Hong Kong’s Office of the Privacy Commissioner for Personal Data (“PCPD”) recently published findings on artificial-intelligence (“AI”) compliance checks followed by the Artificial Intelligence: Model Personal Data Protection Framework – Protecting Personal Data Privacy in the Use of Agentic AI, a supplement to the PCPD’s Model Personal Data Protection Framework. The legal starting point for Hong Kong AI privacy and AI data protection is the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”), applied through its six Data Protection Principles. Those principles govern collection, retention, use, security, transparency and access to personal data. The Hong Kong Government has confirmed that the PDPO applies to AI development and use, and that the PCPD may take adherence to its guidance into account when considering compliance.
There is an important distinction between legal duties under the PDPO and the means by which an organisation demonstrates that it has taken them seriously. PCPD’s Model Framework and its employee checklist for generative AI are not a free-standing AI statute – they are, however, a clear indication of the governance, documentation and operational controls that the regulator regards as prudent.
Hong Kong AI privacy: the 2026 PCPD checks
The PCPD’s May 2026 compliance-check exercise reviewed 60 organisations. Fifty-seven used AI, and 29 of those organisations used three or more different AI systems. Only 24 of the 57 AI users collected or used personal data through those systems. That denominator matters. The detailed privacy findings are not a survey of every organisation reviewed, they concern the subset whose AI use engaged personal data.
Within that group, all 24 organisations supplied a Personal Information Collection Statement (“PICS”) on or before collection. Yet only seven expressly referred to AI. The same proportion appeared in the PCPD’s 2025 exercise. A notice does not cease to be legally adequate simply because it does not use the expression “AI”. Nevertheless, the result presents a practical transparency question. Would an individual reading the notice understand the material role that automated tools play in processing their information?
The more encouraging findings were equally instructive. Twenty-three of the 24 organisations tested their systems before implementation. Nineteen conducted privacy impact assessments, and the same number had a formal AI governance structure. Twenty-two had a data-breach response plan, while 15 undertook regular audits or independent assessments. The PCPD found no PDPO contravention in the exercise. That finding should not, however, be misunderstood as a regulatory endorsement of every system examined or as a general certification of compliance. Notably, only nine of the 22 breach plans specifically addressed AI incidents.
For boards and senior management, the message is straightforward. A conventional privacy policy and a general cyber-security framework will rarely be sufficient evidence of PDPO compliance where personal data is used to train, configure, prompt or operate an AI system. The organisation must be able to explain what it has deployed, what data is involved, which supplier has access, how the output is reviewed and what happens when the system fails.
PDPO compliance and AI governance in practice
The PCPD’s Model Framework is useful because it translates broad privacy principles into an operating structure. It addresses four connected matters: AI strategy and governance; risk assessment and human oversight; model customisation and system management; and communication with affected stakeholders. In practical terms, this means that AI risk cannot be left solely to the technology team. Accountability must sit with individuals who have the authority to set use cases, approve suppliers, allocate resources and escalate material concerns.
The question is not whether every application should be subject to the same degree of scrutiny. A low-risk drafting or translation tool should not be governed in the same way as a system that influences access to credit, employment, insurance or another consequential service. The relevant point is proportionality. A business should be able to show why the data use is necessary, how it complies with the PDPO, which risks were considered, and why the chosen safeguards are appropriate.
Five AI governance controls that create reliable evidence
- Keep a live AI inventory. The register should identify the business purpose, system owner, model or supplier, data categories, prompt and retrieval sources, hosting location, retention position, training rights, output use, decision impact and applicable controls. This makes the PDPO analysis visible and connects it to procurement, information security and internal audit.
- Introduce a documented risk gate. Before launch, and again when there is a material change, the organisation should assess data sensitivity, data quality, security, foreseeable harm, accuracy, fairness, legal requirements and the necessary degree of human oversight. The Model Framework encourages comprehensive risk assessment and privacy impact assessments where appropriate. It does not create an automatic statutory impact-assessment threshold, but it provides a sound means of recording a proportionate PDPO decision.
