Compliance
NVIDIA TensorRT-LLM in Hong Kong
Structured issue-spotting for deploying NVIDIA TensorRT-LLM in Hong Kong, read against the rules for that jurisdiction.
- Source
- Rules engine over a generic brief — no anchored quote on this page
- Verified
- Evidence not verified
- Confidence
- Low
Structured issue-spotting to support your own review — not legal advice. Verify against the cited primary sources and your counsel.
01What this reading assumes
- Jurisdiction
- Hong Kong
- Principal framework
- Personal Data (Privacy) Ordinance (Cap. 486). The Ordinance applies to any person who controls the collection, holding, processing or use of personal data, and works through six Data Protection Principles in Schedule 1 covering collection, accuracy and retention, use, security, openness and access. Data processors are not directly regulated: the data user stays responsible and must impose the requirements on its processors by contract or other means. Contravening a Data Protection Principle is not itself an offence, but the Commissioner may issue an enforcement notice and contravening that notice is.
- Delivery assessed
- Self-hosted
- Data leaves the network
- no
- Vendor home jurisdiction
- United States
- Verified vendor positions
- none — every vendor position below is a question, not an assurance
- Rules evaluated
- 39
- Rules fired
- 16
Assumptions about use
- An internal deployment used by employees, not a public-facing product.
- A person reads the output before acting on it — but that is not recorded, so the engine reports it as a gap rather than assuming it.
- No significant automated decision is taken about a person by the system alone.
02Issues to work through
Cross Cutting
Self-hosting moves the security obligation to you
Keeping data on your own hardware answers the transfer question and creates an operations question. Patching, backups, key management, monitoring and incident response are now yours, and an unpatched inference server on the office network is a worse outcome than a well-run vendor.
- Required checks
- Name the person responsible for patching each component, and the cadence.
- Confirm backups exist, are encrypted, and have been restored at least once.
- Confirm there is an incident response path that includes this system.
- Technical controls
- Encrypt at rest and in transit, including between the application and the inference server.
- Centralise authentication through the existing identity provider rather than local accounts.
- Keep an audit log of who queried what, and protect it from the people it records.
- Subscribe to security advisories for each component and track upgrade lag.
Being able to reconstruct a decision months later
The question that arrives after a complaint is what the system was shown and what it produced on a particular day. Models change, prompts change, and indexes are rebuilt, so the answer has to be recorded at the time. Without it, the only available response is that the output cannot be reproduced.
- Required checks
- Decide what is recorded per interaction: model and version, prompt template version, retrieved document ids, output, reviewer and outcome.
- Set how long those records are kept, balanced against the retention duties that also apply to them.
- Vendor questions
- Does the vendor pin model versions, and how much notice is given before a model is retired or changed?
- Technical controls
- Version prompt templates in source control and log the version used.
- Log the model identifier and version returned by the provider, not the one you requested.
Confidentiality duties bind independently of data protection law
Material can be entirely free of personal data and still be the material a contract stops you disclosing. Client retainers, non-disclosure agreements, supplier contracts and common-law duties are the usual sources, and several of them require consent before a third party processes the material at all — which a model API call is.
- Required checks
- Review the confidentiality clauses in the contracts covering the material going into the system.
- Identify any contract requiring notice or consent before a subcontractor processes the material.
- Decide whether the deployment needs a confidentiality carve-out negotiated into new contracts.
- Vendor questions
- Will the vendor accept a confidentiality undertaking beyond its standard terms?
- Which staff at the vendor can access customer content, under what controls?
- Technical controls
- Segregate the most sensitive corpora into an index that the general assistant cannot reach.
Human review required — take this to your counsel
We were not told whether a person reviews the output
Where output influences a decision about a person, the reviewer has to be able to disagree with it. That needs three things a rubber-stamp review lacks: enough information to judge, enough time to judge, and an override that is used often enough to be real. Design it before the volume makes it impossible.
- Required checks
- Name the role that reviews the output and what they see when they do.
- Decide what evidence is retained about each review, so the practice can be shown to exist.
- Set a threshold below which the system must not act without review.
- Vendor questions
- Does the product expose the retrieved context and the confidence behind a suggestion, or only the answer?
- Technical controls
- Show the reviewer the retrieved sources next to the suggestion, not the suggestion alone.
- Record the reviewer’s decision, including overrides, as part of the audit trail.
Human review required — take this to your counsel
An AI deployment creates new copies of the data
Vector indexes, prompt logs, completion caches, evaluation datasets, fine-tuning checkpoints and backups are all copies of the source material in places the existing retention schedule does not mention. Deletion requests are the moment this is discovered, because deleting the source document does not delete its embedding.
- Required checks
- List every store the deployment creates and add each to the retention schedule.
- Establish how a deletion request propagates to the index, the caches and the logs.
- Establish how long backups keep material that has been deleted from the live system.
- Vendor questions
- What does the vendor retain, where, and for how long after we delete our copy?
- Technical controls
- Store the source document id with every embedding so deletion can cascade.
- Set time-to-live on prompt and completion logs rather than relying on manual cleanup.
