用 AI 處理公司資料安唔安全？香港私隱條例要注意嘅幾點

簡單答：可以做到安全，但唔係自動安全。風險通常唔在 AI 本身，而在三樣嘢：資料去咗邊、保留幾耐、邊個睇到。如果涉及客戶或者員工嘅個人資料，香港《個人資料（私隱）條例》嘅要求一樣適用，用唔用 AI 都係咁。開始之前寫清楚資料流向、揀啱工具、限制權限、定好刪除時間，大部分風險都可以控制。

以下根據個人資料私隱專員公署（私隱公署）嘅公開資料整理。（資料截至 2026 年 10 月，來源見文末；本文唔係法律意見。）

私隱條例同 AI 有咩關係

私隱條例有六項保障資料原則。用 AI 處理公司資料時，最常碰到係以下四項：

• 收集（第 1 原則）：收集個人資料要有合法、同業務直接相關嘅目的，唔可以超乎適度；直接收集時要通知當事人用途。即係話，唔好因為「AI 可能用得着」就收多咗資料。
• 準確同保留（第 2 原則）：要採取切實可行步驟確保資料準確，亦唔應該保留超過達到目的所需嘅時間。交俾外判處理時，要用合約或其他方法防止資料被保留過耐。
• 使用（第 3 原則）：未得當事人訂明同意，唔可以將資料用於新目的。例如為處理訂單收集嘅資料，唔好隨便拎去做其他分析。
• 保安（第 4 原則）：要採取切實可行嘅步驟，保障資料唔會未經准許或者意外被查閱、處理、刪除、遺失或使用；交俾外判處理時，無論對方喺香港定海外，都要用合約或其他方法保障資料。

用 AI 服務，好多時就係將資料交俾第三方處理，所以第 2 同第 4 原則入面「外判處理」嗰部分特別重要。

私隱公署對 AI 嘅兩份指引

《人工智能：個人資料保障模範框架》（2024 年 6 月）：私隱公署為採購、實施同使用 AI（包括生成式 AI）嘅機構提供嘅建議，屬建議性質，涵蓋四個範疇：AI 策略同管治；風險評估同人為監督；AI 模型嘅定製同 AI 系統嘅實施同管理；同持份者溝通。當中建議按風險高低，配合相應程度嘅人為監督。

《僱員使用生成式 AI 的指引清單》（2025 年 3 月）：幫機構訂立內部 AI 使用政策，建議寫明：

• 可以用邊啲 AI 工具、用嚟做咩、適用於邊啲員工
• 可以輸入咩類型同幾多資料，輸出點樣儲存、保留同使用，幾時要匿名化
• 由員工核對 AI 輸出嘅準確性，例如校對同查證事實
• 使用強密碼同嚴格保安設定，出事要按 AI 事故應變計劃報告
• 違反政策嘅後果

中小企最常見嘅風險

• 同事各自用免費工具：將客戶名單、合約或者員工資料貼入唔同嘅 AI 工具，公司唔知資料去咗邊。
• 唔知服務條款：某啲服務可能會保留你輸入嘅內容，或者用嚟改善模型；用之前要睇清楚條款同設定。
• 資料留太耐：錄音、掃描文件、逐字稿一直留喺雲端同手機，冇人負責刪除。
• 權限太闊：人人都睇到所有資料，離職同事帳戶冇即時停用。
• 冇人核對 AI 輸出：AI 可能出錯，錯嘅資料直接寄俾客戶或者入咗系統。

用 AI 前嘅實用清單

• 列出 AI 會處理邊啲資料，有冇個人資料，可唔可以先刪走或者遮蓋
• 寫低資料流向：由邊度嚟、經邊個服務、存喺邊、幾時刪除
• 睇清楚 AI 服務嘅條款：會唔會保留輸入內容、會唔會用嚟訓練
• 統一公司准用嘅工具，唔好人人用唔同嘅免費工具
• 只俾需要嘅同事有權限，離職即時停用帳戶
• 重要嘅 AI 輸出一定要有人核對先用
• 敏感資料考慮喺公司自己嘅環境運行，唔上公共雲端

想睇實際例子，可以睇《會議錄音自動變 minutes》同《收據影相自動入數》。

自己做最常卡喺邊？

• 睇唔明 AI 服務嘅私隱條款，唔知資料會唔會被保留或者拎去訓練
• 唔知點樣喺唔影響效果之下，將個人資料先遮蓋再交俾 AI
• 想寫公司 AI 使用政策，但唔知由邊度開始、要寫幾詳細
• 想資料留喺公司自己嘅電腦或者伺服器，但唔知點設定

以上任何一樣卡住咗，都可以搵我哋。簽約前免費諮詢，我哋會直接話你知要做乜、大概幾錢。

我哋可以點幫你

MuduoPro 嘅 AI 流程自動化由一條最煩嘅流程做起：單一流程 HK$5,000 起，最快 2 日交付；多流程 HK$15,000 起。開工前會寫清楚資料存喺邊、去邊、保留幾耐，交付包原始碼、文件同交接。如果資料敏感、想留喺公司自己嘅環境運行，可以睇 AI 工具／程式開發，小工具 HK$8,000 起。公司帳戶同設備管理，可以睇 IT Support 月費計劃。所有套餐可以睇套餐同價錢，或者直接同我哋傾一次，簽約前免費諮詢。

