Hong Kong critical infrastructure ordinance (Cap. 653)

Summary

The Ordinance imposes computer-system security obligations on designated critical infrastructure operators, to reduce the risk of cyberattacks disrupting essential services in Hong Kong. It covers two categories: infrastructures providing essential services in eight sectors (energy, information technology, banking and financial services, air, land and maritime transport, healthcare, telecommunications and broadcasting) and infrastructures that maintain critical societal or economic activities, such as major sports and performance venues and research and development parks; government departments are excluded. Designated operators must keep an office in Hong Kong and a computer-system security management unit, submit a security management plan and an emergency response plan within three months of designation, carry out a risk assessment every 12 months and an independent audit every 24 months, and take part in the Commissioner's drills. Serious incidents must be notified within 12 hours and other incidents within 48 hours, with a written report within 14 days; fines reach HK$5 million, with daily fines for continuing offences.

Information

Jurisdiction

Hong Kong

Issuing body

Legislative Council of the Hong Kong Special Administrative Region

Type

Law

Available languages

English, Chinese

Topics

• Critical infrastructure
• Incident reporting
• Incident management / CSIRT
• Governance and coordination
• Energy
• Financial sector
• Health
• Telecommunications

Notes

Published in the Gazette on 28 March 2025. By Commencement Notice L.N. 144 of 2025, published on 27 June 2025, the Secretary for Security appointed 1 January 2026 as the commencement date. The Ordinance is enforced by the Office of the Commissioner of Critical Infrastructure (Computer-system Security), set up in January 2026 under the Security Bureau, together with the designated authorities for certain sectors. The generic Code of Practice was issued on 1 January 2026 and sectoral codes for energy on 28 January 2026 and for land transport on 22 June 2026. Bilingual text (English and Chinese) in the official e-Legislation database; guidance on the obligations at https://www.occics.gov.hk

Obligations compared

Cyber incident reporting Hong Kong

Legislative Council of the Hong Kong Special Administrative Region. (2025). Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) (Cap. 653). https://www.elegislation.gov.hk/hk/cap653

Legislative Council of the Hong Kong Special Administrative Region. "Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)." 28 March 2025. https://www.elegislation.gov.hk/hk/cap653.

@misc{hk_critical_infrastructures_computer_systems_ordinance_2025,
  author       = {{Legislative Council of the Hong Kong Special Administrative Region}},
  title        = {{Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)}},
  year         = {2025},
  note         = {Cap. 653},
  url          = {https://www.elegislation.gov.hk/hk/cap653},
  urldate      = {2026-10-29}
}