Hong Kong. Cybersecurity. Ordinance
PCICSOProtection of Critical Infrastructures (Computer Systems) Ordinance
In force
Partly verified
Medium confidence.Enactment year 2025 from general knowledge; full effect 2026-01-01 per DLA Piper. [Link: official bilingual Cap. 653 on HK e-Legislation (site blocks bots; confirmed via data.gov.hk index); authority = Office of the Commissioner of CI (Computer-system Security)]
§1Summary
- Synopsis
Imposes organisational, preventive and incident-reporting duties on designated operators of critical infrastructure and their critical computer systems. It is separate from the PDPO.
- Key themes
- Unique features
Hong Kong's first statutory cybersecurity regime; obligations attach only to designated operators.
- SaaS relevance
SaaS vendors to designated CI operators will see contractual flow-down of security and reporting duties.
§2Dates
- Key dates
- Adopted
- In force
§3Text and authority
- Text
- Authoritative text elegislation.gov.hk
- Authority
- Commissioner's Office under the Security Bureau
§4Where it applies
- Domestic law of
- Hong Kong
§5Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.Enactment year 2025 from general knowledge; full effect 2026-01-01 per DLA Piper. [Link: official bilingual Cap. 653 on HK e-Legislation (site blocks bots; confirmed via data.gov.hk index); authority = Office of the Commissioner of CI (Computer-system Security)]