Legco passes bill enhancing cybersecurity of critical infrastructure

On Wednesday, the Legislative Council endorsed a bill aimed at boosting the cybersecurity of critical infrastructure in Hong Kong, including banks, railway networks, electricity providers, and technology parks. The government expects the new legislation to take effect on January 1, 2026.

The Protection of Critical Infrastructures (Computer Systems) Bill passed its third reading with the support of over half of the lawmakers. The new law identifies two types of critical infrastructure: those delivering “essential services” across eight sectors, including energy, information technology, banking and finance, land and air transport, maritime, healthcare, and communications. Another type covers facilities maintaining important societal and economic activities, such as major sports and performance venues, as well as technology zones.

Operators of these infrastructures are required to establish a computer-system security management unit, formulate cybersecurity plans, conduct regular risk assessments at least once a year, participate in drills, and report any security incidents to the government. For serious breaches that “disrupt the core function of the critical infrastructure,” operators must notify the government within 12 hours of becoming aware of the incident. In other cases, they should report within 48 hours.

Penalties for non-compliance will include fines, with maximum levels ranging from HK$500,000 to HK$5 million, and additional daily fines for persistent non-compliance for certain offenses.

Speaking at LegCo, Secretary for Security Chris Tang Ping-keung emphasized that the legislation aims to maintain the normal functioning of society and the everyday lives of its citizens in the face of cyberattacks, thereby enhancing the city’s overall cybersecurity. Tang also mentioned that a new commissioner’s office will be established to monitor operators of critical infrastructure and follow up on non-compliance. The government will begin designating the operators and their computer systems starting mid-June.

Lawmaker Elizabeth Quat Pei-fan welcomed the passage of the bill, highlighting that critical infrastructure has emerged as a new battleground in national security due to escalating geopolitical risks, underscoring the pressing need for such legislation. However, legal sector lawmaker Ambrose Lam San-keung noted that there is room for improvement in the bill, such as expanding the scope of critical infrastructure to cover vehicle smart systems and empowering authorities to take over compromised systems.

Lawmaker Carmen Kan Wai-mun, chair of the bill committee for the legislation, pointed out that the new law does not apply to the government. Therefore, she called on authorities to safeguard their cybersecurity through administrative measures.