Provides telecom services, in Hong Kong

Implementation Rules for Article 43 of the Law of the People's Republic of China on Safeguarding National Security in the Hong Kong Special Administrative Region (Instrument A303), Schedule 4 · Read the law's page

• Take a disabling action on an electronic message when a designated officer requires it of you as platform service provider, before the deadline the officer specifies; a disabling action is removing the message, or restricting or ceasing access to it via the platform (Sch. 4, ss. 5(1), 7(3)).
• If you host stored material posted on an electronic platform, take a disabling action when the designated officer requires it because the platform service provider could not practicably be required to act or failed to comply (Sch. 4, ss. 3, 5(2), 7(4)(b)).
• If you supply an internet service or a specified network service available to end-users in Hong Kong, restrict or cease access to the message, or to the part or whole of the platform, when the designated officer requires it in the cases section 7(5)(b) describes (Sch. 4, ss. 4, 5(3), 7(5)(b), 14(4)).
• Provide the identification record, meaning the record of the identity of the person who published the message, or decryption assistance, when a police officer requires it under section 9 (Sch. 4, s. 9(3), (4)).
• Keep an address, including an email address, for receiving correspondence: a requirement or notification is issued to you once it is sent to that address, or by an electronic message if you provide none (Sch. 4, s. 15).

Telecommunications (Registration of SIM Cards) Regulation (Cap. 106 sub. leg. AI), ss. 5-7, 9 and 11-13 · Read the law's page

• Keep a SIM card inactive unless it is currently registered with you as the specified licensee (section 5).
• Register a SIM card only when the person has given all the specified information and you have no reasonable cause to believe it incomplete, contradictory, false or misleading, and keep each individual to no more than 10, and each business registration holder to no more than 25, pre-paid SIM cards registered with you (sections 6 and 7).
• Deregister a SIM card when you have reasonable cause to believe the registered information is incomplete or false, after giving the person reasonable steps to rectify it (section 9).
• Keep a record of each SIM card and its registered information while it is registered and for 1 year afterwards (section 11).
• Provide a SIM card record to a law enforcement officer who presents a magistrate's warrant, or who is authorized in writing by a senior officer under section 13, as soon as practicable (sections 12 and 13).

Cap. 653, s. 28 and Schedule 6 (Protection of Critical Infrastructures (Computer Systems) Ordinance) · Read the law's page

• This binds only an organization designated as a CI operator by written notice, which you reach by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services (sections 12 and 28).
• Notify the Commissioner as soon as practicable, and within 12 hours after becoming aware of a computer-system security incident that has disrupted, is disrupting or is likely to disrupt the core function of the critical infrastructure, or within 48 hours in any other case (section 28(1), (2) and Schedule 6).
• If you did not notify in the form and way the regulating authority specified, submit a written record of the incident in that form within 48 hours after the notification (section 28(3) and Schedule 6).
• Submit a written report of the incident in the specified form and way to the Commissioner within 14 days after the date you become aware of it (section 28(4) and Schedule 6).

Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), ss. 12, 19 to 27, 55 and 65 · Read the law's page

• This binds only an organization designated as a CI operator by written notice (section 12) because it operates an infrastructure essential to an essential service in energy, information technology, banking and financial services, air or land or maritime transport, healthcare, or telecommunications and broadcasting (Schedule 1), which you reach by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services; a software vendor that is not designated is reached only through the supplier-contract policies a designated operator must include in its plan (Schedule 3, Part 1, section 3(h)).
• Maintain in Hong Kong an office that you occupy for carrying on your business, and notify the regulating authority of its address within 1 month after your designation date (section 19).
• Notify the regulating authority of a change of the organization that operates the critical infrastructure as soon as practicable and in any event within 1 month after the change (section 20).
• Maintain a computer-system security management unit, set up by you or by an engaged service provider, supervised by an employee with adequate professional knowledge of computer-system security, and notify the regulating authority of that appointment (section 21).
• Notify the regulating authority within 1 month after the date a material change occurs to the design, configuration, security or operation of a critical computer system, a critical computer system is removed, or a computer system essential to the core function is added (section 22).
• Submit a computer-system security management plan covering the matters in Schedule 3 within 3 months after your designation date, submit each revision within 1 month, and implement the plan (section 23).
• Conduct a computer-system security risk assessment within 12 months after your designation date and at least once every 12 months afterwards, and submit its report within 3 months after the period for the assessment ends (section 24).
• Arrange a computer-system security audit within 24 months after your designation date and at least once every 24 months afterwards, and submit its report within 3 months after the period for the audit ends (section 25).
• Submit an emergency response plan covering the matters in Part 2 of Schedule 3 to the Commissioner within 3 months after your designation date, submit each revision within 1 month, and implement the plan (section 27).
• Participate in a computer-system security drill when the Commissioner requires it after giving reasonable notice in writing (section 26).

Telecommunications Ordinance (Cap. 106), s. 24 · Read the law's page

• If you are a telecommunications officer or have official duties in connection with a telecommunications service, do not wilfully destroy, secrete, alter or forge a message, wilfully abstain from transmitting, intercept, detain or delay it, or copy it or disclose it or its purport to anyone but the addressee, except in pursuance of duty or as a court directs (section 24(1)).