Matters are settled in the Labour Tribunal (“LT”) all the time. Where an agreement is reached, the parties often document the settlement terms in a settlement agreement, and this usually brings the proceedings to an end. However, as demonstrated in Lemon & Sons Global Ltd v Chan Hoi Ling [2026] HKCFI 775, settling a LT claim does not necessarily prevent a party from bringing other claims even if they arise out of the same factual matrix. Of course, this will depend on the scope of the earlier settlement terms and whether there has been any prior determination of the issues in question. What happened The employee was employed as a senior accountant (the “Employee”) at the company (the “Company”). On 2 February 2024, the Employee resigned giving one month’s notice. A few days later, the Employee walked out of her employment claiming that she had been constructively dismissed as a result of the Company’s alleged “ill-treatment”. The Employee contended that she had been ostracised at work and verbally abused by her manager. She also received two warning letters from the Company which allegedly contained false accusations. The Employee sued the Company for outstanding wages, rest day pay, annual leave pay and reimbursement of expenses (the “1st LT Claims”). It is unclear why the Employee did not pursue a claim for constructive dismissal, despite that being the purported basis for her departure prior to the expiry of the notice period. In any event, the parties reached a “full and final settlement” of the 1st LT Claims, which was reflected in a consent order made by the LT (the “2024 Settlement”). Subsequently, the Company brought a wrongful termination claim against the Employee in the LT seeking payment in lieu of notice (the “PILON Claim”). The LT ruled in the Company’s favour. The Employee then applied for leave to appeal to the Court of First Instance (CFI). One of her grounds of appeal was that the parties had reached the 2024 Settlement and so the Company was precluded from bringing the PILON Claim. Decision 1. Can the Company pursue the PILON Claim, having reached the 2024 Settlement? Yes. The 2024 Settlement was confined only to the 1st LT Claims and does not cover any PILON Claim. As such, the doctrine of “res judicata” (i.e. the same cause of action cannot be relitigated against the same party once finally determined) did not apply. Further, even if the Company’s PILON Claim arose from the same issues of fact as the 1st LT Claims, there had been no prior determination of such issues given that the 1st LT Claims were resolved by a settlement. As such, the doctrine of “issue estoppel” (which precludes a party from re-litigating an issue of fact or law that has already been determined) was also not engaged. In other words, the 2024 Settlement did not bar the Company from pursuing other claims beyond the scope of that settlement. 2. Was the Employee constructively dismissed for “ill-treatment”? No. The Presiding Officer at the LT had held that in considering whether there was any “ill-treatment”, the conduct complained of must have a sufficiently serious impact on the Employee’s mental or physical well-being. However, the Employee failed to provide any concrete evidence in support of her allegations. Mere disagreement with the contents of the warning letters, including the Company’s assessment of her work performance, would not suffice to show ill-treatment. The CFI upheld these findings and found that there was no error of law or facts on the part of the Presiding Officer. Accordingly, the Employee’s application for leave to appeal was dismissed. Key takeaways for employers While the narrow and specific scope of the 2024 Settlement worked in the Company’s favour on this occasion (thereby enabling their subsequent PILON claim), the absence of any global settlement meant that the Company could have been exposed to other claims from the Employee that fell outside the scope of the 2024 Settlement. When preparing any separation or settlement agreement, employers should ensure that the scope of the release accurately reflects their commercial intentions. Where the objective is to achieve a full and final settlement of all claims arising from the employment relationship and the cessation of that employment, this must be clearly reflected in a carefully drafted agreement containing a sufficiently broad release of claims provision. The judgment (Chinese only) is available at the Judiciary’s website.

