with the local laws of the jurisdiction where you are accessing our services, we may also find information about you from other sources, such as from tax authorities, carefully selected third party background screening providers (see section 5 below for more information on King & Wood’s use of third parties), and/or from publicly available registers/websites where you have voluntarily made your personal data available (e.g. LinkedIn). We require this information as part of our business acceptance processes and to comply with our legal obligations to prevent against money laundering, terrorism and fraud.
- Payment details
Where we enter into a contract for our legal services directly with you rather than the corporate entity you work for/are associated with, we will need to collect and use your payment information, including your bank account or credit/debit card details. This type of personal data is processed strictly in accordance with relevant payment card industry standards.
- Meetings/events
We may collect basic contact information from you when you attend a meeting/event hosted at one of our offices. We use this information to identify you for building security and safety reasons, and so that we can invite you to future events/meetings (see section 3(f) on marketing below).
However, you may also wish to inform us of any specific dietary requirements and/or tell us about any disabilities you have so that we can make the reasonable adjustments you require to facilitate your attendance at the meeting/event. In certain jurisdictions, such details fall into the category of personal data that data protection law considers to be inherently sensitive, as it relates to your health/disability and/or potentially your religion (where you request a kosher food option for example). This type of information is purely optional, so you do not have to provide it to us if you do not wish to. If you have a food allergy and choose not to disclose it we cannot be responsible for any harm caused. For more information about the legal bases which we rely on to use this specific type of personal data, please see section 4, “On what legal basis do we use your personal data?” below.
- Automated interactions
As you interact with our website, we may automatically collect personal data from your device by using cookies and other similar technologies. Processing such information is necessary for us to pursue our legitimate interests in improving our website and providing a more relevant service to our clients. This information is not used to develop a personal profile of you. For further details, please see our cookies policy.
- Marketing and information gathered through our website
Certain sections of our website, including our blogs, invite you to request publications, newsletters and alerts, subscribe to receive invitations to events, seminars and webinars, take part in client surveys and to receive King & Wood announcements. If you do so, we will collect some or all of the following information: your name, business email address, job title, organization name and company address. Our systems will recognize you as a user and based on the content you view/request, we will strive to provide material that is relevant to you and your interests. We may also collect this information about you where you have physically attended an event, meeting or seminar hosted by King & Wood, so that we can invite you again in the future.
Note that you can opt out of receiving marketing communications at any time. For further information, please see section 9, “What are your rights over your personal data?” of this privacy notice.
- Recruitment
King & Wood will collect and use your personal data when you apply for a job with us. We may receive information about you through a recruitment agency or directly from you where you complete an online job application form via the careers section of the King & Wood website. The personal data will include information relating to your education, employment history and other background information such as your right to work in the jurisdiction where you are applying to work etc. For further information about how King & Wood collects and uses your personal data in the recruitment context, please see our applicant privacy notice.
- Indirect collection of personal data
Sometimes we may have access to and use personal data of individuals with whom we do not have any direct contact. For example, if we are providing advice to a client relating to the acquisition of another company, we may use personal data relating to the seller’s employees. In circumstances such as these, it may not be appropriate for us to provide the individuals concerned with a privacy notice that sets out how we use their personal data as doing so may breach client confidentiality. Nevertheless, King & Wood handles such personal data in accordance with applicable data protection laws.
- Profiling
The term “profiling” refers to where your personal data is used for solely automated processing to evaluate or predict certain aspects about you without human assessment. King & Wood does not currently do any profiling using personal data. Should King & Wood decide to use completely automated processes in the future, e.g. to market its services more efficiently, we will notify you if it is likely to have a significant effect on you and you will have the right to object to this type of processing (see section 9 “What are your rights over your personal data?” below).
- On what legal basis do we use your personal data?
In some jurisdictions we are required to inform you of the legal basis permitting us to collect and handle your personal data and so we have set out the main legal grounds that King & Wood relies on. In general, we need the above-mentioned personal data because it is necessary in King & Wood’s legitimate interests to provide its services to/otherwise engage with you and to develop its business, but only in circumstances where these interests are not outweighed by the need to protect your privacy.
Alternatively, it may be necessary for King & Wood to collect and use personal data of other third parties to perform a contract with you or your organization. For example, your instruction to us may contain personal data of staff, customers and/or other third parties. Without this information, we cannot enter into the contract.
Otherwise, it may be the case that we rely on the ‘legal obligations’ ground, i.e. it is necessary for King & Wood to collect certain personal data to comply with legal requirements placed on us. For example, in order to comply with anti-money laundering laws, we need to obtain the identity of relevant individuals and conduct certain background checks on them (which could also include sensitive information such as political allegiances or criminal convictions etc.) when we onboard new clients.
If King & Wood cannot lawfully handle personal data on the above or other permitted grounds under data protection laws or where it is mandatory in a particular jurisdiction that we operate in, we may need to get your express consent to be able to do so. This might be the case where King & Wood collects information that the data protection laws of certain jurisdictions consider to be inherently sensitive. For example, where you tell us about your dietary requirements so that we can cater to your specific health or religious requirements, or where you ask us to make adjustments to accommodate your disability etc. Please note that you may withdraw consent at any time after you have given it. This would not affect the lawfulness of King & Wood’s prior use of that data. In certain situations, however, withdrawing consent might impact King & Wood’s ability to provide services to/otherwise engage with you.
