Hong Kong’s national security law and the quiet expansion of digital risk

While the law itself is not new, these latest changes materially affect how organisations should assess data and travel risk for employees who operate in, travel to, or transit through Hong Kong.

What’s changed?

The National Security Law has, since its introduction, provided Hong Kong authorities with expansive powers to counter perceived threats to state security, including acts of secession, subversion, terrorism and collusion with foreign entities. The March 2026 amendment does not redefine those offences. Instead, it strengthens the mechanisms through which evidence, networks and intent can be identified.

Under the amended rules:

• Individuals can be legally required to provide passwords or decryption assistance for all personal electronic devices, including mobile phones and laptops.
• Refusal to comply is now a criminal offence, punishable by up to one year in prison and a fine of HK$100,000.
• Providing false or misleading information carries even harsher penalties - up to three years’ imprisonment and a HK$500,000 fine.
• Authorities, including customs officers, may confiscate devices as evidence.
• Devices suspected of containing material with “seditious intent” may be seized even if no arrest is made.

Importantly, these measures apply to anyone who owns, controls, or is authorised to access a device, including travellers arriving at or transiting through Hong Kong International Airport.

Who’s most at risk?

Enforcement of the National Security Law has historically been selective rather than indiscriminate. Precedent indicates that individuals who attract attention from the authorities tend to have politically exposed, activist, or otherwise controversial profiles. Activists, journalists and academics therefore remain at higher risk under the amended rules.

However, the revised implementation rules widen exposure for travellers more generally. Any individual who fails to comply with official instructions, provides false information, or is perceived to mislead the authorities is liable to punishment, regardless of profession or intent. While device seizure or detention of travellers is not expected to become routine, it remains plausible where non‑compliance, sensitive data, or perceived obstruction is involved.

Political context and enforcement outlook

The March amendment is consistent with the broader pattern of repression that followed the 2019–2020 anti‑government protests and the introduction of the National Security Law. Since 2019, more than 385 individuals have been arrested on national security‑related charges, reflecting a sustained tightening of political control.

The authorities continue to argue that these measures are necessary to preserve order and protect national security. However, the absence of meaningful judicial oversight has reinforced concerns among international observers regarding Hong Kong’s deteriorating political environment. The latest changes should therefore be understood as part of a longer‑term consolidation of enforcement powers, rather than a one‑off response.

Despite this trajectory, the risk of associated protests or wider civil unrest remains low. The sustained suppression of opposition activity in recent years has significantly reduced the likelihood of public mobilisation in response to further legal tightening.

What this means for businesses

For organisations, the key risk is not widespread detentions, but unprepared employees - particularly those travelling with:

• Sensitive corporate data
• Personal communications that could be misinterpreted
• Devices shared across teams or jurisdictions

Organisations with staff in Hong Kong - or travelling through it - should take proactive steps:

Before travel

• Ensure employees understand local legal obligations, including digital access requirements.
• Review what data is stored on travel devices.
• Consider issuing clean devices where appropriate.

At the border

• Comply with all official instructions at ports of entry.
• Do not provide false or misleading information under any circumstances.

If detained

• Have a clear communication protocol in place.
• Ensure travellers know who to contact internally for immediate support.
• Encourage contact with the relevant embassy or consulate if detained or arrested.

While the likelihood of device seizure or detention for most travellers remains low, the consequences of non-compliance are severe. The latest amendments underscore the importance of awareness, preparation, and clear organisational guidance when operating in or travelling through Hong Kong.