TRAINING DECISIONS
Can staff put company data into AI tools? Staff AI data rules for Hong Kong companies (2026)
Published: · Last updated:
Short answer: yes, within rules your company writes down. Hong Kong does not ban staff from using generative AI at work, but the Personal Data (Privacy) Ordinance (PDPO) still applies to whatever they type or upload. The Privacy Commissioner's Checklist on Guidelines for the Use of Generative AI by Employees (31 March 2025) asks employers to name the permitted tools and to say what information may and may not go in. In my training, staff sort data with a three-second red, yellow, green check before every AI task.
By Sam Wong (黃力桐), a corporate AI trainer in Hong Kong who has trained 11,000+ people. This is practical guidance from my training, not legal advice.
The question every session starts with
In almost every AI session I run, someone asks about data security in the first ten minutes. HR and IT want to know what staff are allowed to put into AI. Staff often hold back for the opposite reason: they assume everything they work with is off-limits, so they do not use AI at all. Until the question is answered, nobody moves.
What the Privacy Commissioner asks of an employer
The Office of the Privacy Commissioner for Personal Data (PCPD) published its checklist to help organisations write internal policies or guidelines on staff use of generative AI while complying with the PDPO. It recommends that a policy covers:
| Area in the PCPD checklist | What the policy should say |
|---|---|
| Scope of permitted use | Which generative AI tools are permitted, for which purposes (for example drafting or summarising), and who the policy applies to |
| Protection of personal data privacy | What types and amounts of information may be entered (for example, whether personal data may go in), how outputs may be used and stored, and which retention and security policies apply |
| Lawful and ethical use | No unlawful or harmful use; staff check outputs for accuracy, correct and report biased output, and know when to label AI-generated content |
| Data security | Which devices may be used, which staff may use the tools, strong credentials and security settings, and reporting AI incidents |
| Violations | The possible consequences of breaking the policy |
The checklist also suggests supporting staff with training and resources, a support team and a feedback channel. Source: the PCPD's media statement of 31 March 2025 and the checklist itself.
A written policy answers "which tools" and "what may go in". Staff still need a way to apply it in the three seconds before they paste something. That is what the traffic light is for.
Red, yellow, green in workplace terms
| Colour | What it covers | Examples | What staff do |
|---|---|---|---|
| Red | Data that must never go into an external AI tool | Client names, account numbers, HKID numbers, salary data, performance reviews with names | Stop |
| Yellow | Internal material that can be used once names and client references are removed | Meeting minutes, process documents, draft communications, aggregated performance figures | Anonymise first |
| Green | Published or fictional material | Annual reports, press releases, public guidelines, industry research | Go ahead |
"External" is the key word. Your company may have internal AI tools with their own data handling, and your policy decides what may go into those.
The three-second check
Before every AI task, staff ask three questions:
- Does this contain names, account numbers or other personal data? Red. Stop.
- Is it internal, but could the names and client references be removed? Yellow. Anonymise first.
- Is it public or completely fictional? Green. Go ahead.
A simple test helps with yellow: if this text appeared on a public website, would anyone be embarrassed or harmed? If yes, it needs anonymising before it touches an AI tool.
From the check to a one-page staff rule
A one-page rule is easier to follow than a long policy. It needs three things: the list of permitted tools, one line of examples per colour for each department, and the name of the person to ask. HR's red line looks different from marketing's, so let each department write its own examples.
What it looked like in real programmes
- A major Hong Kong bank: the programme used external public data only, so every exercise sat in green. Staff across departments still practised on documents, creative work and data analysis.
- Garden: every cohort, from HR to R&D, practised on exercises built around its own work, using fictional data only.
In both cases the client and I agreed what could go into an AI tool before the first exercise. That conversation is part of the preparation, not an afterthought.
FAQ
Can staff use ChatGPT at work in Hong Kong?
Hong Kong does not ban it, but your company's policy decides which tools are permitted. Availability also differs by tool; I compared what a Hong Kong team can roll out in which AI tools work in Hong Kong.
Does the PDPO apply to what staff type into AI tools?
Yes. The PDPO applies to personal data that staff enter into a generative AI tool. The PCPD checklist asks employers to say clearly what information may be entered, including whether personal data may go in.
Do we need a written AI policy before training?
It helps, and the PCPD checklist describes what it should cover. If you do not have one yet, agree at least the permitted tools and what may go in before any exercise. In training, I build exercises on public or fictional data where needed.
Is Microsoft 365 Copilot the safer choice?
It depends on your licences and settings, not on the brand. Count the licences you actually have first; see Microsoft Copilot training: count the licences first.
Where can we ask the Privacy Commissioner directly?
The PCPD launched an "AI Security" hotline, 2110 1155, for organisations on 31 March 2025.
Further reading
Sources
All pages checked on 22 October 2026.