How the PDPO’s six Data Protection Principles apply to an AI project in Hong Kong — collection, use, accuracy, security, openness and access.
dgm is an independent osFoundry integration partner — not affiliated with osFoundry’s maker (OS LLC), and dgm has no completed client integrations yet.
The PDPO’s six Data Protection Principles are the backbone of Hong Kong privacy law. This guide walks through how each one applies to an AI project.
The six principles
DPP1 (collection — lawful, fair, not excessive), DPP2 (accuracy and retention), DPP3 (use limited to the original or a directly related purpose unless consent), DPP4 (security), DPP5 (openness about policies), and DPP6 (access and correction). A breach of a principle is not itself a criminal offence — the PCPD issues an enforcement notice, and contravening that is the offence.
How each applies to AI
DPP1: do not over-collect data to train or run AI. DPP3: do not repurpose data for AI beyond what people consented to. DPP4: secure training data, prompts and outputs. DPP2 and DPP6: keep data accurate and let people access and correct it. DPP5: be open about AI use of personal data.
A practical checklist
Inventory the personal data your AI touches, check the purpose against DPP1/DPP3, secure it under DPP4, and document openness under DPP5. osFoundry’s managed cloud pins data to the US, EU or Japan — it does not currently offer a Hong Kong managed region (its nearest managed region is Japan). To keep data in Hong Kong, the honest path is self-hosting osFoundry (BYO Cloud) inside a Hong Kong cloud region such as AWS Asia Pacific (Hong Kong) ap-east-1, Microsoft Azure East Asia (Hong Kong SAR) or Google Cloud asia-east2 (Hong Kong), or running models locally on-device.
Where dgm fits
dgm is an independent integration partner that helps Hong Kong businesses adopt osFoundry — scoping a first use case, handling the build, and connecting AI to the systems you already run. dgm is independent of osFoundry’s maker (OS LLC) and has no completed client integrations yet, so everything described here is a service offered, not a past result. If you want to scope a practical first project, dgm can help you map it out.