AI Governance: Practical Guidance from Hong Kong Privacy Commissioner for Personal Data
Introduction
Artificial Intelligence (AI) tools have become increasingly prevalent across various industries in Hong Kong. According to the Office of the Privacy Commissioner for Personal Data (PCPD), a compliance check conducted in May 2025 revealed that 80% of organizations (48 out of 60) reported incorporating AI into their daily operations.
In light of this widespread adoption, the PCPD has issued new practical guidance to help organizations establish effective internal policies that address the unique risks and challenges associated with AI usage. Organizations are encouraged to refer to the earlier published Checklist on Guidelines for the Use of Generative AI by Employees to assist in this process.
Key Areas for Developing Internal AI Policies
The PCPD recommends that organizations focus on the following critical areas when formulating their internal AI policies:
Scope of Permissible Use
Organizations should clearly define which Generative AI (Gen AI) tools are approved for use and specify the permitted use cases, such as drafting documents or creating content. It is essential to clarify to whom the policy applies, whether to all employees or limited to specific departments.
Protection of Personal Data Privacy
The internal AI policy must provide explicit guidance on the inputs and outputs of Gen AI tools. This should include:
- Types and amounts of information permitted for input.
- Use cases for AI-generated outputs.
- Rules for storage and retention of information to ensure compliance with data privacy laws.
Lawful and Ethical Use and Prevention of Bias
The policy should explicitly prohibit the use of AI for unlawful or harmful activities. Furthermore, all AI-generated outputs must undergo human review to verify accuracy and identify potential bias or discrimination. Instructions on watermarking or labeling AI-generated materials should also be included.
Data Security
Organizations must define which categories of employees are authorized to access Gen AI tools and specify the devices on which these tools can be used. Implementing strong user credentials and security settings is mandatory, and employees should report any AI-related incidents according to the organization’s incident response plan.
Violations of AI Policy
Consequences for non-compliance with the internal AI policy should be clearly outlined. For broader AI governance, organizations can refer to the PCPD’s “Artificial Intelligence: Model Personal Data Protection Framework” issued in 2024.
Supporting Responsible Use: Practical Measures
The PCPD suggests several practical support measures, including:
- Regular communication with employees about internal policies and updates.
- Targeted training for employees.
- A designated support team and a feedback mechanism to promote continuous improvement.
Takeaways
To align with the expectations set by the PCPD and mitigate AI-related risks, organizations should consider the following actions:
- Conduct a comprehensive review of all AI tools and use cases within the organization, particularly regarding personal data processing.
- Clearly specify approved AI tools, outline permitted use cases, and require pre-approval for new tool adoption.
- Prohibit the entry of sensitive information into public AI tools and evaluate personal data input for compliance with privacy laws.
- Assign reviewers for high-risk use cases and mandate thorough fact-checking and bias assessments for AI-generated content before external use.
- Implement strong authentication, encryption, and secure configurations while restricting AI use to approved devices.
- Provide role-specific training and accessible support channels for employees.
- Regularly audit AI use, gather employee feedback, and update internal policies as needed.
- Ensure compliance with data privacy laws, including the Personal Data (Privacy) Ordinance (PDPO).
As AI continues to reshape the business landscape in Hong Kong, the PCPD urges organizations to adopt a proactive and structured approach to AI governance by establishing comprehensive AI policies that promote lawful, ethical, and responsible use of AI technologies.
