Hong Kong: PCPD Moves to Proactive Enforcement on AI Governance and Cross-Border Data Flows (2026)

Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) has entered a markedly more active posture across 2024–2026, particularly on agentic AI, generative AI, and cross-border data flows. While the Personal Data (Privacy) Ordinance (PDPO) dates from 1996 and Section 33 (cross-border transfer restrictions) remains inactive, the PCPD is using existing powers — Data Protection Principles, complaint investigation, and compliance notice authority — increasingly assertively.

Three Priority Areas for Multinationals

AI and Agentic Systems: The PCPD's AI Model Framework (issued late 2024) sets principles for accountability, transparency, fairness, data minimization, and human oversight. Though non-binding, the PCPD treats it as an operational expectation:

"The framework is non-binding, although the PCPD has signalled it will treat compliance with the framework as a relevant factor in investigating AI-related complaints and breaches."

A 2026 media statement extended these expectations to autonomous AI systems, emphasizing access limits, verified plugins, and human-in-the-loop controls for higher-risk decisions.

Cross-Border Transfers: The peculiarity of Hong Kong's regime is that Section 33 remains outside force after 20+ years. But the PCPD has tightened expectations under DPP 4 (security):

"While no statutory restriction applies, the PCPD expects organisations to take reasonable steps to ensure overseas recipients handle data consistently with PDPO standards. Documented transfer impact assessments and contractual safeguards have become the operational compliance even without Section 33 being in force."

Security Under DPP 4: PCPD investigations now emphasize proportionality to data sensitivity. Audit of security controls, evidence of risk assessment, and encryption are baseline expectations.

Common Compliance Gaps

The article identifies where multinationals most commonly fail: treating the PDPO's age as evidence of lax enforcement, assuming Section 33 inactivity removes cross-border obligations, skipping the AI Model Framework, inadequate direct marketing consent records, and underestimating doxxing exposure from the 2021 amendments.

"The PCPD's pattern is moving from complaint-driven investigation toward proactive thematic review, particularly on AI deployments."