The Protection of Critical Infrastructures (Computer Systems) Ordinance — Cap. 653 — is the first statute in Hong Kong’s history to impose binding cybersecurity obligations. It was passed by the Legislative Council on 19 March 2025, assented to on 27 March 2025, and brought into operation in its entirety on 1 January 2026. It does not reach every company: it reaches a narrow population of designated critical infrastructure operators across eight sectors, and imposes on them three categories of duty — organisational, preventive, and incident reporting and response.