Aureus Sovereign › Briefings

AI and the PDPO: six questions to be able to answer

Hong Kong has no AI statute. It has a data protection ordinance that applies to AI exactly as it applies to everything else, which is a narrower and more answerable problem.

Published 28 September 2026

The short answer. There is no separate regime to learn. The Personal Data (Privacy) Ordinance regulates what an organisation does with personal data, and submitting personal data to an AI service is a thing done with personal data. The questions below are the ordinary ones, asked about a new destination. An organisation that can answer them is in a defensible position; one that cannot has a gap that existed before AI arrived and has now become visible.

Two points of vocabulary first, because they do more work than anything else here.

Personal data is data from which it is practicable to identify a living individual. That is broader than a name. A customer reference joined to a transaction history, a CCTV still, a CV, a performance note, a recorded voice — all of it qualifies. The frequent error is to assume that material is out of scope because no name appears in it.

A data user is whoever controls the collection, holding, processing or use of the data. Engaging a vendor does not transfer that status. The organisation that decides personal data goes into a service remains answerable for it; the vendor is an agent, and the organisation is responsible for what its agent does.

That second point is the one that determines everything below. The service provider is not the party the regulator or the data subject will approach.

1. Was this data collected for a purpose that includes this

Data collected for one purpose may generally be used for that purpose and directly related ones, and a materially new use ordinarily needs the individual's consent.

So the question is not whether the organisation may use AI. It is whether the specific use is what the individual was told about when the data was collected. Summarising customer correspondence to answer that customer's query is plainly within the original purpose. Feeding the same correspondence into a system to score customers for a product they never asked about is a different use, and the fact that a machine performs it changes nothing about that analysis.

The practical test: read the Personal Information Collection Statement the individual was actually given, and ask whether the intended use is recognisable in it.

2. Is more being submitted than the task needs

Collection should be adequate but not excessive for the purpose. The way this goes wrong with AI is specific and almost universal: it is easier to paste the whole document than the relevant paragraph, and easier to attach the full export than the three columns that matter.

Nobody sets out to over-collect. They set out to save a minute.

This is the single highest-value habit to establish early, because it is cheap, it requires no technical knowledge, and it reduces every other exposure on this page at once. Less submitted is less retained, less transferred, and less to explain.

3. Where is it going, and has anyone said so

Material submitted to a service is processed somewhere, under some other jurisdiction's law. Whether the organisation's own privacy notices and customer agreements have ever contemplated that transfer is a question for whoever drafted them.

The specific things worth establishing: which jurisdiction processing occurs in, whether the agreement permits the provider to change it without notice, whether any onward transfer to a sub-processor occurs, and whether the notices given to individuals are consistent with all three.

4. What the vendor is contractually obliged to do

Where processing is entrusted to an agent, the data user is expected to use contractual or other means to prevent excess retention and to guard against unauthorised access. In practice that means the protection is whatever the agreement says, and the agreement is usually available to read.

• Is submitted content excluded from training the provider's models? Business and enterprise tiers commonly exclude it. Consumer tiers commonly do not, and a personal account used for work sits under consumer terms whoever is typing.
• What is the retention period, and can it be set to zero?
• Who at the provider may read it, and in what circumstances?
• What is promised on security, and what is merely described? These read similarly and are not the same.

5. Can the organisation still answer a data access or correction request

An individual may ask what personal data an organisation holds about them, and may ask for it to be corrected. Both rights are unaffected by where the data has been sent.

Two AI-specific complications are worth anticipating. If material has been submitted to an external service and retained there, the organisation should be able to say what is held and to have it produced or deleted — which is a question about the agreement, asked before it is needed rather than during a forty-day response window. And if a machine-generated output about an individual has been retained — a summary, a score, an assessment — that output is itself personal data about them, and an assertion that it is wrong is a correction request like any other.

6. Who decided, and is it written down

Every question above has an answer. What distinguishes an organisation that is in a good position from one that merely happens not to have had a problem is whether the answers were arrived at deliberately and recorded.

The artefact does not need to be elaborate. A short internal note stating which services are permitted, on which agreements, for which categories of material, with which categories excluded outright, is the difference between a considered position and an accident that has not happened yet.

The disproportionately common error

Staff using personal accounts for work. It is well intentioned — someone finds the tool useful and pays for it themselves — and it defeats every control on this page simultaneously: consumer terms rather than the negotiated agreement, no retention control, no visibility of what was submitted, and an organisation that cannot answer an access request about data it does not know was sent.

The remedy is not prohibition, which drives it underground. It is providing an approved route good enough that the unapproved one has nothing to recommend it.

This briefing sets out questions, not requirements. What the Personal Data (Privacy) Ordinance, a listing obligation or a contractual undertaking requires of a particular organisation is a matter for that organisation's own advisers.