Digital Policy Alert logo

Hong Kong: Local operations requirement in Protection of Critical Infrastructures (Computer Systems) Ordinance (Ordinance No. 4 of 2025)

Progress

Current status
in grace period
01 Jan 2026 in force
28 Mar 2025 in grace period
19 Mar 2025 adopted
06 Dec 2024 under deliberation

Scope

Implementers
Hong Kong
Policy Area
Other operating conditions
Policy Instrument
Local operations requirement
Regulated Economic Activity
infrastructure provider: internet and telecom services
infrastructure provider: cloud computing, storage and databases
infrastructure provider: network hardware and equipment
infrastructure provider: other
Government Branch
executive
legislature
Government Body
central government
parliament
Implementation Level
national

Timeline of events

01 Jan 2026
in force

Legislative Council's Protection of Critical Infrastructures (Computer Systems) Ordinance including local operations requirement enters into force

On 1 January 2026, the Legislative Council's Protection of Critical Infrastructures (Computer Systems) Ordinance (Ordinance No. 4 of 2025) including local operations requirement enters into force following designation by the Secretary for Security. …

Source
Event type law
Action type implementation
Government branch executive
Government body central government
28 Mar 2025
in grace period

Legislative Council's Protection of Critical Infrastructures (Computer Systems) Ordinance including local operations requirement entered into force with grace period

On 28 March 2025, the Legislative Council's Protection of Critical Infrastructures (Computer Systems) Ordinance (Ordinance No. 4 of 2025) including local operations requirement entered into force with a grace period. With its publication in the gaze…

Source
Event type law
Action type in force with grace period
Government branch legislature
Government body parliament
19 Mar 2025
adopted

Protection of Critical Infrastructures (Computer Systems) Ordinance including local operations requirement adopted by Legislative Council

On 19 March 2025, Protection of Critical Infrastructures (Computer Systems) Ordinance (Ordinance No. 4 of 2025) including local operations requirement was adopted by the Legislative Council. The Ordinance applies to operators of critical infrastruct…

Source
Event type law
Action type adoption
Government branch legislature
Government body parliament
06 Dec 2024
under deliberation

Protection of Critical Infrastructures (Computer Systems) Ordinance including local operations requirement introduced to Legislative Council

On 6 December 2024, Protection of Critical Infrastructures (Computer Systems) Ordinance (Ordinance No. 4 of 2025) including local operations requirement was introduced to the Legislative Council. The Ordinance would apply to operators of critical in…

Source
Event type law
Action type introduction
Government branch legislature
Government body parliament