What the guidance says: agentic AI is now a privacy-management topic
On 25 August 2026 the Office of the Privacy Commissioner for Personal Data (PCPD) published "Protecting Personal Data Privacy in the Use of Agentic AI". The PCPD says that, unlike conventional AI chatbots, agentic AI can operate with a high degree of autonomy and execute multi-step tasks for users, such as handling emails, making reservations and settling payments, which raises the risks to personal data privacy. The guidance is supported by the Digital Policy Office and the Hong Kong Applied Science and Technology Research Institute, and supplements the PCPD's "Artificial Intelligence: Model Personal Data Protection Framework", which remains generally applicable to agentic AI.
The most important point is that responsibility stays with the organisation. Where an agent collects, holds, processes or uses personal data, the organisation remains the data user and must comply with the Personal Data (Privacy) Ordinance (PDPO). "The system decided" is not a defence, and the responsibility cannot simply be passed to a tool or a vendor.
Five risk areas: broad access, vulnerabilities, plugins, function creep and multi-agent errors
The guidance names several risks. The first is extensive access: agents typically run with higher default access rights and may reach files, emails, account credentials and browser-stored content. Without strict limits this can lead to unauthorised access, or to accidental erasure if the agent misreads an instruction. The second is system vulnerabilities: an agent connected to many systems can expose all of them if its design or safety controls are flawed.
The third is vulnerable plugins or skills. Add-ons that have not had a rigorous security review may contain malicious code that lets attackers take over accounts or an entire computer. The fourth is function creep: agents combine personal data from many sources, and some systems may use it to train language models, taking it beyond the purpose for which it was collected. The fifth is multi-agent risk: inaccurate personal data, whether from external sources or hallucinated by a model, can cascade between agents and make it hard for people to exercise their rights to access and correct their data.
The nine recommendations and how businesses can apply them
First, avoid excessive or arbitrary collection of personal data, and ringfence the information and systems an agent may access, especially for sensitive data such as identity card numbers, bank account numbers and passwords. Second, say in your Personal Information Collection Statements and Privacy Policy Statements how agentic AI is used. Third, reduce the risk of hallucinated or inaccurate personal data through approaches such as chain of thought, retrieval-augmented generation, context-specific fine-tuning and human review. Fourth, set maximum retention periods for conversation histories, cache data and long-term memory, and erase data that is no longer needed.
Fifth, do not use personal data for a new purpose without consent; define the purposes and when human oversight is required. Sixth, strengthen security: use official, current versions; separate the agent's runtime environment from local devices and servers; install plugins cautiously; grant only the minimum access rights and avoid administrator rights; use LLM guardrails; and log operations, timestamps, tools used, data accessed and decision reasoning so that actions can be traced and audited.
Seventh, choose systems built on privacy-by-design and privacy-by-default so that access and correction requests can be handled. Eighth, test safety and reliability before use and keep assessing risk during use; for decisions likely to significantly affect individuals, including high-stakes, irreversible or atypical actions such as sending personal data to third parties, permanently deleting data or changing system settings, keep a human in the loop. Ninth, set up an internal governance structure with enough resources and authority, bind external vendors by contract or other means, and train the people involved.
What the numbers show: AI is widespread, but disclosure and assessment can improve
In compliance checks published on 19 May 2026, the PCPD reviewed 60 organisations. Of these, 57 (95%) used AI in daily operations, up 15 percentage points from the 2025 checks, and 29 of the 57 (about 51%) used three or more AI systems. Among the 57, 24 (about 42%) collected or used personal data through AI systems.
All 24 provided Personal Information Collection Statements, but only seven (about 29%) said in them that AI tools were used to process personal data. Nineteen (about 79%) carried out privacy impact assessments before implementing AI, and 19 used a human-in-the-loop approach. The picture suggests many organisations already have basic controls, while telling individuals clearly about AI use remains an area for improvement.
A practical checklist: what to do before and after deployment
The guidance includes a Security Checklist covering five stages: evaluation, preparation, deployment, use and cessation of use. In evaluation, define the purposes for which an agent will process personal data and choose products with built-in safeguards. In preparation, update your privacy statements and obtain installation files from official channels, verifying their authenticity. In deployment, avoid one-click deployment or automated scripts from unverified sources, switch on logging, restrict the data and systems the agent can reach, and define high-risk operations in advance.
During use, regularly review long-term memory records, revoke sensitive permissions that are no longer needed, remove unused skills and conversation records, and act on security alerts. When retiring an agent, stop it first, export or transfer data you must keep, and clean up the environment. For small and medium-sized businesses, a realistic start is a low-risk, reversible internal task, such as organising meeting schedules, with a clear ban on handling customer identity documents or payment data. Widen the scope only once logging, review and retention rules are working.
AIPPA's view is that the value of AI agents lies in efficiency, but efficiency should not come at the cost of control over data. This article is a practical summary of the PCPD's public materials and is not legal advice; regulated industries and organisations handling large volumes of sensitive data should confirm specific requirements with the relevant regulators and professional advisers.