Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Jurisdiction

Hong Kong: data, AI and cyber laws

Part of APAC.

Regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics
In force
Hong Kong Critical Infrastructure Cyber OrdinanceHong Kong's critical infrastructure cybersecurity law. Designated critical infrastructure operators (CIOs) must keep a Hong Kong office, set up a computer-system security management unit, run risk assessments and audits, keep security and emergency plans, take part in drills, and report incidents. Serious incidents must be reported within 12 hours and other incidents within 48 hours.In effect since Jan 1, 2026
Amended
Hong Kong PDPOHong Kong's privacy law for public and private data users, built on six Data Protection Principles covering collection, accuracy and retention, use, security, openness and access. Amendments in 2012 added direct marketing rules. The 2021 amendment made doxxing a crime and gave the Privacy Commissioner powers to investigate, prosecute and order removal of doxxing content.In effect since Dec 20, 1996

Past deadlines

Takes effectJan 1 · 10 months ago
Hong Kong Critical Infrastructure Cyber OrdinancePCICSO comes into operationCommissioner's Office is established and designation of CIOs begins; obligations apply to designated operators.Hong Kong
Takes effectOct 8, 2021 · 5.1 years ago
Hong Kong PDPOAnti-doxxing amendments take effectNew doxxing offences and PCPD criminal investigation, prosecution and cessation notice powers apply.Hong Kong
Takes effectTentativeDec 20, 1996 · 29.9 years ago
Hong Kong PDPOPDPO takes effectThe PCPD says the PDPO took effect in December 1996, except certain provisions. The exact day was not confirmed on the official pages checked.Hong Kong