Hong Kong: Updates to cybercrime and cybersecurity laws

In brief

The rapid development in technology has brought about an increasing number of cyberattacks and cybercrimes in recent years, resulting in significant challenges for law enforcement and also to the cybersecurity of critical information infrastructures (CIIs). This has highlighted the need for more robust, updated and comprehensive cyber legislation in Hong Kong. 

While Hong Kong has yet to enact specific legislation on cybercrime or cybersecurity, this will soon change with the announcement of the proposal to enact a new cybersecurity law during the Chief Executive’s 2021 Policy Address (“2021 Policy Address“) and the issuance of a consultation paper on “Cyber-dependent crimes and jurisdictional issues” (“Consultation Paper“) by the Hong Kong Law Reform Commission (HKLRC). Further details on the proposed cyber legislation are provided below.


  1. Key takeaways
  2. Cybercrime 
  3. Cybersecurity
  4. Next steps

The HKSAR government’s proposal to enact new cybersecurity legislation and the Consultation Paper’s five new proposed cybercrime offences (“New Cybercrime Offences“) signify a shift towards adopting a strategy of enhanced protection from both criminal and regulatory perspectives. Such developments in the cyberspace stem from Hong Kong’s duty under Article 9 of the National Security Law to take necessary measures to strengthen regulation over matters concerning national security (including the internet) and the potential criminal exploitation of the rapid developments in information technology, computer and computer data. 

The introduction of the New Cybercrime Offences will provide the law enforcement agencies, and hence entities/individuals impacted by cybercrimes, with enhanced tools to pursue the perpetrators. A key takeaway is the possible extra-territorial application of the New Cybercrime Offences. Under the Consultation Paper, the HKLRC suggests that the nature of cybercrime justifies the extra-territorial application of Hong Kong law. It recommends that Hong Kong courts should have jurisdiction where there is a nexus to Hong Kong (e.g., where the victim is from Hong Kong or where damages are incurred in Hong Kong). See…