Who can reach the model, the index and the weights
A self-hosted stack has three access surfaces that are easy to leave open: the inference endpoint, the vector index, and the weights on disk. Retrieval also carries an authorisation problem an ordinary application does not have — the index must not return a document to someone who could not open it in the source system.
- Required checks
- Confirm the inference endpoint is not reachable from outside the network and requires authentication.
- Confirm retrieval filters by the requesting user’s permissions, not only by relevance.
- Confirm who can read the model files and the index volume at the operating-system level.
- Technical controls
- Bind the inference server to a private interface and put an authenticating proxy in front of it.
- Carry document-level access control into the index and enforce it at query time.
- Encrypt the volume holding the weights and the index, and restrict it to the service account.
- Rotate API keys and keep them out of client-side code and container images.
What ends up in a prompt, and where it goes next
Even with inference inside the network, prompts and retrieved context accumulate in logs, traces and caches, and system prompts can often be extracted from the output. The leak path is internal rather than external, but it is still a copy of the source material in a new place.
- Required checks
- Write down which categories of information may be entered into a prompt, and tell people.
- Establish what the system prompt contains and whether disclosing it would matter.
- Establish which shadow tools staff are already using; the policy has to name the permitted ones.
- Vendor questions
- Are prompts and completions retained, for how long, and can retention be set to zero?
- Are prompts used for abuse monitoring, and if so who can read them and for how long?
- Technical controls
- Redact or block high-risk patterns before the prompt leaves the application.
- Keep prompt and completion logs out of general-purpose observability tools.
- Set an explicit retention period on prompt logs and enforce it.
Hong Kong
DPP4 — all practicable steps to protect the data
DPP4 requires all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use, including where a data processor holds it. For a retrieval system that normally means access control that mirrors the source repository, encryption at rest and in transit, and an audit log — and it is the principle the Commissioner reaches for after a breach.
- Required checks
- Confirm retrieval cannot return a document to a user who could not open it at source.
- Confirm encryption at rest for the index, the logs and any model artefacts.
- Confirm there is a tested route to detect and respond to unauthorised access.
- Vendor questions
- What security certifications do you hold, and can we see the current report rather than a badge?
- Which of your staff can access customer content, and under what controls?
- Technical controls
- Enforce document-level permissions at query time, not only at ingestion time.
- Authenticate through the existing identity provider rather than local accounts.
- Keep an access log covering who queried what, retained separately from the application.
DPP3 — a new purpose needs express and voluntary consent
DPP3 prohibits using personal data for a new purpose that is not, or is unrelated to, the purpose for which it was collected, unless the data subject gives express and voluntary consent. This is the provision that decides whether existing client and staff records can be used to power an assistant at all, and it is answered by reading what people were told at collection.
- Required checks
- Retrieve the personal information collection statements actually used for the data in scope.
- Assess whether the AI use is the original purpose, a directly related purpose, or a new one.
- Where it is a new purpose, plan how express consent is obtained — or narrow the corpus.
- Technical controls
- Tag indexed documents with the collection basis so an out-of-scope source is visible.
Human review required — take this to your counsel
PCPD Model Framework — AI governance and the level of human oversight
The PCPD’s Artificial Intelligence: Model Personal Data Protection Framework recommends that organisations formulate policies, practices and procedures when they procure, implement and use AI solutions, taking into account its recommended measures in AI strategy and governance, risk assessment and human oversight, customisation of AI models and implementation and management of AI systems, and communication and engagement with stakeholders. It is guidance rather than law.
- Required checks
- Decide who owns AI governance internally and what they sign off before a system goes live.
- Run a risk assessment that sets the level of human oversight for this system, and record it.
- Train the people who will use the system, and record that you did.
- Vendor questions
- What documentation do you provide to support a customer’s own AI risk assessment?
- Technical controls
- Give reviewers the retrieved sources alongside the output so oversight is possible in practice.
DPP1 — collection must be lawful, necessary and not excessive
DPP1 allows personal data to be collected only for a lawful purpose directly related to a function or activity of the data user, and requires the data collected to be necessary and adequate but not excessive for that purpose. Indexing a whole document store for an assistant is a collection decision made at scale, and "we indexed everything because it was easier" is the shape of an excessive-collection finding.
- Required checks
- State the purpose the AI system serves, in the terms the business would defend it in.
- List which repositories are indexed and confirm each is necessary for that purpose.
- Check whether the personal information collection statement given to staff and clients covers this use.
- Technical controls
- Scope the index by folder, label or classification rather than by whole drive.
- Exclude repositories that exist for a different purpose, such as HR files, unless they are in scope deliberately.
PCPD checklist — write the internal generative AI policy
The PCPD’s 2025 checklist is explicit about what an internal policy should cover: which generative AI tools are permitted, the permissible purposes, clear instructions on the types and amounts of information that can be inputted into the Gen AI tools, lawful and ethical use and bias, which devices and which categories of employee may use the tools, AI incident reporting, and the consequences of a violation.
- Required checks
- Name the permitted tools, including whether publicly available tools are allowed at all.
