Hong Kong's Personal Data (Privacy) Ordinance applies to every organisation that controls personal data, and it holds that organisation responsible for what its AI agents do with that data. Staff who brief, supervise and approve agents must be trained to keep each agent to its collection purpose, check accuracy, protect the data, and respect the Ordinance's strict direct marketing rules.
What does the PDPO ask of staff who work with agents?
The PDPO is built on data protection principles that every data user must follow. In substance they require that personal data is collected for a lawful purpose, by fair means, and no more than necessary; that it is accurate and not kept longer than needed; that it is used only for the purpose it was collected for, or a directly related one, unless the person consents; that it is protected against unauthorised access and loss; that the data user is open about its policies; and that people can access and correct their data.
Each principle becomes a task for someone when an agent is involved. The person who briefs an agent decides what data it collects and reads. The person who supervises it checks that outputs are accurate. The person who approves an outbound message decides what personal data leaves the organisation. Training must reach all three.
The Ordinance also has specific direct marketing rules. In substance, a data user must inform the person and obtain their consent before using their personal data in direct marketing, and must stop when asked. An agent that drafts personalised offers from customer records is doing direct marketing, and the staff who send or approve those offers must know whether consent is in place.
The PCPD, Hong Kong's privacy regulator, has published guidance on the responsible use of AI that stresses human oversight in proportion to risk and staff training. The sector regulators add their own expectations: the HKMA for banks and the SFC for licensed corporations each expect boards and senior management to stay accountable for AI and for customers to be treated fairly.
Who does it apply to?
Every data user in Hong Kong, of any size, public or private, and any organisation that controls the collection, holding, processing or use of personal data there. Data processors acting for a data user must be bound by contract to protect the data. An agent platform or model provider processing personal data for you is a processor, and you remain responsible.
Staff in scope typically include customer service and contact centre teams supervising service agents, relationship managers and marketing staff using agent-drafted offers, operations teams releasing agent-prepared actions, IT and data teams setting agent sources, and compliance staff who review agent activity. For a view by sector, see what AI agent training organisations in Hong Kong need.
What competence does the PDPO imply when agents act?
Purpose discipline. Data collected to open an account is not automatically available for marketing analysis. Staff who give an agent new sources must check the original purpose and whether the new use is directly related. If not, consent is needed.
Accuracy checking. Agents summarise records and can carry errors forward. A supervisor reading an agent's summary of a customer's history must know which facts came from the system of record, which are sealed, and which the customer declared, which may be out of date.
Security in practice. Staff must use only approved agents, never paste customer data into tools without a processor contract, and recognise attempts to talk an agent into disclosing another person's data.
Direct marketing consent. Before sending an agent-drafted offer, staff must know whether the customer consented to that kind of marketing. Agents should hold marketing drafts for a person, or check consent status before sending at depth 3.
Access and correction requests. Customers can ask for their data and ask for corrections. Staff must know that agent records and summaries may fall within an access request, and that a correction must reach the agent's sources.
Payments context. Where agents prepare transfers or payment instructions, the stakes rise. AI agent training for payments operations staff in retail banking in Hong Kong covers that role in depth.
How do you meet the PDPO and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Collect only what is necessary, for a lawful purpose | Agent sources limited to the task; purpose recorded for each source | Agent source register with purposes |
| Use only for the original or a directly related purpose | Staff check purpose before adding sources; consent sought where needed | Change records; consent records |
| Accuracy | Supervisors trained to check agent summaries against sealed records | Sample review results |
| Security | Approved tools only; processor contracts; staff trained on agent-targeted pretexting | Contracts; training records; refusal logs |
| Direct marketing consent | Marketing drafts held or consent checked before sending | Hold logs; consent checks |
| Access and correction | Agent records included in access request searches | Request handling records |
| Accountability | Every agent verdict filed with sources used | Append-only decision record |
What will the PCPD or an auditor ask?
- What personal data does each agent read, and for what purpose was it collected?
- Show us how staff are trained on agents, not just on privacy in general.
- How do you check consent before agent-drafted marketing goes out?
- What contracts do you have with agent and model providers?
- How would an access request find data an agent holds?
- What happened the last time an agent produced an inaccurate summary?
What does the PDPO not cover?
It does not regulate AI as such, or fairness in automated decisions, beyond what the principles require. It does not set sector conduct rules, which the HKMA and SFC apply to the firms they supervise. It does not prescribe training content or certification. And it does not cover non-personal data. Other markets in the region take different approaches; compare India's DPDP Act and staff training and LGPD training in Brazil for contrast. The guide to AI literacy and certification covers the wider model.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy's Foundations track covers data, ownership and trust for anyone who works near agents. Staff who supervise agents daily take the Operator track, which includes keeping knowledge current and human review, tested in the learner's own industry and role. Certificates are issued through VerifyDoc.ai and can be checked at source by anyone, which helps when a regulator asks who was trained.
Questions people ask
Does the PDPO apply to agents run by an overseas provider?
The data user in Hong Kong remains responsible. Bind the provider by contract and check what it does with the data.
Can an agent send marketing messages on its own?
Only if consent for that marketing is in place and checked. Many organisations hold marketing drafts for a person instead.
Must agent summaries be disclosed on an access request?
If they contain the requester's personal data and are held by you, they are likely in scope. Train staff to search agent records.