Cybersecurity law & regulation in Hong Kong (2026)

Legal framework

Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) enforced by the Office of the Commissioner of Critical Infrastructure (Computer-system Security) (OCCICS); Personal Data (Privacy) Ordinance (Cap. 486) under the PCPD; HKMA Cybersecurity Fortification Initiative (CFI) 2.0 for authorized institutions

Key points: cybersecurity in Hong Kong

1. 01Critical infrastructure cyber law in force

   The Protection of Critical Infrastructures (Computer Systems) Ordinance was passed by LegCo on 19 March 2025 and commenced on 1 January 2026, alongside establishment of the Office of the Commissioner of Critical Infrastructure (Computer-system Security). It imposes organisational, preventive and incident-response duties on designated CIOs.

   info.gov.hk occics.gov.hk

2. 02Eight designated sectors

   The Ordinance covers CIOs in energy, information technology, banking and financial services, air transport, land transport, maritime transport, healthcare services, and telecommunications and broadcasting. The Government expects phased designation of CIs and critical computer systems from mid-2026.

   mayerbrown.com nsfocusglobal.com

3. 03Incident reporting duties

   Designated CIOs must report serious computer-system security incidents to the Commissioner within 12 hours of becoming aware, and other reportable incidents within 48 hours, in line with the Code of Practice issued by OCCICS on 1 January 2026.

   occics.gov.hk mayerbrown.com

4. 04Penalties and enforcement

   Non-compliance with statutory duties or the Commissioner's directions is a criminal offence; fines range from HK$300,000 to HK$5 million, with daily fines up to HK$100,000 for continuing offences. The Commissioner has investigation and direction-issuing powers.

   connectontech.bakermckenzie.com china-briefing.com

5. 05Banking sector: HKMA CFI 2.0

   The Hong Kong Monetary Authority's Cybersecurity Fortification Initiative 2.0 (launched November 2020, effective from 2021) applies to all Authorized Institutions and rests on three pillars: the Cyber Resilience Assessment Framework (C-RAF 2.0), the Professional Development Programme, and the Cyber Intelligence Sharing Platform.

   hkma.gov.hk info.gov.hk

6. 06Data-breach notification still voluntary

   The Personal Data (Privacy) Ordinance (Cap. 486) contains no mandatory data-breach notification requirement; the PCPD only issues non-binding guidance. Mandatory breach notification remains a proposed PDPO amendment and has not been enacted as of 2026.

   pcpd.org.hk hfw.com

Timeline of decisions

1. 1 Jan 2026Law · official
   Protection of Critical Infrastructures (Computer Systems) Ordinance takes effect

   Hong Kong's first dedicated cybersecurity law comes into operation, creating statutory cyber obligations (organizational, preventive, and incident-reporting) for designated critical infrastructure operators across 8 sectors. A new Commissioner's Office begins phased designation of operators from mid-2026.

   Hong Kong Government (info.gov.hk)

2. 27 Jun 2025Guidance · official
   Commencement notice sets Jan 1, 2026 effective date; OCCICS established

   The Government gazetted the commencement notice appointing 1 January 2026 as the operative date and stood up the Office of the Commissioner of Critical Infrastructure (Computer-system Security) to administer the new regime.

   OCCICS (occics.gov.hk)

3. 19 Mar 2025Law
   LegCo passes the Protection of Critical Infrastructures (Computer Systems) Bill

   The Legislative Council enacted Hong Kong's first cybersecurity legislation, with fines up to HK$5 million for operators that fail to secure or update critical computer systems. Marks a shift from sector guidance to binding cross-sector cyber law.

   South China Morning Post

4. 6 Dec 2024Law · official
   Critical Infrastructures cybersecurity bill gazetted and introduced to LegCo

   The Government gazetted the draft Bill on 6 December 2024 and introduced it for First Reading on 11 December, covering energy, IT, banking/finance, healthcare, telecoms, and air/land/maritime transport.

   Hong Kong Government (info.gov.hk)

5. 2 Jul 2024Guidance
   Public consultation launched on critical infrastructure cyber framework

   The Security Bureau, OGCIO and Police opened a one-month consultation on a proposed legal framework to regulate critical infrastructure operators and critical computer systems, the precursor to the 2025 Ordinance.

   Mayer Brown

6. 3 Nov 2020Guidance · official
   HKMA launches Cybersecurity Fortification Initiative 2.0

   The Hong Kong Monetary Authority upgraded its CFI framework for banks (C-RAF assessment, professional development, intelligence sharing), effective 1 January 2021, refining the cyber resilience baseline for the banking sector.

   HKMA

7. 6 Jun 2019Enforcement · official
   PCPD issues enforcement notice against Cathay Pacific over 2018 breach

   Following a breach exposing personal data of ~9.4 million passengers, the Privacy Commissioner found contraventions of PDPO data-security and retention principles and ordered remedial measures, a landmark Hong Kong data-security enforcement action.

   PCPD

8. 27 Oct 2017Guidance · official
   SFC issues guidelines to reduce hacking risks in internet trading

   After 27 reported cyber incidents and over HK$110M in unauthorised trades, the SFC (with HKMA) mandated 20 baseline controls including two-factor authentication for online brokerage logins, a key securities-sector cyber rule.

   SFC / HKMA (info.gov.hk)

9. 18 May 2016Guidance · official
   HKMA launches Cybersecurity Fortification Initiative for banks

   The HKMA unveiled the CFI at the Cyber Security Summit 2016, introducing the C-RAF risk assessment framework, professional development programme, and intelligence-sharing platform, the foundation of banking-sector cyber supervision.

   HKMA

Sources

1. 1.info.gov.hk/gia/general/202412/04/P2024120400297.htm
2. 2.occics.gov.hk/en/home/index.html
3. 3.occics.gov.hk/filemanager/en/content_19/CoP_en_v1.0.pdf
4. 4.mayerbrown.com/en/insights/publications/2025/07/hong-kong-passes-first-cybersecurity
5. 5.mayerbrown.com/en/insights/publications/2026/01/hong-kong-issues-code-of-practice-un
6. 6.hkma.gov.hk/eng/news-and-media/press-releases/2020/11/20201103-4/
7. 7.pcpd.org.hk/english/data_privacy_law/ordinance_at_a_Glance/ordinance.html
8. 8.connectontech.bakermckenzie.com/hong-kongs-new-cyber-law-protection-of-critical-infrastructures-compu
9. 9.nsfocusglobal.com/hong-kongs-new-critical-infrastructure-ordinance-will-be-effective-by
10. 10.china-briefing.com/news/hong-kong-cybersecurity-law-critical-infrastructure/
11. 11.info.gov.hk/gia/general/202011/03/P2020110300671.htm
12. 12.hfw.com/insights/a-new-era-for-data-protection-in-hong-kong-legislative-updat