AI Security and Data Compliance in 2025: PCPD and Asia-Pacific Regulators Release Practical Anonymisation Guide for Enterprises

Why Should Hong Kong Enterprises Act Now on Data Anonymisation？

1. Legal Compliance: In June 2024, PCPD’s “Artificial Intelligence: Model Framework for the Protection of Personal Data” recommended that organisations apply data anonymisation prior to using personal data in AI systems—including GenAI—to comply with the Personal Data (Privacy) Ordinance (PDPO).
2. Risk Management: Proper anonymisation significantly reduces the legal and reputational risks of data breaches and re-identification attacks.
3. Business Value: Anonymised data can still support AI model training, business analytics, and innovation without violating data privacy principles.

Anonymisation is not just a technical process. It’s a governance framework that combines privacy-enhancing technologies (PETs), risk evaluation, auditability, and legal accountability.

The 5-Step Anonymisation Framework Explained

• Step 1: Identify the Data Types

1. Direct Identifiers: Data that can directly identify an individual (e.g., name, ID number, phone number).
2. Indirect Identifiers: Data that can become identifiable when combined with other datasets (e.g., birthdate, gender, postal code).
3. Pitfall: Focusing only on sensitive data and ignoring quasi-identifiers, which are often the source of re-identification risks.

• Step 2: Remove Direct Identifiers

1. Fully delete all direct identifiers from datasets. Do not rely solely on masking techniques.
2. Pitfall: Retaining lookup tables or hashed identifiers without proper access controls.

• Step 3: Apply Anonymisation Techniques

1. Generalisation/Bucketing: Replace exact values with ranges (e.g., age 27 → age group 20–30).
2. Suppression/Truncation: Remove unnecessary digits (e.g., truncating postal codes).
3. Perturbation: Introduce random noise to obscure values.
4. Text/Image De-identification: Use NER for text, and blur or crop identifying areas in images.
5. Pitfall: Selecting inappropriate or reversible methods, or over-processing the data and making it unusable.

• Step 4: Assess Re-identification Risk

1. Use attacker models to simulate background knowledge attacks or data linkage with external sources.
2. Evaluate re-identifiability using risk matrices based on uniqueness, linkability, sensitivity, and exposure level.
3. Pitfall: Skipping risk quantification and treating anonymisation as a one-off technical task.

• Step 5: Manage Residual Risk and Enable Auditability

1. Implement access controls, purpose limitations, data-sharing agreements, and audit trails.
2. Conduct periodic testing to compare the performance of anonymised datasets against original benchmarks.
3. Pitfall: Failing to generate audit-ready documentation that regulators and partners can trust.

3 Key Industry Use Cases: Finance, Healthcare, and Retail

• Financial Services

1. Approach: Geolocation bucketing, hashing device fingerprints, transaction amount generalisation.
2. Challenge: High-net-worth customers often have unique behaviour patterns, requiring synthetic data or suppression of outlier records.

• Healthcare & Insurance

1. Approach: Group rare diseases, generalise claim timestamps, apply medical image de-identification techniques.
2. Challenge: Certain demographic and health combinations may still lead to re-identification without advanced privacy models.

• E-commerce and Retail Analytics

1. Approach: Segment user behavior sequences, de-identify customer reviews, truncate delivery zones.
2. Challenge: Long behavior chains can be reconstructed, making time and spatial granularity crucial.

Future-Proof Your AI Compliance Strategy with Anonymisation

In the age of AI-driven decision-making and cross-border data flows in the Greater Bay Area, anonymisation is no longer optional—it is your organisation’s license to operate safely and lawfully

FAQ: Key Questions Around Anonymisation and AI Compliance

1. What is the difference between anonymisation and pseudonymisation?
   Anonymisation makes re-identification practically impossible. Pseudonymisation involves replacing identifiers, but reversibility is possible via a lookup table or key.
2. Is anonymisation mandatory before training GenAI models?
   Yes, if personal data is involved, anonymisation is strongly advised. Organisations should also restrict use and ensure traceable audit logs.
3. Will anonymisation reduce the usefulness of my data?
   It depends on technique and granularity. Define your utility baseline first, then use anonymisation methods that maintain acceptable accuracy (e.g., AUC, F1 scores).
4. Do I still need contracts for anonymised data sharing?
   Yes. Data-sharing agreements should clarify scope, limits on re-use, deletion mechanisms, and audit rights.

Associated Services by DQS HK

• Privacy Impact Assessment (PIA)
• ISO 27001 Certification
• Penetration Test
• Security Risk Assessment & Audit (SRAA)
• Security Awareness Training