In 2026, 95% of the Hong Kong organisations reviewed by the Privacy Commissioner were using AI in daily operations, up from 80% a year earlier. Over the same twelve months, the proportion holding board-level discussions on AI fell by roughly 25 percentage points, and the proportion with a written AI policy dropped from around 63% to 50%.
Adoption accelerated. Governance went backwards. That gap is the reason the regulator moved.
What is the PCPD's agentic AI guidance, and when does it apply?
On 25 August 2026, the Office of the Privacy Commissioner for Personal Data issued guidance titled "Protecting Personal Data Privacy in the Use of Agentic AI". It is not new legislation. It sets out how the existing Personal Data (Privacy) Ordinance applies when your organisation deploys AI that acts autonomously on your systems.
The guidance is designed to be read alongside the PCPD's "Artificial Intelligence: Model Personal Data Protection Framework", published in June 2024, which remains the anchor document for procuring, implementing and using AI systems under the PDPO.
The practical consequence matters more than the legal one. Hong Kong now has an articulated regulatory expectation for agentic systems. An organisation that cannot demonstrate it considered these points is no longer operating in a grey area. It is explaining itself after the fact.
Hong Kong is not moving alone. In the past twelve months the European Data Protection Supervisor, the UK Information Commissioner's Office, Spain's AEPD, the Dutch Autoriteit Persoonsgegevens and Singapore's IMDA have all issued dedicated publications on agentic AI. If you operate across Asia-Pacific and Europe, you are now managing a converging set of expectations rather than one local rule.
What is agentic AI, and why does the PCPD treat it as higher risk?
Agentic AI is software that executes multi-step tasks autonomously rather than returning a single answer. The PCPD describes it as typically deployed on a local device or server with high-level access, able to read and write files, allocate system resources, and complete sequences of actions without real-time user involvement.
That definition is the whole risk argument in one sentence. A chatbot returns text. An agent takes actions.
The PCPD sets out the specific exposures. Elevated default access rights may expose files, emails, account credentials and browser contents. An agent may misinterpret a command and delete important data. Systems with high-level, multi-source access carry significant data-security risk. Unvetted plugins or skills may embed malicious code enabling account or system takeover.
The last point deserves attention from anyone who has installed an agent extension without reading it. A plugin is executable code running with your agent's permissions. It is closer to a contractor with a building pass than to a browser add-on. This is also where prompt injection becomes an operational rather than theoretical concern.
What did the PCPD's 2026 compliance checks actually find?
The PCPD reviewed 60 Hong Kong organisations across sectors including banking and finance, insurance, logistics, property management, accounting, retail, telecommunications and healthcare. Half employed more than 500 people. No PDPO contravention was found. The findings are a picture of maturity, not enforcement.
The numbers worth carrying into your next management meeting:
--- 57 of 60 organisations (95%) used AI in daily operations, up from 80% in 2025.
--- 45 (around 79%) had used AI for more than a year, and 29 (around 51%) ran three or more AI systems.
--- 24 of the 57 AI users (around 42%) collected or used personal data through AI systems.
--- Of those 24, only seven (around 29%) named the use of AI tools in their Personal Information Collection Statements.
--- 19 (around 79%) had an AI governance structure, but only 12 (50%) had formulated an AI policy, down from around 63% in 2025.
--- 22 (around 92%) had a data breach response plan, but only nine (around 41%) addressed AI-specific incidents.
One trend runs the other way and is worth naming. The share of organisations retaining personal data collected through AI fell from around 79% to around 29%. Hong Kong businesses are deliberately shrinking their personal-data footprint when they deploy AI, using anonymisation, pseudonymisation and transient processing. That is a mature response, and it is the single cheapest risk reduction available to you.
Who is the data user when an AI agent acts on its own?
Under the PDPO, an organisation is a data user if it controls the processing of personal data. Autonomy does not transfer that control to the vendor. If you determine the level of authority an agent holds and the systems it may reach, control almost certainly still sits with you.
The tempting argument runs the other way. The agent decided. We only gave it a goal. Fewer instructions surely means less control.
It does not. The question the regulator asks is whether you empowered the agent with the means and the purpose of processing. Setting an objective and granting access is empowerment. The reduced instruction count is a user-interface fact, not a governance one.
Two concrete questions decide this in practice. Does your agent run in full-access mode or approval-request mode? And do you have a meaningful, practical mechanism to review and approve what it does, or a mechanism that exists on paper because nobody has the time to use it?
Agentic procurement also needs a different contractual analysis from ordinary software procurement. Before deployment, establish whether your provider acts as an independent controller, a joint controller, a processor or a subprocessor. That determination drives your obligations, and it is far harder to renegotiate after go-live.
How should you assess risk across a multi-agent workflow?
The PCPD warns that risks amplify when inaccurate data flows through integrated multi-agent workflows. Where agents reach multiple sources, you must understand how data is collected, transferred and managed across its full lifecycle, and reassess continuously rather than once before launch.
Ask the questions the regulator is implicitly asking. Are your agents connected to third-party plugins, tools or MCP servers? Are they reaching external databases, or collecting third-party personal data through web scraping? Who set the collection parameters, you in advance, or the agent during execution?
