Are small firms exempt?

No. The Ordinance is not limited to large companies. If you control personal data, the six principles apply.

Is breach notification mandatory?

As of this article, Hong Kong does not have a mandatory breach-notification duty. The PCPD strongly encourages voluntary notification. Recheck the PCPD’s latest position before you treat this as settled.

01 / 15·PDPO, cross-border data, and private AI

Six PDPO principles Hong Kong SMEs should know before using AI

9 October 2026

Direct answerHong Kong’s Personal Data (Privacy) Ordinance (Cap. 486) does not ban AI. If an AI workflow touches identifiable personal data, you still have to meet the six principles: collection purpose, accuracy and retention, use, security, openness, and access and correction.

What counts as personal data

Names, phone numbers, ID numbers, contracts, invoices, addresses, and staff records count when a person can be identified. Truly irreversible statistics usually do not.

How the six principles land on AI

Collect for a stated purpose. Keep data accurate and no longer than needed. Do not use it for a new purpose you never explained. Limit access and encrypt it. Tell people what you are doing. Honour access and correction requests.

A practical first step

Draw a one-page data map: fields, systems, and who can see them. Pilot one workflow before you connect every department.

Questions

Are small firms exempt?: No. The Ordinance is not limited to large companies. If you control personal data, the six principles apply.
Is breach notification mandatory?: As of this article, Hong Kong does not have a mandatory breach-notification duty. The PCPD strongly encourages voluntary notification. Recheck the PCPD’s latest position before you treat this as settled.

This article is general information, not legal advice. PCPD guidance changes — check the latest version before you rely on it.

Want a first look at whether one real workflow touches personal data? Book a 1-hour business diagnosis.

Book a 1-hour diagnosis