What "agentic AI" actually means
An agentic system is one that (a) plans, (b) takes actions across tools or systems on its own, and (c) executes multi-step tasks without a human in the loop for every step. The current generation of agentic products can read your inbox, act on the contents, log into third-party services on your behalf, and modify files. This is a materially different risk shape from a chatbot that answers a question and stops.
What the PCPD alerted on
The March 2026 PCPD alert flagged six specific concerns:
- Local device access. Agents that can read, write or execute on the device they run on.
- File access. Documents, spreadsheets, historical exports — typically far more personal data than the user consciously realises.
- Email access. Full inbox visibility, often including sensitive third-party correspondence never intended for AI processing.
- Credential access. Session tokens, saved passwords, browser-stored authentication.
- Browser contents. Open tabs, browsing history, autofill data.
- External service access. Third-party APIs the agent can call in the user\'s name.
The PCPD\'s framing was not "don\'t use agents". It was "understand the privacy surface these tools open, and control it".
PCPD recommendations, in operational language
- Minimum access rights. Read-only where write is not required. Scoped API keys. No blanket "access everything" permissions where narrower ones exist.
- Avoid administrator privileges. If an agent is running as an admin because "it was easier to set up that way", that is the finding.
- Separate runtime environments from local infrastructure. Run agents in isolated containers or dedicated workspaces, not on the primary workstation with access to everything the user has access to.
- Review plugins and connectors. Each connector is an independent privacy surface. Third-party plugins are the layer most commonly overlooked in an operational review.
Where Hong Kong SMEs typically get exposed
Four common failure modes we see when we come in on remediation work:
- Agent given a personal Google/Microsoft account, not a scoped service account. The blast radius on that credential is the user\'s entire digital life.
- Agent given persistent admin access to a CRM to "make it work". That access outlives the specific task and rarely gets revoked.
- Browser-based agents running in the same profile as personal browsing. Cookies, saved logins, autofill all in scope.
- Plugin marketplace connectors installed and forgotten. The privacy policy of a plugin installed 18 months ago is not the policy in force today.
The practitioner view — what we actually do
Because this comes up: we run agentic automation for clients and here is our own operating pattern:
- Every agent runs under a purpose-built service account, never a human account.
- Access is scoped per task. An agent that files invoices does not have access to the mail folder.
- Agents run in isolated environments — a dedicated workspace, not the operator\'s workstation.
- Every connector is reviewed before install and re-reviewed on a schedule.
- An action log is maintained. What the agent did, on what data, at what time.
None of that is exotic. All of it is the direct operational translation of the PCPD\'s four recommendations.
Where this fits in the PDPO framework
The PCPD did not create new statutory obligations with the March alert. It restated existing PDPO principles — purpose limitation, security safeguards, use limitation — in the specific context of agentic AI. So the alert is guidance, not a rule change. But it establishes the standard the PCPD will apply if an incident occurs. "We didn\'t know" will be a weak defence for an agent-related incident after March 2026.
Related reading
References
- Office of the Privacy Commissioner for Personal Data (PCPD), Hong Kong — agentic AI privacy alert, March 2026 — pcpd.org.hk
- Personal Data (Privacy) Ordinance (Cap. 486)