If information was wrongly acquired at the outset, the exposure compounds across several Data Protection Principles at once. DPP1 for collection without lawful purpose or excessive collection. DPP2 for processing inaccurate data. DPP3 for use beyond the original purpose. DPP4 for unauthorised access and dissemination. A single badly scoped retrieval step can touch all four.
A privacy impact assessment is likely to be required, weighing those risks against the business need and determining whether privacy-enhancing technologies belong in the design. The Annex to the PCPD guidance includes a security checklist mapped to each processing stage, which is a practical starting point rather than a compliance formality.
One further control is frequently missed: contractual protection against functional creep. Agents gain capability through vendor updates. Your risk assessment ages the moment the product roadmap ships.
What must your privacy notice actually say about AI?
Under DPP1(3) and DPP5, you must explain in your Personal Information Collection Statement and Privacy Policy Statement that agentic AI processes personal data, and how it does so. Only around 29% of the organisations the PCPD reviewed currently name AI tools in those statements. This is the widest visible gap in the market.
Generic wording will not carry the obligation. The notice has to reflect the actual use case and its impact on individuals. A customer-facing agent handling account opening for a financial services institution requires a materially different explanation from one answering transactional queries for a retail chain.
There is a second-order cost to getting this wrong. A privacy statement that is silent on AI may not support feeding that data into AI systems at all, including for model customisation or training. The notice is not a disclosure formality. It is the permission structure your AI programme stands on.
What does a defensible agentic AI control set look like?
The PCPD sets out a stricter control set for agentic AI than for ordinary generative tools. Deploying an agent grants a non-human actor standing access to your systems and data, so the controls are closer to identity and privileged-access management than to software configuration.
The controls the guidance names:
--- Grant only the minimum access rights necessary for the task.
--- Download only the latest official versions from official channels.
--- Segregate the agent runtime environment from local devices and servers.
--- Strengthen network controls around that environment.
--- Install plugins and skills only after verifying their security.
--- Conduct continuous risk assessment rather than a one-off pre-launch review.
--- Retain a human-in-the-loop with final control over decisions.
Read that list again as a job description. Least privilege, environment segregation, supply-chain vetting, continuous monitoring. Your security team already runs this playbook for contractors and service accounts. The work is not inventing a new discipline. It is admitting the agent belongs inside the existing one.
Organisations already pursuing formal certification will find the overlap substantial. The management-system requirements behind ISO 42001 cover much of the same documentation ground.
What goes wrong when organisations attempt this without guidance?
Three failure patterns account for most of the damage. Governance debt, where adoption outruns policy. Oversight that exists on paper but not in practice. And an agent-shaped supply chain nobody has mapped. Each is survivable alone. Together they produce an incident with no defensible record.
Governance debt is the pattern the 2026 data captured directly. AI use climbed 15 percentage points while written AI policies fell 13. Every month of that divergence adds systems whose approval basis nobody documented. The cost is not the policy you eventually write. It is the retrospective audit of eighteen months of undocumented deployment.
Paper oversight is subtler. Around 79% of organisations reported a human-in-the-loop approach. The honest internal question is whether your reviewer has the time, the context and the authority to say no. A reviewer who approves 400 agent actions a day is not oversight. That person is a queue.
Unmapped supply chain is the one that surprises boards. With around 51% of organisations running three or more AI systems, most enterprises now have agents calling tools calling other services. When something goes wrong, the first question is which component held the data at the moment of failure. Firms that cannot answer within a day discover their real problem was never the technology.
The connecting thread is documentation. Undocumented governance leaves you unable to demonstrate oversight and diligence, and shifts the entire burden of explanation onto management at precisely the moment scrutiny arrives.
What should enterprise leaders do this quarter?
Start with an inventory, not a policy. List every agentic deployment, what it can reach, who approved it, and whether personal data is involved. Most organisations discover the list is longer than expected. That inventory is the foundation for everything the PCPD guidance asks of you.
Then work in this order. Close the transparency gap in your Personal Information Collection Statements, because it is the cheapest fix with the clearest regulatory expectation. Restore board-level reporting, because the 2026 data shows this is where Hong Kong is regressing and where accountability ultimately sits. Apply least privilege and environment segregation to agents already running. Add AI-specific scenarios to your incident response plan and rehearse them.
The PCPD's direction of travel is clear. The 2026 compliance checks were expressly framed to align with the National "15th Five-Year Plan" and the Hong Kong Government's "AI Plus" policy. Regulatory attention on AI is intensifying, not settling. Governance built now is evidence later.
None of this requires slowing your AI programme. It requires knowing what you have deployed and being able to prove you thought about it. That is a solvable problem, and it is easier with a partner who has watched Hong Kong technology cycles arrive and pass. We understand AI. We understand you. With UD by your side, AI never feels cold.
Reviewed by the UD enterprise AI team.
Find out where you actually stand
Now that you have the framework, the next step is identifying where agentic AI actually touches personal data inside your organisation. We'll walk you through every step, from AI readiness assessment to access design, vendor due diligence and ongoing oversight, backed by 28 years of Hong Kong enterprise experience.
