Key Takeaways
- Risk to your company: if you hold customer or staff data, the PDPO already applies; Cap 653 binds only designated critical infrastructure operators, but their suppliers inherit its demands through contracts.
- Cap 653 protects the systems behind essential services; the PDPO protects personal data. One incident can trigger both.
- Designated operators must report serious incidents within 12 hours and assess security risk every 12 months, with fines of up to HK$5 million.
- PDPO breach notification is still voluntary, but weak security can lead to an enforcement notice.
Your largest client, a bank, sends a new vendor questionnaire asking for your latest security risk assessment and incident reporting "within hours". A colleague says it is because of the new cyber security law. Is it, and does that law apply to you?
Hong Kong businesses now face two laws that are often confused: the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap 653) and the Personal Data (Privacy) Ordinance (PDPO, Cap 486).
What is the difference between Cap 653 and the PDPO?
Cap 653 is Hong Kong's critical infrastructure cyber security law: it requires designated operators of essential services to protect their critical computer systems. The PDPO is the privacy law: it requires every organisation that collects personal data to keep it secure. One protects services, the other protects people's information.
Think of an office tower. Cap 653 is the safety code for the building's power plant and lifts, written for the few companies that run them. The PDPO is the rule that every tenant must lock the cabinet of customer files. Most businesses are tenants.
The Commissioner's office says Cap 653 mainly targets large organisations, does not affect SMEs or the public, and does not target personal data. That gap is what the PDPO covers.
How do Cap 653 and the PDPO compare side by side?
The two laws differ in who they cover, what they protect, who enforces them and how incidents are reported. Cap 653 has fixed deadlines and large organisational fines; the PDPO relies on broad principles, investigations and enforcement notices, with breach notification still voluntary today.
| Cap 653 (critical infrastructure) | PDPO (personal data) | |
|---|---|---|
| In force | 1 January 2026 | Since 1996, amended since |
| Who it covers | Only operators designated by the Commissioner | Any organisation that collects or holds personal data |
| What it protects | Critical computer systems behind essential services | Personal data of customers, staff and others |
| Regulator | Commissioner, with HKMA and the Communications Authority for their sectors | Privacy Commissioner for Personal Data (PCPD) |
| Incident reporting | Mandatory: 12 hours for serious incidents, 48 hours for others, written report within 14 days | Voluntary notification to the PCPD |
| Assessments | Risk assessment every 12 months, independent audit every 24 months | No fixed schedule; "all practicable steps" to secure data |
| Maximum fines | HK$500,000 to HK$5 million, plus daily fines in some cases | Breaching an enforcement notice: HK$50,000 and up to 2 years' imprisonment on first conviction |
Sources: OCCICS obligations and penalties, read 12 November 2026; CLIC.
Who must comply with Cap 653?
Only organisations formally designated as critical infrastructure operators. Designation covers eight sectors, including energy, banking and financial services, transport, healthcare and telecommunications, plus certain other infrastructures the government treats as essential. If you have not received a designation notice, Cap 653 does not bind you directly.
The sectors are energy, information technology, banking and financial services, air, land and maritime transport, healthcare, and telecommunications and broadcasting (Baker McKenzie).
What designated operators must do
- Set up a security management unit led by a qualified employee
- Submit a security plan and an emergency response plan within 3 months
- Assess security risk within 12 months, then at least yearly
- Arrange an independent audit within 24 months, then at least every 24 months
- Report serious incidents within 12 hours, others within 48 hours
Penalties fall on the organisation, not individual staff (OCCICS).
Why can Cap 653 still affect a company that is not designated?
Because designated operators must manage risk across their critical systems, and many of those systems are built, hosted or maintained by suppliers. Operators therefore pass requirements down through contracts: faster incident reporting, evidence of risk assessments, audit rights and named security contacts.
Law firm Hugill & Ip called this the "supply chain ripple" in April 2026. For many suppliers, the real deadline is set by the client contract, not the statute.
