Are You Ready For The 1st Hong Kong Cybersecurity Law?

Key Takeaways:

• On 19 March 2025, the Protection of Critical Infrastructures (Computer Systems) Bill (the "Bill") was passed in Hong Kong, which aims to strengthen the security of the critical computer systems of "critical infrastructure".
• Infrastructures that deliver essential services in Hong Kong or maintain important societal and economic activities are "critical infrastructure" under the Bill.
• The Bill imposes statutory obligations on designated operators of critical infrastructure that emphasise risk assessment, incident reporting and security measures.
• The office of the Commissioner of Critical Infrastructure (Computer-System Security), entrusted with investigation powers to regulate compliance, will be established within one year after the passage of the Bill, with the new legislation coming into force within six months thereafter.