Legal Update: The Protection of Critical Infrastructure (Computer Systems) Bill will come into effect on 1 January 2026
26 Mar 2025
Hong Kong SAR, China
3 min read
The Protection of Critical Infrastructure (Computer Systems) Bill was passed by Legislative Council on 19 March 2025. As Hong Kong’s first standalone legislation on enhancing the overall cybersecurity, it sets out a comprehensive regulatory framework and lays down the statutory requirements for the protection of computer systems within critical infrastructures, signifying an important step for aligning Hong Kong's cybersecurity practices with international standards, improving its global standing and attractiveness for international business and investment.
Key Takeaways from the Bill:
- Establishment of Regulatory Authorities: the Commissioner of Critical Infrastructure (Computer-system Security) will be appointed and specific entities responsible for managing and regulating critical infrastructures will be established.
- Regulating Critical Infrastructure Operators (“CI Operators”) and Critical Computer Systems: CI Operators and Critical Computer Systems will be ascertained, designated and notified by the regulatory authorities. Eight sectors, namely, energy, information technology, banking and financial services, air transport, land transport, maritime transport, healthcare services, and telecommunications and broadcasting services, fall within the definition of critical infrastructure.
- Key obligations of CI Operators: maintaining an office in Hong Kong, establishing dedicated security management units, submitting and implementing security management plans and performing regular risks assessment and audits.
Implications for Businesses:
- For large organizations that operate critical infrastructures, once designated as a CI Operator, more resources will need to be allocated for the purpose of complying with the new regulatory standards and maintaining compliance.
- For smaller businesses, if they are part of the supply chain of CI Operators, they will likely be required by CI Operators to meet the same regulatory standards. Terms of the relevant service contracts may need to be renegotiated or amended.
