Skip to main content

    AI by country · East Asia

    AI in Hong Kong: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Hong Kong know before starting with AI?

    Hong Kong has no dedicated AI law as of 29 October 2026. The Personal Data (Privacy) Ordinance (PDPO) is the law that applies when AI uses personal data, and the Privacy Commissioner and the Digital Policy Office have issued non-binding AI guidance. A company should set an AI policy for staff, decide what personal data may go into AI tools, and secure that data.

    At a glance

    Hong Kong at a glance

    Key facts about Hong Kong
    Data protection lawPersonal Data (Privacy) Ordinance (Cap. 486), passed 1995, in effect since December 1996
    RegulatorOffice of the Privacy Commissioner for Personal Data (PCPD)
    AI policyNo dedicated AI law as of 29 October 2026. PCPD Model Framework (2024) and DPO Generative AI Guideline (2025) are guidance
    Time zoneHKT, UTC+8 (India is 2.5 hours behind)
    CurrencyHKD (Hong Kong dollar)
    Business languageChinese (Cantonese) and English

    Why now

    Why Hong Kong is worth watching

    Each point links to the document it comes from.

    • The PCPD published its Artificial Intelligence: Model Personal Data Protection Framework on 11 June 2024 for organisations that buy, implement and use AI.[2]

    • On 31 March 2025 the PCPD published a checklist to help employers write rules for staff using generative AI at work.[3]

    • The Digital Policy Office released the Hong Kong Generative AI Technical and Application Guideline on 15 April 2025 for developers, service providers and users.[4]

    • The PCPD runs a Safeguarding Personal Data AI Sandbox and a Best AI Governance Award, listed on its AI page.[6]

    • Reporting a data breach to the PCPD is still voluntary, which puts the burden on each company to judge when to tell the regulator.[5]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Personal Data (Privacy) Ordinance (Cap. 486): data protection principles

    In force1995Data may only be collected for a lawful, directly related purpose, and using it for a new, unrelated purpose needs the person's express and voluntary consent (DPP1 and DPP3). This matters when reusing customer data to train or feed AI. Data users must protect data and, when they use a processor such as an AI vendor, must ensure by contract that it meets the security and retention rules (DPP2 and DPP4).[1]

    Personal Data (Privacy) Ordinance: enforcement, direct marketing and erasure

    In force1995Breaking a principle is not itself an offence, but the Commissioner can issue an enforcement notice, and ignoring it can bring a fine of up to HK$50,000 and two years in prison. Using personal data for direct marketing needs explicit consent, and failing to erase data no longer needed can bring a fine of up to HK$10,000 (section 26). People can also sue for damage.[1]

    Where AI fits first

    Where AI fits first

    Banking and finance

    Document review, compliance checks and customer service in Cantonese and English, with staff checking outputs.

    The PCPD Model Framework recommends a risk-based approach with human oversight scaled to the risk of each AI use. Financial regulators may have their own expectations, which we did not review here.[2]

    Professional services

    Drafting and summarising documents with generative AI under a written staff policy.

    The PCPD checklist suggests rules on permitted tools, what data may be entered, checking outputs for accuracy and bias, and labelling AI output.[3]

    Retail and marketing

    Product descriptions, customer segmentation and campaign drafts.

    Using personal data for direct marketing needs informed, explicit consent under Part 6A of the PDPO; silence is not consent.[1]

    Technology providers

    Building generative AI tools for local businesses.

    The DPO guideline covers scope and limits of applications and risks such as data leakage, model bias and errors.[4]

    Your first steps

    Your first steps

    1. Write a staff policy for generative AI using the PCPD checklist: permitted tools, what data may be entered, and who may use them.
    2. Check the original purpose for any personal data you plan to use with AI, and get express consent if the new use is unrelated.
    3. Put security and retention terms in your contracts with AI vendors, since processors are covered through the data user.
    4. Use the PCPD Model Framework to set up AI governance, a risk assessment and the right level of human oversight for each use.
    5. Prepare a breach plan, and decide in advance when you will notify the PCPD and affected people.
    6. Erase personal data you no longer need, including copies held in AI tools and logs.
    7. Read the DPO Generative AI Guideline before building or offering a generative AI service.

