In most companies we visit, generative AI is already in use — unofficially. Someone in marketing drafts posts with a public chatbot; someone in finance pastes a contract in to summarise it. The productivity is real, and so is the exposure. The useful response is not a ban but a decision about the terms on which the company uses AI. Here is how we frame that decision with clients.
Where does the data go?
With a consumer chatbot, the text you type is processed by the provider under its consumer terms. Depending on the product and your settings, that text may be retained and may be used to improve the provider's models. For personal use that may be acceptable; for a client contract or an employee's personal data it usually is not.
Azure OpenAI runs the same families of models as a service inside Microsoft Azure, under Microsoft's enterprise terms. The practical differences are the ones that matter to a business: prompts and outputs are not used to train the underlying models and are not shared with other customers or with OpenAI; the service runs in the Azure region you choose; and access is controlled through your own Azure identity, networking and logging. Microsoft documents the precise data-handling behaviour, including how abuse-monitoring works, and we go through it with every client so that the statement in their AI policy is accurate rather than assumed.
Who can use it, and for what?
A consumer tool is an individual account. An Azure OpenAI deployment is a company resource: you decide which applications and people can call it, what content filters apply, and what is logged. This is what makes it possible to build an internal assistant that respects document permissions, or a customer-facing one that only answers from approved content. It is also what lets the finance team say "yes, you can summarise that contract — in this tool, not that one."
What about the PDPO?
Hong Kong's Personal Data (Privacy) Ordinance applies to personal data whether it is processed by a person or by a model. The data-protection principles — collecting only what is needed, using it for the stated purpose, keeping it secure, and being transparent — translate directly into AI design decisions: which data the assistant can reach, whether personal data needs to be in the prompt at all, how long logs are kept, and what users are told. The Privacy Commissioner has published guidance on the use of AI, and we recommend reading it alongside any project plan. None of this is a reason not to proceed; it is a checklist to settle in week one.
Cost and control
Consumer subscriptions are simple per-seat fees. Azure OpenAI is billed by usage, in your Azure subscription, with budgets and alerts you control — which suits applications that many people use a little, such as a customer-service assistant, and makes the cost of each use case visible. For heavy individual use of Microsoft 365 apps, Microsoft 365 Copilot is the per-seat option that already inherits your tenant's permissions. The right answer is often a combination, and a licensing review is worth doing before buying either.
What to put in an AI policy
A one-page policy is enough to start. We suggest it cover: which tools are approved for which kinds of data; the rule that personal or confidential data goes only into company-controlled tools; the expectation that AI output is reviewed before it is relied on; and who to ask. Pair it with an approved tool that is actually good to use, and the unofficial usage moves over on its own.
If you would like help mapping your current AI usage to the right Azure services — or setting up Azure OpenAI in your own tenant — get in touch.