Hong KongProtection of Critical Infrastructures (Computer Systems) Ordinance, Incident Notification
Cap. 653, s. 28 and Schedule 6 (Protection of Critical Infrastructures (Computer Systems) Ordinance)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds only an organization designated as a CI operator by written notice, which you reach by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services (sections 12 and 28).
- Notify the Commissioner as soon as practicable, and within 12 hours after becoming aware of a computer-system security incident that has disrupted, is disrupting or is likely to disrupt the core function of the critical infrastructure, or within 48 hours in any other case (section 28(1), (2) and Schedule 6).
- If you did not notify in the form and way the regulating authority specified, submit a written record of the incident in that form within 48 hours after the notification (section 28(3) and Schedule 6).
- Submit a written report of the incident in the specified form and way to the Commissioner within 14 days after the date you become aware of it (section 28(4) and Schedule 6).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
A failure to notify, to submit the written record or to submit the written report is an offence punishable by a fine, on conviction on indictment, of HKD 5,000,000.
Penalty structure
On conviction on indictment; the fine on summary conviction is HKD 3,000,000. Section 28 sets no daily fine.
- Rule
- Fixed only
- As of
- Currency
- HKD
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
The Commissioner of Critical Infrastructure (Computer-system Security).
Settledness
- As of
- Open questions
- Which form and way has the Commissioner specified under section 10 for a notification under section 28(2), and is a notification that is not in that form, but states the nature of the incident and identifies the critical computer system, enough to start the 48-hour clock for the written record?
What this law does
A CI operator that becomes aware that a computer-system security incident has occurred in respect of a critical computer system of a critical infrastructure it operates must notify the Commissioner of the incident. A computer-system security incident is an event that involves access, without lawful authority, to the critical computer system, or another act done without lawful authority on or through it, and has an actual adverse effect on its computer-system security.
The notification is due 12 hours after becoming aware of the incident if it disrupts or is likely to disrupt the core function of the critical infrastructure. In any other case the notification is due 48 hours after becoming aware of the incident. If the notification is not made in the specified form and way, the operator must subsequently submit a written record of the incident to the Commissioner within the specified time.
The specified time for the written record is 48 hours after the notification. The operator must further submit a written report of the incident to the Commissioner within the specified time. The specified time for the written report is 14 days after the operator becomes aware of the incident. Failure to comply is an offence with a fine of 3,000,000 dollars on summary conviction and 5,000,000 dollars on conviction on indictment.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.