Hong Kong: Legislative Council's Protection of Critical Infrastructures (Computer Systems) Ordinance including local operations requirement entered into force with grace period

On 28 March 2025, the Legislative Council's Protection of Critical Infrastructures (Computer Systems) Ordinance (Ordinance No. 4 of 2025) including local operations requirement entered into force with a grace period. With its publication in the gazette, the Ordinance was officially promulgated, but it will enter into full effect on a day designated by the Secretary for Security. The Ordinance applies to operators of critical infrastructures, including infrastructure that is essential to the continuous provision of certain essential services or which, if damaged, would hinder or substantially affect critical societal or economic activities in Hong Kong. Critical infrastructure operators will be required to maintain a Hong Kong office and notify any changes to its address. Operators who fail to do so can be liable for HKD 3 million, with a continuing daily HKD 60'000 fine, on summary conviction and HKD 5 million, with a continuing daily HKD 100'000 fine, on conviction on indictment.