Founded and led by HKAAST · Secretariat provided by HKAAST Greater Bay Area · 3 Locks: Safe · Reliable · Trustworthy 繁 · 简 · EN
Guide · Intermediate

Data Export & Cross-Border AI: the law and the technology you need to know

GBA AI Safety & Development Standing Committee · 2026

For many AI services you use, your data is not processed on your device at all — it is sent to the cloud, sometimes to servers in other jurisdictions. Understanding what "data export" means is the first step to protecting it.

What is data export?

Data export means your personal data is transmitted or stored outside where you are. Pasting a paragraph into a chatbot, uploading a photo, recording a voice note — each can constitute data export, especially when the server sits in another country or region.

Why it matters

Data export involves: legal compliance (different jurisdictions, different rules), privacy risk (data leaves your control), and misuse risk (training, profiling, even leakage).

Three core concepts

1. Data minimisation — provide only what is genuinely needed. Never paste sensitive information into an AI unless necessary.

2. Localisation — keep data processing local where possible: locally-run open models, encrypted drives, self-hosted tools all reduce export.

3. Consent & awareness — know how your data will be processed, by whom, and for how long. Demand a transparent privacy policy from your platforms.

Practical advice

· Never paste sensitive data (ID numbers, banking, medical records) into online AI
· Choose services with clear data-processing policies
· Organisations handling cross-border data should understand the data laws and compliance requirements applicable in the Greater Bay Area
· Think in the order: minimise first, then encrypt, then localise

Data governance is ongoing learning. Want to go deeper? Ask the AI Safety Assistant or contact info@3token.org.