Compliance
Hong Kong's cybersecurity rules now have teeth
The Critical Infrastructure Ordinance is in force, the privacy regime is tightening, and financial regulators are raising the bar. Here is the map — and where the spend is going.
The landscape
Three regimes, one direction
In force January 2026
Critical Infrastructure Ordinance
Hong Kong's first standalone cybersecurity law. Eight sectors — energy, IT and data centres, banking, air, land and maritime transport, healthcare, and telecom — face designated-operator duties: a 12-hour serious-incident clock, annual risk assessments, independent audits, and emergency-response plans.
Privacy Commissioner (PCPD)
PDPO — personal data
Six Data Protection Principles govern how personal data is collected, secured, used and corrected. No GDPR-style administrative fines — enforcement is via notices and criminal doxxing offences — but the PCPD expects prompt, voluntary breach reporting.
HKMA · SFC · IA
Financial regulators
The HKMA's CFI and OR-2 govern banks, the SFC's cloud and AI-cyber guidance binds brokers, and GL20 gives insurers a 72-hour incident window. Regulated finance buys resilience on the regulator's clock.
What it means for your stack
Compliance maps onto the three domains we carry
Identity security & resilience
The PDPO security principle, HKMA and SFC identity expectations, and recovery requirements put the directory layer first. ITDR, Active Directory recovery, agentless MFA and non-human identity are where auditors start.
PDPO · HKMA CFI · SFC
Cloud-native & runtime security
HKMA cloud guidance, the SFC's AI-cyber circular and the Ordinance's 'accessible from Hong Kong' test pull cloud workloads into scope. Runtime protection — not just perimeter — is now a compliance question.
HKMA · SFC · Critical Infrastructure Ordinance
OT / ICS security
Energy, transport and telecom operators sit on the Ordinance's 12-hour clock. OT-native defence, zero-trust segmentation and industrial visibility are what a designated operator has to prove.
Critical Infrastructure Ordinance
The stakes
A widening gap
15,877
security incidents in Hong Kong in 2025 — up 27% year on year
60%
of incidents are phishing
29%
of SMEs have privileged access management in place
12 hrs
to report a serious critical-infrastructure incident
Local help for a local compliance regime
Hong Kong's rules reward on-the-ground knowledge. Talk to us about how we help vendors and resellers serve the compliance-driven buyers.