- Who do we share your personal data with?
We may share information that you have provided to us as necessary with certain third parties such as service providers acting on our behalf who will use the data to provide the service. These may include insurers, IT service providers, background screening providers, barristers, translators, accountants, tax advisers and catering service providers etc. We will ensure that any third-party service provider that we use commits to an appropriate level of security and confidentiality to protect your personal data.
We may also share your personal data with a purchaser or potential purchaser of our business and in some circumstances, we may have to disclose your personal information for legal or regulatory purposes, such as where a court, the police or other law enforcement agency or regulatory body has asked us for it.
- Is your personal data transferred overseas?
Due to the global nature of King & Wood’s business operations, it may be necessary to send your personal data to other King & Wood offices in another jurisdiction or third parties (as per section 5 “Who do we share your personal data with?” above), unless we have specifically agreed to retain your personal data within a particular jurisdiction. This may be the case where your instructions require an opinion from a local law expert in another jurisdiction, or else because King & Wood has centralized the management/administration of its processes in another jurisdiction for efficiency (for example, our website is hosted on Microsoft Azure servers in Chinese Mainland and Hong Kong SAR).
Some of the jurisdictions where your personal data is transferred have a different standard of data protection than the jurisdiction in which you are situated. However, we have put in place contractual or other appropriate protections to ensure that your information is safeguarded to the same standards globally.
- How do we keep your personal data secure?
We are committed to ensuring that any personal data that we hold about you is kept securely in accordance with our policies and procedures. These include appropriate physical and technological security measures, such as access controls, regular penetration testing of our systems and necessary selection of staff and third-party service providers.
- How long will we keep your personal data?
Your personal data will be retained in line with legal and regulatory retention periods. At the end of any retention period, your personal data will either be deleted in its entirety or anonymized so that you can no longer be identified from that data. We aggregate such anonymized data for statistical analysis and business planning.
- What are your rights over your personal data?
Depending on the jurisdiction where you are based and subject to certain exceptions and limitations you may have various legal rights in relation to your personal data, as set out in this section.
Such rights may allow you to ask King & Wood to:
- provide a copy of your personal data (subject to the privacy rights of other people and the information already provided to you in applicable privacy notices);
- correct any inaccuracies in your personal data by informing us to make the necessary changes;
- modify or withdraw your consent for the collection, use and disclosure of your personal data (see section 4 “On what legal basis do we use your personal data?” above);
- delete your personal data where there is no lawful justification for King & Wood to retain it;
put the processing of your data on hold while, or until such time as:
- King & Wood verifies any inaccuracies in your personal data that you notify us of; or
- we respond to a claim by you that King & Wood’s legitimate interests in processing your personal data are outweighed by your interests in the data not being processed; and
- transfer your personal data to you or another organization in a commonly used electronic format (known as the right to data portability).
You also have the right to object to the processing of your personal information, including in the event that we use it for profiling purposes, where King & Wood does this:
- for the purposes of its legitimate interests or those of a third party; or
- on the basis that it is acting in the public interest; or
- for direct marketing purposes.
If you lodge an objection on the last of these three grounds King & Wood will simply stop processing your personal data for marketing purposes (and any associated profiling). If you lodge an objection on the other two grounds King & Wood will stop processing the relevant data unless we identify compelling legitimate grounds for the processing which override your rights and interests or we need to process the data in connection with a legal claim.
You may exercise or enquire about the above rights by contacting King & Wood’s data protection team (see section 10 “How can you contact us?” below).
- How can you contact us?
We hope this privacy notice has been helpful in setting out the way we handle your personal data and your rights to control it. This privacy notice sets out most of your rights under relevant laws, but not necessarily every right you have.
If you have any concerns, requests related to, among others, the exercise of your rights, complaints or questions that haven’t been covered, please contact us by privacy.officer@cn.kingandwood.com.
- Complaints
You may have a right to make a complaint to the relevant data protection authority (“DPA”) at any time. We would appreciate the chance to understand your concerns in the first instance before you contact the DPA, however.
Click on the relevant jurisdictions below to access the website of the DPA responsible for overseeing that jurisdictions’ data protection compliance:
China Mainland: Cyberspace Administration of China (https://www.cac.gov.cn/)
Hong Kong SAR: Privacy Commissioner for Personal Data (https://www.pcpd.org.hk/english/contact_us/contact_us.html)
Japan: Personal Information Protection Commission (https://www.ppc.go.jp/en/)
North America: The US has various rules that may implicate the collection and use of data in certain circumstances but have not adopted a comprehensive data protection law. Canada has adopted the Personal Information Protection and Electronic Documents Act (PIPEDA). Provincial legislation may offer additional protection for data in that province. For data privacy concerns in Canada, you may contact the Office of the Privacy Commissioner of Canada (OPC) (https://www.priv.gc.ca/).
- Changes to this privacy notice
This privacy notice was last updated in March 2026. We may change this privacy notice from time to time by updating this page.