Cyber Law at Hong Kong
Hong Kong has developed a robust legal framework to address cybersecurity and data protection, comprising the Protection of Critical Infrastructure (Computer Systems) Bill and the Personal Data (Privacy) Ordinance (PDPO). Here's an overview of these key legislations:
🛡️ Protection of Critical Infrastructure (Computer Systems) Bill
Enacted on March 19, 2025, this legislation aims to enhance the cybersecurity of critical infrastructure in Hong Kong
Key Provisions:
Scope: Applies to operators of critical infrastructure in sectors such as energy, banking, IT, healthcare, transport, communications, and broadcasting
Obligations: - Conduct annual security risk assessments - Implement security management plans - Report significant cybersecurity incidents within 12 hours - Undergo biennial independent security audits
Penalties: - Fines ranging from HK$500,000 to HK$5 million for non-compliance - Additional daily fines for persistent violations
Enforcement: The Commissioner’s Office, supported by sector-specific authorities, is empowered to investigate and enforce compliance
🔐 Personal Data (Privacy) Ordinance (PDPO)
The PDPO, established in 1995 and amended in 2021, governs the collection, use, and protection of personal data in Hong Kon.
Key Features:
Data Protection Principles:
Purpose and Manner of Collection Data must be collected for lawful purposes and in a fair manne.
Accuracy and Retention Data should be accurate and not kept longer than necessary.
Use of Data Data should be used only for the purpose for which it was collected.
Data Security Appropriate security measures must be in place to protect dat.
Openness and Transparency Data users must be transparent about their data practice.
Access and Correction Individuals have the right to access and correct their personal data.
Enforcement:
Privacy Commissioner for Personal Data (PCPD) Oversees compliance and can issue enforcement notice.
Penalties:
Fines up to HK$1 million and imprisonment for up to 5 years for serious offenses like doxxing.
Fines up to HK$50,000 for non-compliance with enforcement notices.
RELATED Blog
0 comments