What does the Hong Kong phone password law allow authorities to do?

Police can order people to disclose phone and computer passwords under national security rules. Refusal may lead to up to one year in jail and fines. Customs can also seize items viewed as seditious. The rules expand on-the-spot access to data during searches or border checks. Companies and travelers should expect closer scrutiny of devices and accounts that store locally accessible information.

Who is most exposed to the new Hong Kong security law enforcement shift?

Multinationals with staff in Hong Kong, media outlets, NGOs, consultancies, and professionals who carry client data on devices face higher risk. Travelers passing through the city are also exposed if sensitive files or app caches are on phones or laptops. Firms with weak mobile device management, broad local storage, or poor data maps will struggle to respond quickly to a password demand.

How should US companies reduce compliance risk under these rules?

Adopt clean travel devices or work profiles, shorten auto-locks, and enable remote lock and wipe. Cut local data caches, prefer virtual desktops, and enforce full-disk encryption. Update incident playbooks, name local counsel, and train staff on responses at borders or workplaces. Keep tight data maps, limit vendor log retention, and record any demand and response to support audits and client notifications.

Law and Government

March 23: Hong Kong’s New Password Demand Rule Raises Investor Risk

ByHuzaifa Zahoor March 24, 2026March 24, 2026

The Hong Kong phone password law expands police powers to demand access to phones and computers, with up to one year in jail and fines for refusing. For US investors and companies with staff, data, or clients in the city, this raises data privacy Hong Kong concerns and compliance risk. Customs can seize items labeled seditious, widening exposure for journalists and professionals. We explain what changed, who is at risk, and the practical steps we should expect boards and CISOs to take now.