PDPO Call Recording Hong Kong Checklist
By Ilya Laptev, Co-Founder, Genium Group · Published
Under DPP1, the recording party must tell the data subject the purpose on or before collecting the data, so callers need to hear it before recording starts. AI Voice Phone Agents must therefore embed PDPO call recording compliance into every inbound and outbound flow.
Personal Data in PDPO Call Recording
Voice recordings, caller ID, transcripts and service notes are personal data under the Personal Data Privacy Ordinance. This applies when they identify a person. The PCPD's summary of the Ordinance says DPP1 allows collection only for a lawful purpose directly related to a function or activity of the data user.
Clinics, law firms and logistics operators often capture names, medical details or delivery addresses on calls. So the whole audio file and any transcript made from it fall inside scope. Over-collection happens when agents record calls without limiting them to the stated purpose.
Hong Kong AI phone compliance means mapping every data field collected on a call to a documented purpose. Teams must do this before the system goes live.
AI voice call disclosure must cover both the audio itself and any metadata. A caller who gives an address while booking an appointment creates a record that links identity to location. If that record later feeds an analytics dashboard, the new use triggers DPP3.
In some interpretations, the ordinance treats the voice print itself as biometric data. The PCPD has not issued a binding ruling on that point yet. Teams should assume the strictest reading and treat every element as personal data.
Disclosure Requirements Before Recording
DPP1 requires clear notification at or before the start of recording, and DPP5 requires your privacy policies and practices to be openly available. The notice must state the purpose of collection and the classes of persons to whom the data may be transferred. For PDPO call recording, this means telling the caller that the conversation is recorded for service quality, training or dispute resolution.
The disclosure must use the language the caller speaks. A generic English-only prompt fails when the caller speaks Cantonese.
The practical moment is when the call connects, before any real conversation begins. Written notice on a website meets DPP1 only if the caller has already seen it. Otherwise a spoken disclosure at the start of the call is mandatory.
Hong Kong call recording consent flows therefore pair a short spoken line with an option to opt out or ask for more. If you miss the first reasonable chance to give this notice, you invite complaints under DPP1. A PCPD case note on a bank that recorded calls without enough notice shows how this plays out.
Consent Rules and New-Use Limitations
Notice alone is enough for the original purpose of collection. DPP3 bars the use of personal data for a new purpose without the data subject’s prescribed consent. Training an AI model on past recordings is a new purpose. So any plan to reuse PDPO call recording data for model improvement needs separate consent, obtained at collection or through a later opt-in.
Using calls for marketing also needs explicit consent, as the PCPD's summary of the direct marketing rules explains. Ordinary service-quality monitoring stays within the original purpose. When a clinic records calls to verify appointment details, the initial notice covers that use.
The line is crossed when the same recording trains a voice-cloning model or feeds a marketing segmentation engine. In those cases, the vendor data processor PDPO relationship does not shield the data user. Consent remains the duty of the organisation that collected the data.
PDPO Audio Retention Period and Deletion
DPP2 requires that personal data not be kept longer than necessary. The ordinance sets no fixed statutory period for the PDPO audio retention period. Yet PCPD enforcement actions show that indefinite storage without review triggers investigations.
A common, defensible approach for Hong Kong SMEs is 24 months for dispute-resolution recordings and 90 days for quality-monitoring files. Secure deletion follows. The policy must be documented, and the deletion process must be auditable.
AI systems make deletion harder, because transcripts and embeddings may persist after the audio file is gone. Hong Kong AI phone compliance therefore means setting deletion schedules in the contract with any AI vendor. Regular audits confirm that both audio and derived data are purged on schedule. Over-retention remains one of the most common PDPO breaches in recorded-call settings.
Vendor Data Processor PDPO Responsibilities
When an external provider transcribes, stores or analyses recordings, the Hong Kong business remains the data user. The vendor acts as data processor. Under DPP2 and DPP4, the data user must use contractual or other means to control how the processor keeps and secures the data.
The PCPD's leaflet on outsourcing to data processors lists typical contract clauses. These cover security, access limits, breach reporting, and return or deletion of data at contract end. The data user cannot pass the duty of getting consent or setting retention periods to the processor.
Many AI voice platforms keep data for model training by default. A Hong Kong firm that accepts those terms unchanged is liable for any later DPP3 breach. Before signing, legal review must confirm that the processor agreement bars reuse of recordings for training unless separate consent exists. AI receptionist for clinics Hong Kong operational walkthrough and AI voice agent vs traditional answering service Hong Kong both detail how these contract terms work in live deployments.
Conclusion
PDPO call recording compliance in Hong Kong rests on four things. These are timely disclosure, purpose limits, documented retention and clear data-user duties when vendors are involved. Businesses that build these controls into the design avoid the most common enforcement triggers.
Get the compliance checklist and see how our AI Voice Phone Agents handle PDPO call recording flows out of the box.
FAQ
Do I need consent to record calls in Hong Kong?
You must give notice under DPP1 before recording begins. Prescribed consent is needed only when you will use the recording for a new purpose, such as AI model training or direct marketing. Ordinary service and quality monitoring can rely on clear disclosure alone. The distinction matters because reusing recordings without fresh consent breaches DPP3.
What must I disclose before recording a call?
Tell the caller the purpose of the recording and the classes of people who may receive the data. Say it at the start of the call, in the language the caller is using. A typical line states that the call is recorded for service quality and dispute resolution. Written notice on a website adds to the spoken statement but does not replace it.
How long can I keep recorded calls under PDPO?
DPP2 governs the PDPO audio retention period: data must not be kept longer than necessary. A common approach is 24 months for dispute files and 90 days for quality-monitoring files. Document the retention schedule, and make sure deletion can be verified. Indefinite storage without review has triggered PCPD investigations.
Is a vendor processing call recordings a data processor or data user?
The Hong Kong business that decides to record is the data user, and the vendor is the data processor. Contracts must therefore set the processor's duties on security, access and deletion. The data user still owns consent and purpose limits. A processor agreement that allows model training without separate consent creates liability for the data user.
Can recorded calls be reused to train an AI model?
Reuse for training is a new purpose under DPP3 and requires prescribed consent. The initial service-quality notice does not cover model training. Any vendor contract that permits such reuse must be amended, or you must get separate opt-in consent at the time of each call. Without that step, the reuse breaches the ordinance.
Talk to us
Want to see how this would work in your business? Tell us what you need and we will get back to you within 24 hours.
Our service: Lead reactivation. Works the leads already sitting in your CRM and brings the still-interested ones back.
Voice agents · AI receptionist for clinics: PDPO call flow in Hong Kong · Answering Service Hong Kong: AI Voice Agent vs Traditional · Ai agents · Cantonese AI voice agent: English model failures in Hong Kong · Property Voice Agent Hong Kong Measured Case · Retell vs Vapi: An 8-Criteria Production Teardown · More articles · Talk to our team