Cybersecurity · Hong Kong
Cybersecurity law & regulation in Hong Kong (2026)
Hong Kong shaded by its cybersecurity status
Cybersecurity in Hong Kong: sectoral rules.
FrameworkProtection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) enforced by the Office of the Commissioner of Critical Infrastructure (Computer-system Security) (OCCICS); Personal Data (Privacy) Ordinance (Cap. 486) under the PCPD; HKMA Cybersecurity Fortification Initiative (CFI) 2.0 for authorized institutions
Hong Kong does not have a NIS2-style horizontal cybersecurity statute covering all businesses. Its regime is sector-specific: the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) — Hong Kong's first dedicated cybersecurity law — took effect on 1 January 2026 and regulates designated critical infrastructure operators (CIOs) across eight essential sectors, while the HKMA (banking), SFC (securities), and PCPD (personal data) impose additional cyber and incident-reporting duties on regulated entities. Mandatory data-breach notification remains proposed under PDPO reform but is not yet in force.
Key points
The Protection of Critical Infrastructures (Computer Systems) Ordinance was passed by LegCo on 19 March 2025 and commenced on 1 January 2026, alongside establishment of the Office of the Commissioner of Critical Infrastructure (Computer-system Security). It imposes organisational, preventive and incident-response duties on designated CIOs.
The Ordinance covers CIOs in energy, information technology, banking and financial services, air transport, land transport, maritime transport, healthcare services, and telecommunications and broadcasting. The Government expects phased designation of CIs and critical computer systems from mid-2026.
Designated CIOs must report serious computer-system security incidents to the Commissioner within 12 hours of becoming aware, and other reportable incidents within 48 hours, in line with the Code of Practice issued by OCCICS on 1 January 2026.
Non-compliance with statutory duties or the Commissioner's directions is a criminal offence; fines range from HK$300,000 to HK$5 million, with daily fines up to HK$100,000 for continuing offences. The Commissioner has investigation and direction-issuing powers.
The Hong Kong Monetary Authority's Cybersecurity Fortification Initiative 2.0 (launched November 2020, effective from 2021) applies to all Authorized Institutions and rests on three pillars: the Cyber Resilience Assessment Framework (C-RAF 2.0), the Professional Development Programme, and the Cyber Intelligence Sharing Platform.
The Personal Data (Privacy) Ordinance (Cap. 486) contains no mandatory data-breach notification requirement; the PCPD only issues non-binding guidance. Mandatory breach notification remains a proposed PDPO amendment and has not been enacted as of 2026.
Timeline - major decisions & events
Hong Kong's first dedicated cybersecurity law comes into operation, creating statutory cyber obligations (organizational, preventive, and incident-reporting) for designated critical infrastructure operators across 8 sectors. A new Commissioner's Office begins phased designation of operators from mid-2026.
Hong Kong Government (info.gov.hk) ↗The Government gazetted the commencement notice appointing 1 January 2026 as the operative date and stood up the Office of the Commissioner of Critical Infrastructure (Computer-system Security) to administer the new regime.
OCCICS (occics.gov.hk) ↗The Legislative Council enacted Hong Kong's first cybersecurity legislation, with fines up to HK$5 million for operators that fail to secure or update critical computer systems. Marks a shift from sector guidance to binding cross-sector cyber law.
South China Morning Post ↗The Government gazetted the draft Bill on 6 December 2024 and introduced it for First Reading on 11 December, covering energy, IT, banking/finance, healthcare, telecoms, and air/land/maritime transport.
Hong Kong Government (info.gov.hk) ↗The Security Bureau, OGCIO and Police opened a one-month consultation on a proposed legal framework to regulate critical infrastructure operators and critical computer systems, the precursor to the 2025 Ordinance.
Mayer Brown ↗The Privacy Commissioner updated its guidance recommending notification of the PCPD and affected individuals as soon as practicable after a breach posing real risk of harm, still voluntary, pending a proposed mandatory regime.
PCPD ↗The Hong Kong Monetary Authority upgraded its CFI framework for banks (C-RAF assessment, professional development, intelligence sharing), effective 1 January 2021, refining the cyber resilience baseline for the banking sector.
HKMA ↗Following a breach exposing personal data of ~9.4 million passengers, the Privacy Commissioner found contraventions of PDPO data-security and retention principles and ordered remedial measures, a landmark Hong Kong data-security enforcement action.
PCPD ↗After 27 reported cyber incidents and over HK$110M in unauthorised trades, the SFC (with HKMA) mandated 20 baseline controls including two-factor authentication for online brokerage logins, a key securities-sector cyber rule.
SFC / HKMA (info.gov.hk) ↗The HKMA unveiled the CFI at the Cyber Security Summit 2016, introducing the C-RAF risk assessment framework, professional development programme, and intelligence-sharing platform, the foundation of banking-sector cyber supervision.
HKMA ↗One of Asia's earliest comprehensive data protection laws took effect, establishing data-security obligations (Data Protection Principle 4) and the PCPD, the backbone of Hong Kong's data and cyber-incident enforcement before dedicated cyber law.
PCPD ↗Hong Kong - other topics
Cybersecurity in other countries
Last verified 9/21/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →