First published version.
This is part of our work on AI Solutions.
In our view, AI governance names who may use AI, which work it may handle, which records the workflow keeps and where each job needs approval. Hong Kong's Personal Data (Privacy) Ordinance sets duties for data users handling personal data. Guidance from the Office of the Privacy Commissioner for Personal Data (PCPD) recommends ways to govern AI involving personal data and staff use of generative AI. Each check names its source; your legal adviser can assess which duties apply to you.
Under each check, 'Our check' is A2FF's suggested internal test, not a legal requirement.
For AI involving personal data, the PCPD's Model Framework says an internal AI governance structure "should be established"; in its example, a C-level executive leads a cross-functional team.
The Model Framework (June 2024) says an AI governance structure "may include" a governance committee that reports to the board, and that a "C-level executive" should be designated to lead the cross-functional team.
Our check: you can name the person, and every new AI use goes through them.
Source (PCPD guidance): "Artificial Intelligence: Model Personal Data Protection Framework", June 2024 [2].
Assess the risks of each AI use involving personal data, the PCPD advises, and match human oversight to them.
The Model Framework says "human actors should be held accountable for the decisions and output made by AI". It adds that a high-risk system should take a "human-in-the-loop" approach.
Our check: each AI use has a written risk level and a named person who reviews its output.
Source (PCPD guidance): Model Framework, Part II and paras 12, 31 and 32 [2].
The PCPD's Model Framework says organisations "should ensure compliance with the requirements under the Personal Data (Privacy) Ordinance" when handling personal data in "procuring, implementing and using AI solutions".
The Ordinance's Schedule 1 holds six Data Protection Principles, which the Model Framework says "represent the core requirements of the PDPO". Three apply here:
Our check: each approved AI tool has a written list of the data it may and may not see.
Source (law): Personal Data (Privacy) Ordinance, Cap. 486, Schedule 1 [1]; PCPD Model Framework, para 8 [2].
The PCPD's March 2025 checklist helps a company write down which generative AI tools staff may use, what they may put in and what they may do with the output.
On input, it says to give "clear instructions on the types and amounts of information that can be inputted into Gen AI tools". Its practical tips include "Transparency: Regularly communicate the policies or guidelines to employees" and "Training and resources: Educate employees on how to use Gen AI tools effectively and responsibly".
Our check: staff can find the policy and the list of approved tools, and have had training on both.
Source (PCPD guidance): "Checklist on Guidelines for the Use of Generative AI by Employees", March 2025 [3].
The PCPD's checklist suggests a staff AI policy cover "Response to AI incident and data breach incident".
The PCPD's 2026 compliance checks covered 60 organisations, not Hong Kong companies in general. Of the 22 organisations with data breach response plans, 9 (around 41%) "specifically addressed AI-related data breach incidents".
Our check: your breach response plan says who acts first when a leak comes through an AI tool.
Source (PCPD guidance): PCPD checklist [3]; PCPD media statement on compliance checks on 60 organisations, 19 May 2026 [4].
The PCPD recommends openness with staff, customers and others affected about where a company uses AI.
The Model Framework says a company's "use of AI should be transparent to stakeholders". Where personal data are involved, it notes that companies "must communicate the required information" under the privacy law, such as the purpose the data are used for. Beyond that, it says companies "should consider" "clearly and prominently disclosing the use of AI systems unless the use is obvious in the circumstances and context".
Our check: your privacy notice and any customer-facing AI tool say where AI is used.
Source (PCPD guidance): Model Framework, Part IV, paras 51 to 53 [2].
The 2026 Policy Address announced the creation of a Commissioner for AI post under the Digital Policy Office. It also announced AI Agent safety-management guidelines that the Government will promulgate, in collaboration with the Hong Kong Artificial Intelligence Research and Development Institute, "applicable to society at large next year".
The Model Framework calls itself "a set of recommendations on the best practices" for organisations using AI that involves personal data. It also says organisations "should ensure compliance with the requirements under the Personal Data (Privacy) Ordinance", including the six Data Protection Principles. The legal duties come from the Ordinance, so ask your legal adviser how both apply to you.
The HKMA circular of 19 August 2024 is addressed to authorized institutions, and the SFC circular of 12 November 2024 to licensed corporations. The SFC circular's fourth core principle is "Third Party Provider risk management". In our view, a company that supplies AI services to licensed corporations may come across those expectations through its clients' contracts. Your legal adviser decides whether either circular bears on you.
Yes. Two that a private company can use are the PCPD's "Artificial Intelligence: Model Personal Data Protection Framework" (June 2024), for organisations using AI that involves personal data, and the Digital Policy Office's Ethical AI Framework. The DPO says its framework was originally developed to assist government bureaux and departments and "is also applicable to other organisations in general". Whoever handles legal and compliance decides how far to follow either.
Checked against the issuer's page on 4 October 2026.
Tell us the AI job you have in mind. We will test it against the six checks for whoever handles legal and compliance to review, then build the AI policy, risk register and owner model they confirm into the workflow.
Talk to us about AI Solutions