- Say which categories of employee may use them, on which devices.
- Give concrete instructions on what may go into a prompt, with examples rather than principles.
- Add AI incidents to the existing incident response plan and say what an AI incident is.
- Technical controls
- Make the sanctioned tool easier to reach than the unsanctioned one; policy alone does not move behaviour.
DPP2 — accuracy, and no longer than necessary
DPP2 requires all practicable steps to keep personal data accurate and not to keep it longer than is necessary for the purpose it is used for. Where a data processor is engaged, the data user must adopt contractual or other means to ensure the processor complies with the same retention requirement. An AI deployment multiplies the copies: embeddings, prompt logs, cached completions and evaluation sets all fall inside this.
- Required checks
- Add every store the deployment creates to the retention schedule with a stated period.
- Confirm the contract with any processor caps their retention and that you can verify it.
- Decide what "accurate" means for a generated answer, and how a wrong one is corrected at source.
- Vendor questions
- How long do you retain prompts, outputs and logs, and can that be reduced contractually?
- Technical controls
- Set a time-to-live on prompt and completion logs.
- Re-index on a schedule so the assistant does not answer from a superseded document.
DPP6 — access and correction, and the log book
DPP6 gives data subjects the right to request access to and correction of their own personal data, with detailed provisions in Part 5 of the Ordinance on manner and timeframe, on when a request may be refused, and on maintaining a log book recording every refusal. A vector index and a prompt log are places that data now lives, and a data access request reaches them.
- Required checks
- Establish how a data access request is answered when the data also sits in an index or a log.
- Establish how a correction propagates from the source document to the index.
- Confirm the refusal log book exists and covers requests touching the AI system.
- Vendor questions
- How do we extract or delete a specific individual’s data from your service, and how long does it take?
- Technical controls
- Keep the source document id on every embedding so a subject can be located across stores.
DPP5 — openness about policies, practices and what you hold
DPP5 requires all practicable steps to make a data user’s personal data policies and practices open, along with the kind of personal data held and the main purposes for holding it. Deploying an assistant over personal data changes the practices, so the published statement has to change with it.
- Required checks
- Update the privacy policy and internal data handling notice to describe the AI processing.
- Say plainly, where people will see it, that an AI system is involved and what it does.
Data stays inside — but the weights still came from outside
Keeping documents on your own server removes the transfer question for the content. It does not remove the supply chain: model weights, container images and dependencies are downloaded from third parties, and a gated repository records who downloaded what and when. That is a procurement and integrity matter rather than a personal data transfer, and it is worth stating explicitly so nobody assumes the system is hermetic.
- Required checks
- Record which model revision you downloaded, from where, and under which licence.
- Note that accepting gated access terms is a contract, and check who accepted it.
- Technical controls
- Verify checksums on downloaded weights and pin the revision rather than tracking a moving tag.
- Mirror the artefacts internally so a rebuild does not depend on the upstream still being there.
Structured issue-spotting to support your own review — not legal advice. Verify against the cited primary sources and your counsel.
03What this reading does not know
- Whether any of the data falls into a special or sensitive category.
- Whether any material is covered by legal professional privilege.
- Whether a person reviews the output before it is acted on.
04Instruments these issues point at
- guidancePCPD AI Model FrameworkPCPD guidance for organisations that procure, implement and use AI, including generative AI. Recommends measures in four areas: AI strategy and governance, risk assessment and human oversight, customisation and management of AI systems, and communication with stakeholders. Adopts a risk-based approach. It is recommended practice, not a statutory obligation.
- guidancePCPD Gen AI ChecklistPCPD checklist for organisations writing an internal policy on employee use of generative AI. Covers the scope of permissible use and permitted tools, what may be entered into a prompt, lawful and ethical use and bias, data security and permitted devices, reporting of AI incidents, and consequences of violations.
- guidancePCPD Ethical AI GuidancePCPD guidance from August 2021 on complying with the PDPO when developing or using AI. Sets three data stewardship values and seven ethical principles, including accountability, human oversight, transparency and interpretability, data privacy and fairness, and describes an AI governance and risk-assessment practice. The document states only a month of publication, so no exact date is recorded.
- statutePDPOHong Kong’s general data protection statute. Six Data Protection Principles govern collection, accuracy and retention, use, security, openness, and access and correction. Data processors are not directly regulated; the data user must impose the requirements by contract. Section 33, restricting transfers outside Hong Kong, has never been brought into operation.
05Vendor documents being watched
- Data processing agreementhttps://www.nvidia.com/en-us/agreements/data-processing-addendum/nvidia-cloud-services-data-processing-addendum/not yet fetched
- Privacy policyhttps://www.nvidia.com/en-us/about-nvidia/privacy-policy/not yet fetched
- Security pagehttps://www.nvidia.com/privacy-center/not yet fetched
- Terms of servicehttps://developer.nvidia.com/legal/termsnot yet fetched
06Ask about your own deployment
This page reads the rules against a generic organisation. Your size, industry, data and existing contracts change which of these issues matter and which fall away.