    AI services for Hong Kong

    AI consulting and development for teams in Hong Kong

    We work remotely with companies in Hong Kong, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Hong Kong is on UTC+8 and India on UTC+5:30, a 2.5 hour gap. Taking a 9:00 to 18:00 day in Hong Kong and 9:30 to 18:30 in India, the overlap is about 6 hours, from 12:00 to 18:00 Hong Kong time.

    Questions

    Common questions about AI in Hong Kong

    Does Hong Kong have an AI law?

    Not as of 29 October 2026. The PDPO applies to AI that uses personal data, and the PCPD and the Digital Policy Office have published guidance that is not binding law.

    Must we report a data breach?

    It is not a legal requirement as of 29 October 2026. The PCPD says data users are advised to notify it as a recommended practice, and it offers an online form. Check for any change to the PDPO before you rely on this.

    Can staff paste customer data into a chatbot?

    Only if your policy allows it and the use fits the purpose the data was collected for. The PCPD checklist recommends clear rules on the types and amounts of data that can be entered.

    What are the penalties under the PDPO?

    Breaking a data protection principle is not an offence by itself. Ignoring an enforcement notice can bring a fine of up to HK$50,000 and two years in prison for a first conviction, with higher amounts for repeat convictions.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Office of the Privacy Commissioner for Personal Data, 2026-10-29. The Personal Data (Privacy) Ordinance: the Ordinance at a Glance(pcpd.org.hk)
      Full title and what we used it for

      The Personal Data (Privacy) Ordinance: the Ordinance at a Glance. Primary regulator summary of the law, read on this date. Used for history, the six principles, Part 6A, section 26, enforcement notices and penalties. We did not read the full Ordinance text.

    2. [2] Office of the Privacy Commissioner for Personal Data, 2024-06-11. Privacy Commissioner's Office Publishes Artificial Intelligence: Model…(pcpd.org.hk)
      Full title and what we used it for

      Privacy Commissioner's Office Publishes Artificial Intelligence: Model Personal Data Protection Framework. Primary press release. Used for the date, audience and four areas of the Model Framework.

    3. [3] Office of the Privacy Commissioner for Personal Data, 2025-03-31. Checklist on Guidelines for the Use of Generative AI by Employees(pcpd.org.hk)
      Full title and what we used it for

      Checklist on Guidelines for the Use of Generative AI by Employees. Primary press release. Used for the date and the topics the checklist covers.

    4. [4] Hong Kong SAR Government, Digital Policy Office, 2025-04-15. Digital Policy Office releases Hong Kong Generative Artificial Intellig…(info.gov.hk)
      Full title and what we used it for

      Digital Policy Office releases Hong Kong Generative Artificial Intelligence Technical and Application Guideline. Primary press release. Used for the release date, audience and scope. A law firm (DLA Piper) describes the guideline as non-binding, and a version 1.1 may exist; we did not read the guideline itself.

    5. [5] Office of the Privacy Commissioner for Personal Data, 2026-10-29. Data Breach Notification(pcpd.org.hk)
      Full title and what we used it for

      Data Breach Notification. Primary. Used for the statement that notifying the PCPD is not a statutory requirement.

    6. [6] Office of the Privacy Commissioner for Personal Data, 2026-10-29. AI Privacy Protection(pcpd.org.hk)
      Full title and what we used it for

      AI Privacy Protection. Primary. Used for the existence of the AI sandbox and the AI governance award. We read only the section headings.

    This is general information, not legal advice. AI guidance in Hong Kong is not binding law, and the PDPO may be amended. Check with a qualified Hong Kong lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Hong Kong?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score