What the PCPD’s June 2024 Model Personal Data Protection Framework asks of Hong Kong businesses using AI — advisory guidance across four areas, not law.
dgm is an independent osFoundry integration partner — not affiliated with osFoundry’s maker (OS LLC), and dgm has no completed client integrations yet.
The PCPD’s Artificial Intelligence: Model Personal Data Protection Framework, issued in June 2024, is Hong Kong’s main AI-specific privacy guidance. It is advisory, not law — here is what it asks of businesses.
What the framework is
Published on 11 June 2024 by the Office of the Privacy Commissioner for Personal Data, it was described as the first comprehensive AI-specific personal-data-protection framework in the Asia-Pacific. It is advisory — recommendations and best practice — and does not create new binding legal obligations beyond the PDPO.
The four recommended areas
(1) AI strategy and governance; (2) risk assessment and human oversight proportionate to risk; (3) customisation, implementation and management of AI; and (4) communication and engagement with stakeholders. It builds on the PCPD’s earlier 2021 ethical-AI guidance.
How to apply it
Treat it as a practical checklist: set an AI governance position, assess risk before deploying, keep humans in the loop for higher-risk uses, and be transparent with the people whose data you use. osFoundry’s managed cloud pins data to the US, EU or Japan — it does not currently offer a Hong Kong managed region (its nearest managed region is Japan). To keep data in Hong Kong, the honest path is self-hosting osFoundry (BYO Cloud) inside a Hong Kong cloud region such as AWS Asia Pacific (Hong Kong) ap-east-1, Microsoft Azure East Asia (Hong Kong SAR) or Google Cloud asia-east2 (Hong Kong), or running models locally on-device.
Where dgm fits
dgm is an independent integration partner that helps Hong Kong businesses adopt osFoundry — scoping a first use case, handling the build, and connecting AI to the systems you already run. dgm is independent of osFoundry’s maker (OS LLC) and has no completed client integrations yet, so everything described here is a service offered, not a past result. If you want to scope a practical first project, dgm can help you map it out.