What exactly changed under Article 43 on 24 March?

Amendments took immediate effect, expanding powers to require password disclosure or decryption help and to order removal or blocking of online content linked to national security risks. The rules apply to individuals and entities that control relevant data or services in Hong Kong, with an emphasis on faster, documented responses and auditable compliance.

Can police require password disclosure from individuals and companies?

Yes. Officers may compel passwords or decryption assistance tied to a defined investigation under the amended Article 43 rules. Requests should identify the targeted account, device, or service. Recipients should verify scope and authority, use secure handover channels, and keep access logs to ensure proportional, traceable compliance with Hong Kong law.

How do platform takedown orders affect ISPs and platforms?

Orders can require removing specific posts, disabling features, or blocking access in Hong Kong. Platforms and ISPs should prepare for order authentication, geo-targeted enforcement, and preservation of records. Clear playbooks reduce downtime and limit over-removal. Monitoring appeals and guidance will help teams calibrate scope and timelines for future requests.

What should businesses operating in Hong Kong do now?

Appoint a response lead, set 24-7 intake channels, and adopt checklists for verifying orders. Map where credentials and keys reside, segment admin rights, and test break-glass access. Keep detailed logs and chain-of-custody records. Review policies for proportionality and confidentiality. These steps support reliable compliance under Hong Kong national securitylaw.

Law and Government

Hong Kong NSL March 24: Article 43 Expands Password, Takedown Powers

ByDanny Kontos March 24, 2026March 24, 2026

Hong Kong national securitylaw amendments to Article 43 took effect on 24 March, expanding police powers to demand password disclosure and issue platform takedown orders for online content deemed a security risk. The changes were gazetted and apply immediately to individuals, platforms, ISPs, and businesses that store or transmit data in the city. We explain what changed, who must comply, and how this reshapes risk for tech operations and investors assessing Hong Kong’s regulatory setting and enforcement outlook.