The Cyberspace Administration of China (CAC) and the Ministry of Public Security jointly issued the Provisions on the Simplified Measures for Personal Information Protection by Small-scale Personal Information Processors (the “Provisions”), on 22 July 2026. They will come into force on 1 September 2026. The Provisions were introduced pursuant to Article 62 of the Personal Information Protection Law (PIPL), which authorises the CAC to co-ordinate with relevant government departments in developing specific personal information protection rules and standards for small-scale personal information processors. Since the PIPL came into effect on 1 November 2021, it has imposed a comprehensive set of compliance obligations on personal information processors. These include requirements relating to transparency and consent, periodic compliance audits, personal information protection impact assessments (PIPIAs) and cross-border data transfer obligations. For organisations engaged in only limited personal information processing activities, these requirements may in some cases result in a disproportionate compliance burden. The Provisions seek to reduce the compliance burden on smaller processors without lowering the underlying standards of personal information protection. The objective is to support innovation and business development among small and micro enterprises, sole proprietors and other small businesses. With upcoming implementation of the Provisions – together with the proposed Provisions on Personal Information Protection for Large-Scale Personal Information Processors (currently under public consultation) and other planned supporting measures such as the Data Security Technology Guide on Personal Information Protection for Small-Scale Personal Information Processors – the Chinese Mainland’s personal information protection framework is expected to become increasingly sophisticated. The regulatory approach is gradually shifting away from a uniform “one-size-fits-all” model towards a more nuanced and tiered regime based on the scale of personal information processing activities. This series of articles will examine key features of the Provisions, including, Qualification criteria for a “small-scale personal information processor” and the scope of application of the regime Simplified compliance measures available to such processors Relevant supervisory and enforcement arrangements Helping organisations assess their position under the new regime, this first article in the series examines the qualification criteria for “small-scale personal information processors” and scope of application of the Provisions. Is your organisation considered a small-scale personal information processor? Small-scale personal information processors Definition Under the PIPL, although certain categories of personal information processors are subject to additional obligations in specific circumstances11, the law generally does not distinguish between different types of personal information processor at the level of legal obligations. As a result, the PIPL’s requirements apply broadly to all personal information processors. Although Article 62 of the PIPL authorises the CAC and other competent authorities to formulate specific personal information protection rules and standards for small-scale personal information processors, the PIPL itself does not define the term “small-scale personal information processor”. Article 2 of the Provisions addresses this gap by introducing, for the first time, a clear threshold. A small-scale personal information processor is defined under Article 2 of the Provisions as a personal information processor that processes the personal information of fewer than 100,000 individuals22. The classification is based on the number of individuals whose personal information is processed, rather than the processor’s revenue, headcount or asset size. In practical terms, a personal information processor will qualify as a small-scale processor if it processes the personal information of fewer than 100,000 individuals. If that threshold is exceeded, the processor will not qualify. Accordingly, an internet start-up with only a small number of employees but a large user base may not fall within the scope of the Provisions. Conversely, a manufacturing company with a relatively large workforce but which mainly processes personal information relating to employees may qualify as a small-scale processor. Organisations should therefore not assume they qualify simply because they are categorised as a “micro”, “small” or “medium-sized” enterprise under other regulatory or statistical classifications33. Territorial scope The Provisions apply only to small-scale personal information processors located within the People’s Republic of China (PRC) when carrying out personal information protection activities44. Where the relevant entity is located outside the PRC, the Provisions do not apply, regardless of the scale of the personal information processing activities undertaken. Such entities must instead comply with the PIPL and other applicable requirements, including the principle of international co-operation and mutual recognition set out in Article 12 of the PIPL55. Practical considerations The threshold of fewer than 100,000 individuals is based on the number of natural persons whose personal information is being processed by the processor at the time of assessment. Individuals whose personal information has already been deleted are not counted. Although the threshold itself is clear, questions may arise as to how the number of individuals should be calculated in practice66. In our view, the calculation should be approached as follows: All categories of data subjects should be included. The calculation should cover all natural persons whose personal information is processed by the organisation, including customers and their contacts, employees, job applicants, suppliers and supplier contacts, former employees, visitors and any other categories of data subject. The focus is on individuals, not data records. The relevant measure is the number of natural persons, rather than the number of personal information records. Accordingly, an individual should be counted only once, even if their personal information is stored across multiple systems or processed for different purposes. Deleted data is excluded, but retained data remains relevant. If the organisation no longer actively uses an individual’s personal information but continues to retain it, that individual should still be counted. An individual should only be excluded once all their personal information has been permanently deleted.Similarly, where personal information has been irreversibly anonymised so that it no longer constitutes personal information under the PIPL, the relevant individual should no longer be included in the calculation. Under the Provisions, the number of individuals whose personal information is processed is the key criterion for determining whether an organisation qualifies as a small-scale personal information processor. Organisations should therefore establish a monitoring mechanism to regularly track the number of individuals whose personal information they process. Where that number approaches the 100,000-person threshold, they should begin preparing to transition to the compliance framework applicable to general personal information processors.