Hong Kong Passes Cybersecurity Law to Protect Critical Infrastructure
Hong Kong has passed a cybersecurity law requiring operators of critical infrastructure to strengthen computer systems and report security incidents or face penalties of up to HKD 5 million ($640,000).
The law, set to take effect in 2026, aims to safeguard computer systems essential to the city's infrastructure, Security Secretary Chris Tang said. He emphasised that the law does not target personal information or commercial secrets.
The Security Bureau told the legislative council that disruptions or sabotage of these systems could severely impact society, the economy, public safety, and national security.
The legislation applies to eight industries, including banking, financial services, information technology, energy, transport, healthcare, and communications. It also covers major sports and performance venues, as well as research and development parks.
Authorities will notify affected operators but will not publicly identify them to prevent them from becoming targets, Tang said.
The law mandates annual security risk assessments and independent security audits every two years. Serious security incidents must be reported within two hours.
Non-compliance could result in fines ranging from HKD 500,000 (USD 64,000) to HKD 5 million (USD 640,000), with additional daily fines for continued violations.
George Chen, co-chair of digital practice at consulting firm the Asia Group, warned that the law could increase compliance costs for data centres and potentially deter foreign investors. He noted that some investors may see Hong Kong entering a "busy cycle of legislation" following the national security laws passed in 2020 and 2024.
Hong Kong had not previously enacted a cybersecurity law, unlike mainland China, which introduced one in 2016.
Hong Kong passed a cybersecurity law to protect critical infrastructure.
The law takes effect in 2026 and mandates security measures and incident reporting.
Non-compliance could result in fines of up to HKD 5 million.
Source: REUTERS