PDPO Call Recording Hong Kong Checklist

PCPD guidance from 2021 requires the recording party to inform the data subject before audio-recording and state the purpose. AI Voice Phone Agents must therefore embed PDPO call recording compliance into every inbound and outbound flow.

Personal Data in PDPO Call Recording

Voice recordings, caller ID, transcripts and service notes all qualify as personal data under the Personal Data Privacy Ordinance when they identify an individual. DPP1 requires collection only for a lawful purpose directly related to the function of the data user. Clinics, law firms and logistics operators routinely capture names, medical details or delivery addresses during calls, so the entire audio file and any derived transcript fall inside scope. Over-collection happens when agents record calls without limiting the scope to the stated purpose. Hong Kong AI phone compliance demands that teams map every data field collected during a call to a documented purpose before the system goes live.

AI voice call disclosure must cover both the audio itself and any metadata. A caller who provides an address during an appointment booking creates a record that links identity to location. If that record later feeds an analytics dashboard, the secondary use triggers DPP3. The ordinance treats the voice print itself as biometric data in some interpretations, though PCPD has not issued a binding ruling on that point yet. Teams should assume the strictest reading and treat every element as personal data.

Disclosure Requirements Before Recording

DPP1 and DPP5 together require clear notification at or before the start of recording. The notice must state the purpose of collection and the classes of persons to whom the data may be transferred. For PDPO call recording this means telling the caller that the conversation is recorded for service quality, training or dispute resolution. The disclosure must occur in the same language the caller uses. A generic English-only prompt fails when the caller speaks Cantonese.

Practical timing is the moment the call connects, before any substantive conversation begins. Written notice on a website satisfies DPP5 only if the caller has already seen it; otherwise the verbal disclosure at the start of the call is mandatory. Hong Kong call recording consent flows therefore combine a short spoken line with an option for the caller to opt out or request further information. Failure to give this notice at the first reasonable opportunity exposes the data user to complaints under DPP1.

Consent Rules and New-Use Limitations

Notice alone suffices for the original purpose of collection. DPP3 prohibits use of personal data for a new purpose without the data subject’s prescribed consent. Training an AI model on past recordings constitutes a new purpose. Therefore any plan to reuse PDPO call recording data for model improvement requires separate consent obtained at the time of collection or via a later opt-in. Direct marketing use of call recordings also demands explicit consent under the separate direct marketing provisions of the ordinance.

Ordinary service-quality monitoring stays within the original purpose. When a clinic records calls to verify appointment details, that use is covered by the initial notice. The line is crossed when the same recording trains a voice-cloning model or feeds a marketing segmentation engine. In those cases the vendor data processor PDPO relationship does not shield the data user; consent remains the responsibility of the organisation that collected the data.

PDPO Audio Retention Period and Deletion

DPP2 requires that personal data not be kept longer than necessary. No fixed statutory period exists for PDPO audio retention period, yet PCPD enforcement actions show that indefinite storage without review triggers investigations. A defensible policy for most Hong Kong SMEs is 24 months for dispute-resolution recordings and 90 days for quality-monitoring files, followed by secure deletion. The policy must be documented and the deletion process auditable.

AI systems complicate deletion because transcripts and embeddings may persist even after the original audio file is removed. Hong Kong AI phone compliance therefore requires the data user to specify deletion schedules in the contract with any AI vendor. Regular audits confirm that both audio and derived data are purged on schedule. Over-retention remains one of the most common PDPO breaches in recorded-call environments.

Vendor Data Processor PDPO Responsibilities

When an external provider transcribes, stores or analyses recordings, the Hong Kong business remains the data user. The vendor acts as data processor. Contracts must therefore contain the standard processor clauses required under DPP2 and DPP4: security, access restrictions, breach notification and return or deletion of data on contract end. The data user cannot shift responsibility for obtaining consent or setting retention periods onto the processor.

Many AI voice platforms default to retaining data for model improvement. A Hong Kong firm that accepts those terms without amendment becomes liable for any subsequent DPP3 breach. Before signing, legal review must confirm that the processor agreement explicitly prohibits reuse of recordings for training unless separate consent has been obtained. AI receptionist for clinics Hong Kong operational walkthrough and AI voice agent vs traditional answering service Hong Kong both detail how these contract terms are implemented in live deployments.

Conclusion

PDPO call recording compliance in Hong Kong hinges on timely disclosure, purpose limitation, documented retention and clear allocation of data-user responsibility when vendors are involved. Businesses that embed these controls at the design stage avoid the most common enforcement triggers.

Call to Action

Get the compliance checklist and see how our AI Voice Phone Agents handle PDPO call recording flows out of the box.

FAQ

Do I need consent to record calls in Hong Kong?

Notice is required under DPP1 and DPP5 before recording begins. Prescribed consent is needed only when the recording will be used for a new purpose such as AI model training or direct marketing. Ordinary service and quality monitoring can rely on clear disclosure alone. The distinction matters because reusing recordings without fresh consent breaches DPP3.

What must I disclose before recording a call?

The caller must be told the purpose of the recording and the classes of people who may receive the data. The disclosure should occur at the start of the call in the language the caller is using. A typical line states that the call is recorded for service quality and dispute resolution. Written notice on a website supplements but does not replace the verbal statement.

How long can I keep recorded calls under PDPO?

PDPO audio retention period is governed by DPP2: data must not be kept longer than necessary. Most Hong Kong organisations adopt 24 months for dispute files and 90 days for quality-monitoring files. The retention schedule must be documented and deletion must be verifiable. Indefinite storage without review has triggered PCPD investigations.

Is a vendor processing call recordings a data processor or data user?

The Hong Kong business that decides to record remains the data user. The vendor is the data processor. Contracts must therefore allocate security, access and deletion duties to the processor while the data user retains responsibility for consent and purpose limitation. Processor agreements that allow model training without separate consent create liability for the data user.

Can recorded calls be reused to train an AI model?

Reuse for training constitutes a new purpose under DPP3 and requires prescribed consent. The initial service-quality notice does not cover model training. Any vendor contract that permits such reuse must be amended, or separate opt-in consent must be obtained at the time of each call. Without that step the reuse breaches the ordinance.

Voice agents · AI receptionist for clinics: PDPO call flow in Hong Kong · Answering Service Hong Kong: AI Voice Agent vs Traditional · Ai agents · More articles · Talk to our team