Hong Kong's privacy guidance on employees using generative AI: what to put in your policy

Most companies now have staff using generative AI tools, whether or not there is a policy. Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) has issued guidance that gives organisations a practical structure for managing this.

The two key documents

• Artificial Intelligence: Model Personal Data Protection Framework (June 2024): best practices for organisations procuring and using AI systems that involve personal data, including AI strategy, governance and risk assessment.
• Checklist on Guidelines for the Use of Generative AI by Employees (March 2025): helps organisations develop internal policies for staff using generative AI, in line with the Personal Data (Privacy) Ordinance.

What your internal policy should cover

• Scope: which tools are permitted, which uses are allowed, and which staff the policy applies to.
• Data protection: what information may be entered, anonymising personal data before input, and how outputs are stored and deleted.
• Lawful and ethical use: no unlawful or harmful uses, human review of outputs, fact-checking, and labelling of AI-generated content where appropriate.
• Security: approved devices and accounts, access for trained staff only, strong authentication and secure settings.
• Incidents: how staff report problems such as data being entered by mistake, and how the company responds.

Making it work in practice

Keep the policy short and specific, train staff with examples from their own work, and review it as tools change. Pair the policy with approved enterprise tools so staff have a safe alternative to consumer apps.

Read the PCPD's documents directly on its website for the full text, and take legal advice for your specific situation.