Protection of Data Security

To ensure the smooth implementation and operation of government IT systems, the DPO puts in place a series of new measures in February 2024, which include additional pre-launch testing on large-scale and high-risk IT projects, such as simulating intrusion attacks, to enable early detection and patching of system vulnerabilities and assess the system’s detection and recovery capabilities against cyberattacks.

Government bureaux and departments (B/Ds) must adhere to the regulations and guidelines outlined in “IT Security Standards and Best Practices”, which are aligned with the measures recommended in the “Guidance Note on Data Security Measures for Information and Communications Technology” published by the Privacy Commissioner for Personal Data. These include encrypting data in transit and storage, refraining from storing sensitive and personal information on public cloud platforms and conducting regular security risk assessments and audits of their IT infrastructure, information systems, and data assets. The “Guidance Note on Data Security Measures for Information and Communications Technology” is also open for industry reference, enabling both public and private institutions to develop appropriate IT security measures based on their circumstances.

As set out in the “Policy Statement on Facilitating Data Flow and Safeguarding Data Security in Hong Kong” , the DPO has formulated a “Practice Guide on Data Centre Security” to strengthen the security of data centre infrastructure.

To bolster the surveillance and defence capabilities of the Government’s information systems and network, the DPO enhances the regular security risk assessments and audits of information systems, routine network monitoring, spot checks, compliance audits, and staff training across B/Ds. Furthermore, the DPO will lead the cybersecurity attack and defence drills to be conducted regularly such that the IT security of B/Ds and public organisations will be tested and strengthened.

To promote the overall awareness of information security and data safety (including public and private organisations, educational institutions and the general public), the Government has been working closely with various stakeholders and relevant institutions, including the Hong Kong Computer Emergency Response Team and the Hong Kong Internet Registration Corporation Limited. These collaborations aim to share cybersecurity information; launch promotional and educational initiatives, as well as training, to remind industries and the public to reinforce their cybersecurity measures and protect their information systems and data from cyberattacks; and to provide incident response support for information security incidents, alerts on security threats, and guidelines for defence mechanisms, all of which serve to strengthen the data security barrier.