Notes · November 2026
Hong Kong’s privacy regulator on staff use of AI: what it asks of you.
In March 2025 the Privacy Commissioner published a checklist for organisations on how employees use generative AI. It is guidance rather than law, but it is the clearest statement yet of what the regulator expects — and most firms still have nothing written down.
What the checklist is
A guide to writing an internal policy on staff use of generative AI, published by the Office of the Privacy Commissioner for Personal Data on 31 March 2025. It sits alongside the Commissioner’s June 2024 model framework for organisations procuring and using AI, and ties back to the existing Personal Data (Privacy) Ordinance.
When it was released, the Commissioner’s office cited a finding that fewer than 30 per cent of Hong Kong organisations had a generative AI policy. In my experience with smaller firms, that is generous.
What a policy is expected to cover
- Scope of use — which tools are permitted, and for what kinds of work
- Personal data — what may and may not be put into an AI tool, and how outputs containing personal data are handled and kept
- Lawful and ethical use — including checking outputs for accuracy and bias before they are relied on
- Data security — approved accounts and devices, and reporting when something goes wrong
- Consequences — what happens if the policy is breached
- Support — training for staff, someone to ask, and a way to raise concerns
The practical version for a 20–200 person firm
You do not need a thirty-page document. You need four things people will actually follow:
A list of approved tools
On business accounts, with training on your data switched off.
A one-page rule on data
What can go in, and what never goes in — client personal data, HR files, pricing, anything under a confidentiality agreement — unless the tool is approved for it.
A checking rule
Where a person must check AI output before it leaves the building or is relied on.
Twenty minutes of training
Built around the tasks your people actually use AI for, not a slide deck about risk.
The best policies make the approved route easier than the workaround. If the approved tool is worse than the free one on someone’s phone, people will use their phone.
Not legal advice. This is an operational summary. Read the Commissioner’s checklist itself, and take legal advice on anything specific to your business.
Sources: PCPD, “Checklist on Guidelines for the Use of Generative AI by Employees” (31 March 2025); PCPD, “Artificial Intelligence: Model Personal Data Protection Framework” (June 2024).
Staff already using AI without a policy?
That is the normal starting point. A short call is enough to scope what you need.