A company scenario
A 40-person IT firm in Kwun Tong maintains a booking system for a private hospital group. Its contract now says any suspected incident must be reported within 6 hours. An engineer spots odd logins late on a Friday but mentions them on Monday. No data was lost, yet the firm has breached its contract.
The fix is a company rule: any suspected security incident goes to one named owner within 1 hour, day or night.
What does the PDPO require for data security?
Data Protection Principle 4 requires every data user to take all practicable steps to protect personal data against unauthorised or accidental access, processing, loss or use. That covers access control, staff training, vendor contracts and retention. What counts as practicable depends on how sensitive the data is and the harm a leak could cause.
Notification is not mandatory: the PCPD's breach form is voluntary. But the Commissioner can investigate, and ignoring a resulting enforcement notice is a criminal offence. Mandatory notification has been discussed since 2020 but is not law at the time of writing.
Incidents are common: HKCERT handled 4,404 in Q3 2026, up from 3,839 a year earlier.
What are the most common misunderstandings about the two laws?
The biggest mistakes are assuming Cap 653 applies to every company, assuming it replaces the PDPO, and assuming that no mandatory reporting means no consequences. In reality the laws sit side by side, and one incident at a designated operator can trigger duties under both.
- "Cap 653 covers all businesses." No, only designated operators.
- "Cap 653 replaced the PDPO." No, the PDPO still applies in full.
- "The PDPO has a 72-hour breach rule." No, that is the EU's GDPR.
- "If we are not designated, we can ignore it." Risky: client contracts may impose similar duties.
What should your company do if a security incident happens?
Contain the problem without deleting evidence, tell your named incident owner at once, check your client contracts for reporting deadlines, and decide whether personal data is involved. Report to HKCERT for technical help, and consider notifying the PCPD and affected people if personal data may have leaked.
HKCERT's 24-hour hotline is 8105 6060, or use its online report form (checked 12 November 2026).
Staff notice you can copy into your team chat
Team notice: if you see anything unusual on our systems (strange logins, locked files, client data sent by mistake), tell [name] on [phone] straight away, even at night.
Do not delete anything or try to fix it yourself.
Some clients require us to report within hours, so speed matters.
Thank you.60-second self-check
- Do we know which clients are designated operators?
- Have we read every incident clause in our contracts?
- Is there one named incident owner with a backup?
- Have we done a risk assessment in the last 12 months?
- Do staff know not to delete evidence?
Know which law you are answering to
For most Hong Kong businesses the PDPO applies today, and Cap 653 arrives through larger clients. Borrow the Cap 653 rhythm, a yearly risk assessment and a clear reporting path, even if you are never designated. It answers client questionnaires and the PDPO's "all practicable steps" test at the same time.
Have an independent risk assessment ready before clients ask
A Security Risk Assessment and Audit (SRAA) combines the two exercises Cap 653 asks of designated operators, a risk assessment and a security audit, into one independent report. It gives you evidence for client questionnaires and your PDPO security duties, carried out by a 100% Hong Kong-based team.
Book a Compliance Consultation
Frequently Asked Questions
Does Cap 653 apply to small and medium enterprises?
Not directly. The Commissioner's office states that the Ordinance mainly targets large organisations and does not affect SMEs or the general public. SMEs that supply designated operators may still face similar demands through contracts.
How do I know if my company has been designated under Cap 653?
Designation is made by written notice from the Commissioner or the relevant sector regulator. If your organisation has not received one, it is not a designated operator, though you can ask your clients whether they are.
Is data breach notification mandatory in Hong Kong?
Not under the PDPO today. Notifying the PCPD is voluntary, though strongly encouraged. Designated operators under Cap 653 must report computer-system security incidents within 12 or 48 hours, which is a separate duty.
Can one incident trigger both Cap 653 and the PDPO?
Yes. If a ransomware attack disrupts a designated hospital's systems and exposes patient records, the operator faces Cap 653 reporting deadlines and also PDPO security duties for the personal data involved.