騰訊 WorkBuddy 或將把韓國用戶的 AI 提示詞傳往中國

A diagram illustrating the flow of personal and user information associated with Tencent’s AI productivity tool WorkBuddy. (Image: Generative AI)

Chinese technology company Tencent has disclosed that personal information collected from South Korean users of its artificial intelligence (AI) tool WorkBuddy may be transferred to China. The information includes not only account and authentication details but also payment information and AI prompt inputs and outputs.

AI prompt data is particularly sensitive. In April 2025, South Korea’s Personal Information Protection Commission (PIPC) determined that Chinese AI company DeepSeek had transferred excessive personal information that was unnecessary for its stated purposes, prompting the company to halt the transmission of such data.

According to Tencent Cloud’s privacy policy published as of Nov. 5, Tencent Technology (Shenzhen) Co., Ltd., based in Shenzhen, China, is designated as a recipient of overseas personal data transfers. Tencent identifies the destination country as China (PRC) and specifies that data is transferred through information and communications networks when users access the service.

Tencent’s WorkBuddy is an AI productivity tool that creates documents, manages files and performs tasks through integration with external business systems in response to users’ natural-language instructions.

Tencent stores WorkBuddy user information on servers in Singapore and Hong Kong. Its privacy policy allows the information to be transferred to or accessed by Tencent Technology, its Chinese affiliate.

For individual WorkBuddy users, the categories of information subject to transfer include login and account details, security authentication information, diagnostic and usage data, payment and consumption records, and AI inputs and outputs. These categories cover email addresses, user IDs, internet protocol (IP) addresses, device identifiers and operating system information. The enterprise version of WorkBuddy also identifies account and authentication information, along with AI inputs and outputs, as data subject to transfer to China.

Tencent states in its privacy policy that overseas support and engineering teams, including those in China, may access users’ personal information for service operations. This means China-based personnel can remotely view or process personal information stored on servers in Singapore and other overseas locations.

However, the extensive scope of data collection, including substantial amounts of sensitive information, is likely to raise controversy. The transfer of AI input and output data, in particular, could raise questions about compliance with South Korea’s Personal Information Protection Act.

Under South Korean privacy law, overseas disclosure of personal information includes access to that information from abroad. This means that accessing data from China may constitute a cross-border transfer even if the servers storing the information are not physically relocated to China.

There is precedent for South Korean privacy regulators investigating a Chinese AI company’s overseas transfer of Korean users’ personal information.

In April 2025, the PIPC announced the findings of its investigation into DeepSeek, saying the company had transferred Korean users’ personal information to businesses in China and the United States without properly disclosing the transfers. DeepSeek was also found to have transmitted prompts entered by users to Beijing Volcano Engine Technology, an affiliate of China’s ByteDance.

DeepSeek said the transfers were intended to support cloud services used to address security vulnerabilities and improve the user experience. The PIPC, however, determined that transferring prompt contents was unnecessary for those purposes. DeepSeek subsequently blocked new transmissions starting April 10, 2025, and the PIPC recommended measures including the deletion of previously transferred data.

Tencent defines AI input information as prompts, text, voice recordings, uploaded files, shared content and task instructions submitted by users. Output information includes AI conversation histories, generated responses and task execution results. As in the DeepSeek case, such information could expose Tencent to regulatory action by the PIPC.

Tencent also operates a data center infrastructure region in South Korea, known as the Seoul region (ap-seoul), which has two availability zones. Despite having domestic server infrastructure, the company stores user information overseas and allows it to be transferred to China.

THE ELEC has repeatedly contacted Tencent for clarification, but the company has continued to delay providing a clear response.