Hong Kong — PDPO AI Guidance (PCPD): AI Compliance Requirements
Hong Kong's PCPD published two distinct AI-relevant documents: the "Guidance on the Ethical Development and Use of Artificial Intelligence" (August 2021, aimed at AI developers/vendors) and the "Artificial Intelligence: Model Personal Data Protection Framework" (11 June 2024, aimed at organizations procuring/implementing AI) — both non-binding guidance under the Personal Data (Privacy) Ordinance (PDPO), not new binding statutory obligations. Together they recommend AI accountability frameworks, transparency to data subjects, ethical AI principles, and PDPO-compliant data governance for AI development and deployment. PCPD has now run TWO rounds of AI compliance checks: 60 organizations Feb-May 2025 (no PDPO contraventions found) and a SECOND round launched January 2026, results published 2026-05-19 (95% of the checked organizations used AI in daily operations, over half using 3+ AI systems; again NO PDPO contravention found, with PCPD flagging agentic AI as an emerging risk area) — see recentGuidance for both. CYCLE 19 (2026-08-22): PCPD is separately developing a proposal to give itself direct administrative-fine sanctioning power for the first time (a fundamental shift from the current criminal-conviction-only enforcement model) — not yet enacted, no confirmed timetable as of mid-2026.
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
June 1, 2024
PDPO does NOT currently have administrative-fine power (a reform proposal to add one is pending, not yet enacted — see summary). Criminal penalties apply instead: non-compliance with a PCPD enforcement notice carries HKD 50,000 + up to 2 years' imprisonment (first conviction), HKD 100,000 + up to 2 years (repeat conviction), plus a further HKD 1,000/day for a continuing offense. Separately, the AGGRAVATED doxxing offense (PDPO s.64(3C), disclosure causing "specified harm") carries up to HKD 1,000,000 and 5 years' imprisonment — a narrower, more severe tier, not the general AI-processing-violation exposure.
What Your Business Must Do
2 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
AI Accountability Framework (PCPD Guidance)
High PriorityDesignate an AI governance owner, conduct AI risk assessments, document training data sources and model logic, and implement audit processes — as required by PCPD AI guidance.
AI Transparency for Hong Kong Data Subjects
Medium PriorityNotify HK individuals when AI processes their data for profiling, automated decisions, or significant analysis. Include AI use in your privacy notice.
Who Does This Apply To?
Applies to any organisation deploying AI systems in Hong Kong or processing the personal data of HK residents through AI — the PCPD enforces the Personal Data (Privacy) Ordinance (PDPO) and has published two non-binding AI guidance documents (2021 ethical-development guidance for AI vendors; 2024 procurement Model Framework for AI-deploying organizations). In scope: any organisation deploying AI (should establish an AI accountability framework — designate an AI governance owner, conduct AI risk assessments, document training-data sources and model logic, and implement audit processes), and AI systems that profile individuals or make automated decisions (data subjects should be notified). CYCLE 5 (2026-08-22): PCPD's own May 2025 compliance-check exercise across 60 organizations found NO PDPO contraventions in AI practices reviewed — there is no confirmed AI-specific PCPD enforcement action against a named respondent as of this cycle (see enforcementActions). Maximum exposure: HKD 1,000,000 (~USD $128,000) administrative fines, with criminal prosecution for repeated offences — this is the general PDPO ceiling, not an AI-specific penalty tier.
Recent Regulatory Guidance
PCPD — Guidance on the Ethical Development and Use of Artificial Intelligence (August 2021)
PCPD's foundational AI ethics guidance, aimed primarily at organizations that develop and use AI systems involving personal data. Recommends three core data-stewardship values and seven internationally-recognized ethical AI principles. Complements the later 2024 procurement-focused Model Framework.
PCPD — Artificial Intelligence: Model Personal Data Protection Framework (11 June 2024)
PCPD's first guidance document targeted specifically at organizations procuring, implementing, and using AI systems (as distinct from the 2021 guidance aimed at AI vendors/developers) — establishing accountability requirements: designate an AI governance owner; conduct AI risk assessments and document training data sources and model logic; implement audit processes; notify data subjects when AI processes their personal data for profiling or automated decisions; publish an AI transparency statement.
PCPD — Compliance Checks on 60 Organisations to Ensure AI Security (8 May 2025)
Verified this cycle via direct WebFetch of the PCPD press release: between February and May 2025, PCPD conducted compliance checks on 60 local organizations across sectors. 48 (80%) used AI operationally; of the 24 that collected personal data through AI, all reviewed organizations had implemented appropriate security measures, 79% had specified data-retention/deletion timelines, 79% had established AI governance structures, 96% conducted pre-implementation reliability/fairness testing, and 83% performed privacy impact assessments. PCPD found NO PDPO contraventions in the AI practices reviewed.
PCPD — Second Round of AI Compliance Checks Completed (19 May 2026)
PCPD launched a second round of AI compliance checks in January 2026 (results published 2026-05-19): of the organizations checked, 95% used AI in day-to-day operations, with over half using three or more AI systems (a marked increase in AI adoption density versus the 2025 round). PCPD again found NO PDPO contravention. PCPD flagged agentic AI specifically as an emerging risk area and recommended governance structures, privacy impact assessments, AI audits, staff training, and incident-response plans for agentic AI deployments. This is now the most current, real, AI-specific PCPD publication as of this cycle.
Frequently Asked Questions
Does Hong Kong — PDPO AI Guidance (PCPD) apply to my business?
Hong Kong's PCPD published two distinct AI-relevant documents: the "Guidance on the Ethical Development and Use of Artificial Intelligence" (August 2021, aimed at AI developers/vendors) and the "Artificial Intelligence: Model Personal Data… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under Hong Kong — PDPO AI Guidance (PCPD) is: PDPO does NOT currently have administrative-fine power (a reform proposal to add one is pending, not yet enacted — see summary). Criminal penalties apply instead: non-compliance with a PCPD enforcement notice carries HKD 50,000 + up to 2 years' imprisonment (first conviction), HKD 100,000 + up to 2 years (repeat conviction), plus a further HKD 1,000/day for a continuing offense. Separately, the AGGRAVATED doxxing offense (PDPO s.64(3C), disclosure causing "specified harm") carries up to HKD 1,000,000 and 5 years' imprisonment — a narrower, more severe tier, not the general AI-processing-violation exposure.. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with Hong Kong — PDPO AI Guidance (PCPD)?
The 2 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://www.pcpd.org.hk/english/resources_centre/publications/files/ai_guidance_e.pdfLast updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan