What are the Hong Kong Critical Infrastructure Cyber Ordinance compliance deadlines?

Jan 1, 2026: PCICSO comes into operation.

What are the penalties under Hong Kong Critical Infrastructure Cyber Ordinance?

Fines from HKD 300,000 up to HKD 5 million, plus daily fines for continuing offences.

Hong Kong Critical Infrastructure Cyber Ordinance

In force Hong Kong · In force Jan 1, 2026 · no upcoming deadlines

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Takes effectJan 1 · 10 months ago · Source

PCICSO comes into operationCommissioner's Office is established and designation of CIOs begins; obligations apply to designated operators.

Summaries for reference, not legal advice. Check the official text.

What it does

Hong Kong's critical infrastructure cybersecurity law. Designated critical infrastructure operators (CIOs) must keep a Hong Kong office, set up a computer-system security management unit, run risk assessments and audits, keep security and emergency plans, take part in drills, and report incidents. Serious incidents must be reported within 12 hours and other incidents within 48 hours.

Who it applies to: Operators designated by regulators in 8 sectors: energy, IT, banking and financial services, air transport, land transport, maritime transport, healthcare, and telecommunications and broadcasting (plus other infrastructure critical to society). Only designated CIOs and their designated critical computer systems are covered.
Penalties: Fines from HKD 300,000 up to HKD 5 million, plus daily fines for continuing offences.
Enforced by: Commissioner of Critical Infrastructure (Computer-system Security) under the Security Bureau; Hong Kong Monetary Authority and Communications Authority as designated authorities for their sectors
Official name: Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)
Citation: Cap. 653
Topics: Cybersecurity, Breach notification

Verified 2026-09-22 info.gov.hk coms-auth.hk mayerbrown.com

Research notes

Gazetted 28 Mar 2025 (the date used as enacted_date); commencement notice gazetted 27 Jun 2025. Duties for each operator run from its designation date, so there is no fixed calendar deadline. The penalty range comes from the Baker McKenzie summary. Reporting windows come from the Code of Practice via Mayer Brown.

In forceAustralia

Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024

AmendedAustralia

Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days

AmendedAustralia

Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018

In forceChina

China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025

AmendedChina

China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017

In forceChina

China Data Export Security Assessment MeasuresSets the CAC security assessment that must be passed before certain data leaves China, including exports of important data and large-scale personal information exports. Data handlers must run a self-assessment, then apply through the provincial CAC for a national CAC review. Transfers already under way had six months to come into compliance.In effect since Sep 1, 2022

In forceChina

China Data Security LawSets up China's data classification and grading system, with heightened protection for 'important data' and 'core data'. Requires data processors to run data security management systems, risk monitoring and incident handling, and restricts giving data stored in China to foreign judicial or law-enforcement bodies without approval.In effect since Sep 1, 2021

In forceChina

China Data Security Risk Assessment MeasuresImplements the annual risk assessment duty for important data handlers under the DSL and Network Data Security Regulations. Important data handlers must assess risk every year and submit the report to their regulator within 20 working days of finishing; general data handlers are encouraged to assess at least every 3 years. Regulators can order an assessment by a certified third party after serious risks or large leaks.In effect since Aug 20, 2026

Questions about Hong Kong Critical Infrastructure Cyber Ordinance

What are the Hong Kong Critical Infrastructure Cyber Ordinance compliance deadlines?: Jan 1, 2026: PCICSO comes into operation.
When does Hong Kong Critical Infrastructure Cyber Ordinance take effect?: Hong Kong Critical Infrastructure Cyber Ordinance took effect on Jan 1, 2026.
Who does Hong Kong Critical Infrastructure Cyber Ordinance apply to?: Operators designated by regulators in 8 sectors: energy, IT, banking and financial services, air transport, land transport, maritime transport, healthcare, and telecommunications and broadcasting (plus other infrastructure critical to society). Only designated CIOs and their designated critical computer systems are covered.
What are the penalties under Hong Kong Critical Infrastructure Cyber Ordinance?: Fines from HKD 300,000 up to HKD 5 million, plus daily fines for continuing offences.

Deadlines

What it does

Related