Does the PDPO ban AI?

No. If the workflow touches identifiable personal data, the six principles apply.

Does a three-person firm have to care?

Yes. The test is whether you control personal data, not headcount.

If staff use a personal ChatGPT account for company work, is the company exposed?

The company, as data user, may still be responsible. That is why you need a one-page policy and a red zone.

Can we paste a contract after removing the name?

Not if a phone number, address, or contract ID still identifies the person.

Is section 33 in force?

Not as of this article. Recheck before you put the status into a client promise.

Is an overseas API a cross-border transfer?

If the data is processed outside Hong Kong, treat it as one and cover it by contract and permissions.

Does the GBA standard contract cover Macao?

The mainland–Hong Kong text does not.

Is private AI automatically lawful?

No. A clear boundary is a start. Purpose, security, and openness still have to be done.

Can we train a model on support chats?

Not by default. Retraining is a new purpose unless the original notice covered it.

They asked a price on WhatsApp. Can we promote later?

Do not treat that as consent. Promotion needs its own consent and an opt-out.

Can AI change a credit limit or send a quote by itself?

It should not. Amounts, promises, and signatures need a person.

How long must we keep an invoice?

This article states no statutory number of days. Ask your accountant or lawyer.

10 / 15·PDPO, cross-border data, and private AI

Hong Kong enterprise AI privacy: local FAQ

18 October 2026

Direct answerWhen a Hong Kong firm’s AI touches personal data, the frequent questions compress to a few answers: the PDPO does not ban AI; small firms are not exempt; public chat tools need a red zone; section 33 is not in force as of this article, but cross-border processing still needs control; promotion needs consent; private AI is a data boundary, not automatic compliance. Every answer below is general information, not legal advice.

How to use this page

Each answer points at another post in this series. If one workflow mixes contracts, WhatsApp, and an overseas API, do not stop after a single line. Bring one real example to a diagnosis.

What you should recheck

Whether breach notification has become mandatory, whether section 33 is in force, and the official title and date of PCPD framework and staff guidance should be rechecked against the PCPD and the Gazette before you rely on them. This page deliberately does not freeze those statuses.

Questions

Does the PDPO ban AI?: No. If the workflow touches identifiable personal data, the six principles apply.
Does a three-person firm have to care?: Yes. The test is whether you control personal data, not headcount.
If staff use a personal ChatGPT account for company work, is the company exposed?: The company, as data user, may still be responsible. That is why you need a one-page policy and a red zone.
Can we paste a contract after removing the name?: Not if a phone number, address, or contract ID still identifies the person.
Is section 33 in force?: Not as of this article. Recheck before you put the status into a client promise.
Is an overseas API a cross-border transfer?: If the data is processed outside Hong Kong, treat it as one and cover it by contract and permissions.
Does the GBA standard contract cover Macao?: The mainland–Hong Kong text does not.
Is private AI automatically lawful?: No. A clear boundary is a start. Purpose, security, and openness still have to be done.
Can we train a model on support chats?: Not by default. Retraining is a new purpose unless the original notice covered it.
They asked a price on WhatsApp. Can we promote later?: Do not treat that as consent. Promotion needs its own consent and an opt-out.
Can AI change a credit limit or send a quote by itself?: It should not. Amounts, promises, and signatures need a person.
How long must we keep an invoice?: This article states no statutory number of days. Ask your accountant or lawyer.

This article is general information, not legal advice. PCPD guidance changes — check the latest version before you rely on it.

Want a first look at whether one real workflow touches personal data? Book a 1-hour business diagnosis.

Book a 1-hour diagnosis