Skip to content

Regulation Tracker / Hong Kong

Checklist on Guidelines for the Use of Generative AI by Employees

Office of the Privacy Commissioner for Personal Data, Hong Kong

last revised 2025-03-31last verified 2026-09-041 versioncountry page →

GuidanceIn forceConfidentialityVerification dutySupervisionRecord-keeping

map categories:Data protection and legal AIClient data in AI toolsSupervision of AI workVendor due diligence

Published 31 March 2025, this PCPD checklist helps organisations, including law firms, draft internal policies on employees' use of generative AI while complying with the Personal Data (Privacy) Ordinance. It covers permitted tools and purposes, what may be entered, verification duties, watermarking, and device and access controls.

Applies to
firms, all
Effective
31 Mar 2025
Current version
Original · 31 Mar 2025
Last verified
04 Sept 2026

What the document requires

  • Specify the permitted generative AI tools, permissible purposes of use, and to whom the policy applies.
  • Give clear instructions on the types and amounts of information that may be input, permissible purposes for output, storage and retention.
  • Employees are responsible for verifying the accuracy of AI-generated output by proofreading and fact-checking, and for correcting and reporting biased or discriminatory output.
  • Give instructions on when and how to watermark or label AI-generated output.
  • Specify which devices may be used to access generative AI tools and which categories of employee may use them.

Version history

VersionDateWhat changedSource
Originalcurrent2025-03-31First version recorded.official

Sources

Cite this record

SafeLegalAI Legal AI Regulation Tracker, "Checklist on Guidelines for the Use of Generative AI by Employees" (Office of the Privacy Commissioner for Personal Data, Hong Kong, Original, 2025-03-31), safelegalai.com/regulation/hong-kong/hk-pcpd-checklist-generative-ai-employees (accessed 2026-09-04). Data: CC BY 4.0.

More official documents in Hong Kong