AI Regulation Tracker / Regulator programme

Hong Kong Launches a Personal Data AI Sandbox, Starting With 15 Schools

Regulatory summary: On July 6, 2026, Hong Kong's Privacy Commissioner for Personal Data and the Digital Policy Office launched the "Safeguarding Personal Data AI Sandbox," a voluntary programme giving selected participants free PCPD compliance guidance and the Hong Kong Generative AI Technical and Application Guideline. Phase one pilots with 15 publicly-funded schools.

The privacy regulator and the Digital Policy Office are offering free compliance guidance to publicly-funded schools testing generative AI, and the signal to APAC compliance teams is bigger than the pilot.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

Hong Kong Launches a Personal Data AI Sandbox, Starting With 15 Schools regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

The PCPD and the Digital Policy Office jointly opened applications for a Safeguarding Personal Data AI Sandbox. Selected participants receive complimentary PCPD regulatory guidance on personal data privacy and access to the Digital Policy Office's Hong Kong Generative AI Technical and Application Guideline during a six-month first phase.
Directly, the school-sector participants selected for phase one. Indirectly, DPOs, privacy counsel, and compliance leads across Hong Kong and the wider APAC region who now have a concrete reference for how the regulator expects AI-plus-personal-data deployments to be governed.
Status: Live and open for applications.
Map any planned generative-AI deployment touching personal data against the Hong Kong Generative AI Technical and Application Guideline and PDPO principles, and document the assessment before go-live.

Regulatory Briefing

Bindingness: Voluntary regulator programme / guidance, not binding law
Scope: A supervised "sandbox" for testing generative AI use in a defined setting, launched with a phase-one pilot limited to publicly-funded primary and secondary schools in Hong Kong. Not a general licensing regime and not sector-wide.
What Changed: The PCPD and the Digital Policy Office jointly opened applications for a Safeguarding Personal Data AI Sandbox. Selected participants receive complimentary PCPD regulatory guidance on personal data privacy and access to the Digital Policy Office's Hong Kong Generative AI Technical and Application Guideline during a six-month first phase.
Who This Affects: Directly, the school-sector participants selected for phase one. Indirectly, DPOs, privacy counsel, and compliance leads across Hong Kong and the wider APAC region who now have a concrete reference for how the regulator expects AI-plus-personal-data deployments to be governed.
Current Status: Live and open for applications. Phase one runs six months; the application deadline is 30 October 2026.
Effective Date: Launched July 6, 2026.
Primary Source: https://www.pcpd.org.hk/english/news_events/media_statements/press_20260706.html
Secondary Analysis: Consistent with the APAC pattern of regulators coupling AI adoption support with existing data-protection duties rather than passing new AI statutes, mirroring Singapore's PDPC advisory approach.
Workflow Impact: Gives compliance teams a checklist-grade reference for AI data-protection impact reviews, vendor due diligence, and student or employee data minimisation, even for organisations outside the pilot.
Operational Next Step: Map any planned generative-AI deployment touching personal data against the Hong Kong Generative AI Technical and Application Guideline and PDPO principles, and document the assessment before go-live.
Last Verified: July 9, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	Hong Kong	The PCPD and the Digital Policy Office jointly opened applications for a Safeguarding Personal Data AI Sandbox. Selected participants receive complimentary PCPD regulatory guidance on personal data privacy and access to the Digital Policy Office's Hong Kong Generative AI Technical and Application Guideline during a six-month first phase.	Directly, the school-sector participants selected for phase one. Indirectly, DPOs, privacy counsel, and compliance leads across Hong Kong and the wider APAC region who now have a concrete reference for how the regulator expects AI-plus-personal-data deployments to be governed.	Live and open for applications. Phase one runs six months; the application deadline is 30 October 2026.

Frequently Asked Questions

Is the Safeguarding Personal Data AI Sandbox a new law?

No. It is a voluntary regulator programme and guidance initiative from the PCPD and the Digital Policy Office. It supports compliance with the existing Personal Data (Privacy) Ordinance rather than creating new binding obligations.

Who can join the pilot?

Phase one is open to publicly-funded primary and secondary schools in Hong Kong. The regulator selected an initial cohort of 15 schools. The first phase runs six months, with applications due by 30 October 2026.

What do participants receive?

Free access to the PCPD's regulatory guidance on personal data privacy protection and to the Digital Policy Office's guidance on the Hong Kong Generative AI Technical and Application Guideline.

Does this apply to companies outside education?

Not directly. The pilot is limited to schools. But DPOs and compliance teams across APAC can use the guidance and the PDPO-anchored approach as a practical template for their own AI deployments.

How does this fit the wider APAC regulatory trend?

It reflects a regional pattern of pairing AI adoption support with existing data-protection duties instead of passing standalone AI statutes, similar to Singapore's generative-AI data advisory.