- Govern the interface with the model. Data minimisation and purpose discipline are most effective before information is entered into a tool or connected to an internal knowledge base. Organisations should establish what the provider may retain, inspect or use for training. This is particularly important when implementing a generative AI policy. The agreed position should be reflected in contractual terms, settings, access rights, prompt restrictions, deletion arrangements and processor safeguards.
- Make human oversight meaningful. The PCPD’s framework distinguishes between human-out-of-the-loop, human-in-command and human-in-the-loop models. The label is less important than the reality. A reviewer must have sufficient information, authority, time and training to identify an error and change the outcome. A person who merely confirms an AI output without understanding or questioning it is unlikely to provide an effective safeguard.
- Test transparency and incident readiness. Privacy notices should describe relevant AI processing in language that affected individuals can understand. The Model Framework recommends disclosure, explanations, feedback channels and, where appropriate, consideration of opt-out mechanisms. Incident planning should also cover unauthorised prompts, leakage, model failure and anomalous outputs. Periodic testing should confirm that the inventory, supplier configuration, working practices and written policy remain aligned.
Cross-border AI privacy: a short international comparison
International regimes do not alter the PDPO. They do, however, help distinguish a genuinely portable control from a requirement that is specific to another market.
The European Union offers the clearest legal contrast. The binding, risk-based EU AI Act operates alongside the GDPR, rather than replacing it. Compliance with the AI Act does not itself provide a lawful basis for personal-data processing. The European Commission’s implementation guidance describes an extensive set of controls for high-risk systems, including risk management, data governance, logging, technical documentation, human oversight, robustness, cyber-security and accuracy. A Hong Kong group with an EU nexus will therefore need a dual analysis: one under the GDPR and another under the AI Act. The practical lesson is to classify the use case at the outset and calibrate controls to the actual impact of the system.
The United Kingdom is a second useful comparator because its AI privacy obligations remain rooted in a statutory, lifecycle-based data-protection regime. The Information Commissioner’s Office applies the UK GDPR and Data Protection Act 2018 to AI across training, testing, deployment and inference, with particular emphasis on accountability, privacy by design, fairness, transparency and data protection impact assessments. Its AI guidance is being reviewed following the Data (Use and Access) Act 2025. That legislation now frames safeguards for certain significant decisions made solely by automated processing without meaningful human involvement, including information rights, representations, human intervention and the ability to contest a decision. Hong Kong’s Model Framework addresses many comparable operational questions, but it is guidance rather than a source of equivalent statutory automated-decision rights.
Two further points are worth retaining. In the United States, the Federal Trade Commission has made clear that AI businesses remain exposed where their representations about training, retention, confidentiality or secondary data use are inaccurate or incomplete. Its guidance for AI companies is a reminder that product settings, supplier terms and public-facing privacy statements must tell a consistent story. In Australia, the Office of the Australian Information Commissioner treats AI inputs and outputs -including inaccurate or artificially generated information about an identifiable person – as potential privacy issues. Its guidance on commercially available AI products recommends a cautious approach to entering personal information, particularly sensitive information, into public generative-AI tools.
A proportionate route to durable AI governance
The appropriate objective is not zero-risk AI. It is a governance framework that can withstand scrutiny: one which shows what the organisation uses, why the data handling is appropriate, who is accountable, what the supplier may do, how errors are detected and how concerns may be raised.
A focused legal review is often most valuable before an organisation launches or materially changes AI that uses sensitive or high-volume personal data, affects eligibility or pricing, monitors employees, supports a public-facing chatbot, involves model training or fine-tuning, or gives a third party retention or training rights. The same applies where confidential or legally privileged material, cross-border deployment, or overlapping overseas regimes are involved. In those circumstances, a considered review can align the use case, privacy notices, contractual arrangements, security architecture and incident plan with the PDPO and any applicable external regime.
Hugill & Ip advises on privacy governance, technology risk, commercial arrangements and dispute-sensitive issues arising from AI deployment. For a focused review of an AI use case, supplier arrangement or cross-border rollout, please contact our team.
This article provides general information. It is not legal advice. Its application will depend on the facts, the organisation and technologies involved, and potentially applicable laws, contractual terms and professional duties.
