Can Chinese authorities access data on servers in Hong Kong?

Which mainland laws apply in Hong Kong?

Only those listed in Annex III of the Basic Law. Article 18 says national laws "shall not be applied" in Hong Kong except those in the annex. The listed laws apply by promulgation or local legislation.

Annex III, as read on 2 November 2026, covers subjects such as the national flag, nationality and the garrison. Its last addition is the National Security Law, decided on 30 June 2020.

A national law missing from Annex III, such as the PRC Data Security Law, is therefore not applied in Hong Kong. A server in Hong Kong is reached through Hong Kong ordinances and the National Security Law, not the mainland statute book.

What can Hong Kong police do with a server?

A lot, in national security cases. Article 43 lets the police's national security department search premises and electronic devices. It can also require service providers to remove information or assist, and ask courts to order people to hand over material.

The Implementation Rules set the procedure. A magistrate's warrant lets police require a service provider to give identification records or decryption help. Since 23 March 2026, police can also require a password for seized equipment.

These are Hong Kong officers using Hong Kong procedure. The details are on how the National Security Law affects hosted websites.

When can the central government's office act directly?

In three cases listed by Article 55, on a proposal by the Hong Kong government or the office, approved by the Central People's Government:

• a complex case involving foreign or external forces, where jurisdiction by Hong Kong is genuinely difficult;
• a serious situation where Hong Kong cannot effectively enforce the law;
• a major and imminent threat to national security.

The Office for Safeguarding National Security then investigates (Article 56). The Supreme People's Procuratorate and Supreme People's Court designate the prosecutors and the court.

Article 57 applies mainland criminal procedure to those cases. Documents issued for compulsory or investigative measures have legal effect in Hong Kong. Institutions, organisations and individuals must comply with the office's measures.

Can Hong Kong courts review what the office does?

No, under Article 60. Acts of the office and its staff in performing duties under the law are not subject to Hong Kong jurisdiction.

The same article says Hong Kong law enforcement may not inspect, search or detain staff or vehicles holding the office's documents while on duty. Article 62 adds that the law prevails where local laws are inconsistent with it.

Is there a mutual legal assistance channel with the mainland?

Not under Cap. 525. The Mutual Legal Assistance in Criminal Matters Ordinance covers places outside Hong Kong "other than any other part of the People's Republic of China".

So an ordinary mainland criminal case has no assistance route through that ordinance. National security cases follow the separate channels above.

Can a host simply hand data over?

Hong Kong's privacy law allows it in crime cases. Section 58(2) of the PDPO exempts use of personal data for preventing or detecting crime from data protection principle 3. It applies where following the principle would be likely to prejudice that purpose.

That makes the host's own records the real limit. Copperstrait's list of what it holds is on its privacy policy. The datacenter and its network operator in Hong Kong are separate companies under Hong Kong law. The PDPO side is on what the PDPO requires from hosting providers.

What is documented about these powers in use?

Official papers document Hong Kong police use of the Article 43 rules. The Legislative Council paper of 24 March 2026 cites a Schedule 5 case from 2021. It says the amendments drew on practical experience of applying the rules.

A Hong Kong Police notice of 3 September 2024, later published in the United States, applied Schedule 4 to a hosting company.

None of the official texts and papers listed below reports a case taken over under Article 55. That describes these sources only. This page does not forecast how the powers will be used.

What does this mean when choosing a city?

Each city's law reaches its own datacenters. In Copperstrait's survey of 33 hosts selling bare metal in Asia on 2 November 2026, 20 sell in Hong Kong, 26 in Singapore and 22 in Japan.

Copperstrait charges one price in all three. Copperstrait is operated by DomaineGoat LLC, incorporated in Panama and answerable to Panamanian law only. The datacenter in each city is bound by the law of the place it stands in. Compare Singapore's data retention rules. Plans are on how much a Copperstrait server costs.

Copperstrait does not serve residents or companies of mainland China. This page sums up published law and is not legal advice.