資料來源（截至 2026 年 10 月）：個人資料私隱專員公署《保障資料原則》、《AI Privacy Protection》專頁（《人工智能：個人資料保障模範框架》，2024 年 6 月）、《僱員使用生成式 AI 的指引清單》新聞稿（2025 年 3 月 31 日）。本文唔係法律意見，實際做法請向法律顧問確認。

Is it safe to use AI on company data? What Hong Kong privacy law means for SMEs

The short answer: it can be done safely, but it is not safe by default. The risk usually lies not in the AI itself but in three things: where the data goes, how long it is kept, and who can see it. If customer or employee personal data is involved, Hong Kong's Personal Data (Privacy) Ordinance applies whether or not you use AI. Writing down how data flows, choosing the right tools, limiting access and setting deletion times before you start brings most of the risk under control.

The points below are drawn from public material from the Office of the Privacy Commissioner for Personal Data (PCPD). (Information as of October 2026; sources at the end. This article is not legal advice.)

How the privacy ordinance relates to AI

The ordinance has six Data Protection Principles. When AI handles company data, these four come up most often:

• Collection (DPP1): collect personal data for a lawful purpose directly related to your business, and not more than necessary; when collecting directly, tell people the purpose. In other words, do not collect extra data just because AI might find it useful.
• Accuracy and retention (DPP2): take practicable steps to keep data accurate, and do not keep it longer than necessary for its purpose. When a processor handles it, use contractual or other means to stop it being kept too long.
• Use (DPP3): do not use data for a new purpose without the individual's prescribed consent. Data collected to process orders, for example, should not casually be reused for other analysis.
• Security (DPP4): take practicable steps to protect data against unauthorised or accidental access, processing, erasure, loss or use. When a processor handles it, whether in Hong Kong or overseas, protect it by contract or other means.

Using an AI service often means handing data to a third party to process, so the processor parts of DPP2 and DPP4 matter especially.

The PCPD's two AI guidance documents

Artificial Intelligence: Model Personal Data Protection Framework (June 2024): recommendations for organisations procuring, implementing and using AI, including generative AI. It is advisory and covers four areas: AI strategy and governance; risk assessment and human oversight; customisation of AI models and implementation and management of AI systems; and communication with stakeholders. It recommends matching the level of human oversight to the level of risk.

Checklist on Guidelines for the Use of Generative AI by Employees (March 2025): helps organisations set an internal AI policy. It recommends specifying:

• Which AI tools may be used, for what purposes, and which staff the policy covers
• What types and amounts of information may be entered, how outputs are stored, retained and used, and when to anonymise
• That staff verify the accuracy of AI outputs, for example by proofreading and fact-checking
• Strong credentials and strict security settings, and reporting incidents under an AI incident response plan
• The consequences of breaching the policy

The most common risks for SMEs

• Staff using their own free tools: customer lists, contracts or employee details pasted into different AI tools, and the company does not know where the data went.
• Unread terms of service: some services may keep what you enter or use it to improve their models; check the terms and settings first.
• Data kept too long: recordings, scanned documents and transcripts left in the cloud and on phones, with nobody responsible for deleting them.
• Access too wide: everyone can see everything, and leavers' accounts are not disabled straight away.
• Nobody checks AI output: AI can be wrong, and wrong information goes straight to customers or into systems.

A practical checklist before using AI

• List what data the AI will handle, whether it includes personal data, and whether that can be removed or masked first
• Write down the data flow: where it comes from, which services it passes through, where it is stored and when it is deleted
• Read the AI service's terms: does it keep your inputs, and does it train on them?
• Standardise on approved tools instead of everyone using different free ones
• Give access only to the staff who need it, and disable accounts as soon as people leave
• Have a person check important AI output before it is used
• For sensitive data, consider running AI in your own environment rather than a public cloud

For worked examples, see Turning meeting recordings into minutes and Turning receipt photos into accounts.

Where do people usually get stuck?

• Not understanding an AI service's privacy terms, or whether data is kept or used for training
• Not knowing how to mask personal data before giving it to AI without ruining the results
• Wanting to write a company AI policy but not knowing where to start or how detailed to be
• Wanting data to stay on the company's own computers or servers but not knowing how to set it up

If any of these is where you are stuck, talk to us. Consultation before signing is free, and we will tell you plainly what needs doing and roughly what it costs.

How we can help

MuduoPro's AI workflow automation starts with your single most repetitive workflow: single workflows from HK$5,000, delivered in as little as 2 days; multiple workflows from HK$15,000. Before starting we write down where data is stored, where it goes and how long it is kept, and delivery includes source code, documentation and handover. If your data is sensitive and should stay in your own environment, see AI tools and software, with small tools from HK$8,000. For company accounts and device management, see our IT support monthly plans. See all packages and pricing, or talk to us: consultation before signing is free.

Sources (as of October 2026): Office of the Privacy Commissioner for Personal Data, Six Data Protection Principles, the AI Privacy Protection page (Artificial Intelligence: Model Personal Data Protection Framework, June 2024), and the press release on the Checklist on Guidelines for the Use of Generative AI by Employees (31 March 2025). This article is not legal advice; please confirm your arrangements with a legal adviser.