How does Hong Kong's National Security Law affect websites hosted in Hong Kong?

What does Article 43 allow the police to do?

It lists seven measures for national security cases, on top of the usual powers for serious crime. Four matter for a server:

• (1) search premises and electronic devices that may hold evidence;
• (4) require a person who published information, or the relevant service provider, to remove it or provide assistance;
• (6) intercept communications and run covert surveillance, with the Chief Executive's approval;
• (7) require people who hold relevant information to answer questions and hand over material.

Article 43 also lets the Chief Executive, with the national security committee, make implementation rules. Those rules took effect on 7 July 2020. They set the procedures, offences and penalties for each measure.

What is a "hosting service provider" under Schedule 4?

A person who hosts stored material posted on an electronic platform, where an intermediary service exists for that platform. Schedule 4 treats that hosting as a hosting service, and its supplier as the hosting service provider.

Section 5(2) defines the "disabling action" a host can be told to take:

• remove the message from the platform;
• restrict or cease access to the message;
• discontinue the hosting service for part or all of the platform;
• restrict or cease access to part or all of the platform.

In a dedicated-server rental, the customer usually runs the platform and the company renting out the machine supplies the hosting. Under Schedule 4, a disabling action can mean taking a whole platform offline, not just one page.

How does a removal requirement reach a host?

In writing, from a designated officer. The Commissioner of Police first needs reasonable grounds to suspect that a published message is likely to be, or cause, a national security offence. The Secretary for Security must approve.

A published example shows the form. On 3 September 2024 the Hong Kong Police Force sent a notice under section 7(4)(b) of Schedule 4 to Automattic Inc., a US company. It required a disabling action on a website within 48 hours. It cited section 12(1): a fine of HK$100,000 and six months in prison for non-compliance.

The notice also cited Article 63(3) of the law. It asked the company not to disclose the notice's contents, while allowing it to state that it had complied.

What changed on 23 March 2026?

The 2026 Amendment Rules (L.N. 27 of 2026) were gazetted and took effect the same day. Two changes reach hosts.

• Schedule 4: the Commissioner now specifies the message itself. An officer can act on that message wherever it reappears, even posted by another publisher or on another platform.
• Schedule 1: when police search seized electronic equipment, they can require a "specified person" to give a password or decryption method. That includes anyone believed to control the device or to know the password.

Refusing the decryption requirement without reasonable excuse carries up to HK$100,000 and one year. Giving false or misleading information carries up to HK$500,000 and three years. The Legislative Council paper states that Schedule 4 already had a similar offence for service providers.

Can police get customer data or decryption help from a host?

Yes, through a court step. The Government's 2020 summary says officers may apply to a magistrate for a warrant. It then authorises police to require the service provider to give the identification record or decryption assistance.

Article 43(7) adds a separate route: on application, a court can order a person to answer questions or produce material. Hong Kong's personal data law does not block disclosure here. Section 58 of the PDPO exempts use of data for detecting crime from the use-limitation principle, when applying it would prejudice that purpose.

What a host hands over is what it holds. We keep no logs: no record of connections or traffic and no IP address of a visitor or customer, on the website, in the dashboard or on any server.

Does the law reach websites hosted outside Hong Kong?

The text claims a wide reach. Article 38 applies the law to offences committed outside Hong Kong by people who are not permanent residents. The 2024 notice above was addressed to a company outside Hong Kong.

Enforcing a requirement abroad is a separate matter, governed by the law where the host stands. This page does not assess it.

For a server inside Hong Kong, there is no such question. The datacenter and its network are under Hong Kong law. See also is Hong Kong still a good place to host servers?

What does this mean for a Copperstrait server in Hong Kong?

Copperstrait is operated by DomaineGoat LLC, incorporated in Panama and answerable to Panamanian law only. The datacenter in each city is bound by the law of the place it stands in. A requirement addressed to the datacenter or its network provider can affect your server without passing through Copperstrait.

In Copperstrait's survey of 33 hosts selling bare metal in Asia on 2 November 2026, 20 sell in Hong Kong, 26 in Singapore and 22 in Japan. Copperstrait charges the same in all three cities, so choosing another legal system costs nothing extra. Compare on Hong Kong or Singapore for hosting.

Direct action by mainland bodies is covered on whether Chinese authorities can access Hong Kong servers. Plans are on how much a Copperstrait server costs.

This page sums up published law and is not legal advice.