The Office of the Privacy Commissioner for Personal Data of Hong Kong published guidance titled Protecting Personal Data Privacy in the Use of Agentic AI on 25 August 2026, announced by media statement the same day. The guidance is advisory material issued by the Commissioner. It is not subordinate legislation and creates no new statutory duty.
The guidance applies the Personal Data (Privacy) Ordinance, Cap. 486, to organisations that deploy AI agents capable of acting without step by step human instruction. It sets out nine recommendations, which include avoiding excessive or arbitrary collection of personal data for use by agentic AI, being transparent about the use of agentic AI in privacy notices, ensuring accuracy of personal data processed by agentic AI through human review, setting appropriate retention periods with timely erasure, and adopting a human in the loop approach where a decision materially affects an individual.
Organisations in Hong Kong running customer service agents, recruitment screening agents or internal workflow agents are the direct audience. The guidance carries a security checklist covering the evaluation, preparation, deployment, use and cessation stages of an agentic AI system, which gives compliance teams a sequence to document. Data users remain answerable under the Ordinance for what an agent collects and retains on their behalf.
Because the guidance is advisory, departing from it is not itself an offence. It bears on whether a data user met the obligations the Ordinance already imposes, and it supplements the Commissioner's earlier artificial intelligence publications rather than replacing them.
Licentium advises technology and financial services businesses on data protection duties arising from automated and agentic systems. Work we undertake includes privacy notice drafting for AI deployments, retention and erasure policy review, human oversight design, and cross-border data protection assessments.