Hong Kong (2026): What to Do If Police Demand Your Phone Password

Since March 23, 2026, the question of whether police can compel you to hand over a phone password in Hong Kong is no longer theoretical, it is codified in law. The Implementation Rules for Article 43 of the National Security Law were amended by Legal Notice 27 of 2026 (L. N. 27/2026), granting law-enforcement officers an express power to require device passwords and decryption assistance from specified persons during national security investigations. Separately, the Law Reform Commission (LRC) published its report on cyber-dependent crimes on January 9, 2026, proposing five new offence categories that would further tighten the legal framework around digital evidence.

For anyone living in, working in or travelling through the territory, understanding the practical reality of a police phone password demand in Hong Kong is now essential.

Last updated: 17 May 2026

Quick Summary: What Changed on March 23, 2026

On March 23, 2026, L.N. 27 of 2026 came into effect, amending the Implementation Rules for Article 43 of the national security law in Hong Kong. The amended rules empower police to require a “specified person”, any individual subject to a lawfully authorised national security investigation, to provide passwords, decryption keys or other assistance needed to access electronic devices. Refusal to comply “without reasonable excuse” is now a criminal offence carrying penalties that include imprisonment and a fine.

The key points to understand immediately are:

• Scope. The obligation applies only within a lawfully authorised national security investigation, not to every routine police encounter on the street.
• Who is covered. “Specified persons” includes suspects, but the statutory language is broad enough to cover associates, employees or anyone holding relevant device access.
• Criminal liability. Refusal without reasonable excuse may result in imprisonment of up to one year and/or a fine, according to the DOJ/LegCo paper tabled on March 24, 2026.
• Immediate action. If you are confronted with such a demand, ask for written authority, remain calm and request legal representation before disclosing anything.

Legal Basis: The Article 43 Implementation Rules and Police Phone Password Powers in Hong Kong

Article 43 of the Law of the People’s Republic of China on Safeguarding National Security in the Hong Kong Special Administrative Region empowers the HKSAR government to make subsidiary legislation, called Implementation Rules, that prescribe the procedures and powers available to law-enforcement during national security investigations. L.N. 27 of 2026 is the latest amendment to those Implementation Rules, and it is the statutory instrument that creates the device password obligation.

The DOJ/LegCo paper referencing L.N. 27 of 2026, tabled on March 24, 2026, confirms that the amendments authorise officers to “require a specified person to provide decryption assistance” in relation to electronic devices relevant to an investigation. The HKSAR Government’s press release of March 27, 2026 further clarified that these powers are exercisable only within the framework of lawful authorisations, they are not a blanket licence to stop members of the public at random and demand passwords.

When the Obligation Triggers

The device password obligation under L.N. 27/2026 does not arise automatically. Two conditions must be met before a lawful demand can be made:

1. National security investigation. The investigation must relate to one of the offences under the national security law in Hong Kong, secession, subversion, terrorist activities or collusion with foreign forces, or to offences under the Safeguarding National Security Ordinance.
2. Lawful authorisation. The officer making the demand must be acting under a proper authorisation, typically a warrant or equivalent judicial or executive approval. The HKSAR Government press release of March 27, 2026 emphasised that these powers are subject to safeguards and cannot be exercised arbitrarily.

Industry observers expect that, in practice, most demands will occur during formal interviews under caution or during the execution of search warrants at premises, rather than during casual street encounters.

Key Statutory Terms Defined

• Specified person. Broadly defined to include any person who is the subject of, or connected to, a lawful national security investigation and who holds or controls access to a relevant device or data.
• Reasonable excuse. The statute does not exhaustively define this term. The likely practical effect is that genuine inability (e.g., a forgotten password) may constitute a defence, but deliberate obstruction will not. Legal professional privilege may also be relevant, a point explored later in this guide.
• Decryption assistance. Goes beyond simply providing a password; it can extend to biometric unlocking, providing encryption keys, or any other step necessary to render data accessible.

Penalties and Criminal Exposure If You Refuse to Give Your Phone Password in Hong Kong

The consequences of refusing to comply with a lawful device-password demand under the amended Article 43 implementation rules are serious. Based on the DOJ/LegCo paper of March 24, 2026, and contemporaneous reporting by the South China Morning Post on March 23, 2026, the following penalties apply:

Beyond the statutory penalties, refusal carries secondary risks: devices may be seized and forensically examined, detention may be extended, and the refusal itself may be presented in subsequent proceedings as circumstantial evidence of consciousness of guilt. The U.S. Consulate General Hong Kong & Macau issued a security alert on March 26, 2026 advising U.S. citizens to “be aware that local authorities may require you to provide device passwords” and to review personal device contents before travelling to Hong Kong.

When Can Police Search Your Device? The Practical Test for a Police Device Search in Hong Kong

Not every police encounter in Hong Kong triggers a power to demand device access. Understanding the thresholds is critical to knowing whether you must unlock your phone or whether you can lawfully decline.

A decision-tree approach helps clarify the position:

1. Routine street stop (no arrest, no NSL investigation). Police may ask to see identification and may conduct a superficial search under general police powers, but there is no express statutory power to compel device passwords outside the NSL framework. Early indications suggest that a demand for a password in this scenario would lack lawful authority under L.N. 27/2026.
2. Arrest under ordinary criminal law. Following arrest, police have powers to search the person and seize property, including phones, but accessing encrypted content typically requires a warrant. The password-compulsion power under L.N. 27/2026 applies specifically to national security investigations.
3. National security investigation with authorisation. This is the core scenario where L.N. 27/2026 applies. The officer must be acting under a lawful authorisation, and the device must be relevant to the investigation. Refusal without reasonable excuse is a criminal offence.
4. Border and immigration checkpoint. Authorities at Hong Kong’s borders exercise broad administrative powers. While the NSL password-compulsion framework is distinct from immigration powers, device inspections at borders have been reported, and travellers should be aware that refusal at a port of entry may have practical consequences, including detention, device seizure and follow-up investigation.

Sample scenarios: A journalist stopped on the MTR and asked informally to show their phone is in a fundamentally different legal position from an activist arrested under the NSL and served with a written demand for decryption assistance during a recorded interview. The legal obligations differ dramatically, and any individual uncertain about which scenario applies should request legal advice before complying.

Immediate Steps If Police Demand Your Phone Password: What to Do

If you are confronted with a demand to provide a device password in Hong Kong, the following step-by-step approach is recommended. These steps are designed to protect your rights while avoiding actions that could escalate the situation or create additional criminal liability.

1. Stay calm and do not physically resist. Physical resistance to a police officer carries separate criminal penalties. Cooperate with the process while preserving your legal rights.
2. Ask for the officer’s authority in writing. Request to see the written authorisation, warrant or order that underpins the demand. Note the authorising instrument reference, the officer’s name, rank and warrant-card number.
3. Record the time, location and personnel. If permitted, note the exact time, the location, and the names and ranks of all officers present. This information is critical for any subsequent legal challenge.
4. Assert your right to legal representation. State clearly: “I wish to consult a solicitor before responding to this request.” Under Hong Kong law, a person under investigation has a right to legal advice.
5. Do not volunteer information beyond what is required. Answer only the specific demand. Do not offer commentary, explanations, or access to devices or accounts not covered by the demand.
6. If detained, follow the custody script. In detention, repeat: “I do not wish to say anything until I have spoken with my solicitor.” Do not sign any document without legal advice.
7. Avoid destroying data or providing false information. Deliberately deleting data, providing an incorrect password or tampering with a device during a lawful investigation creates additional criminal exposure.

Sample Scripts

The following scripts are suggested responses. They are not legal advice for your specific situation, consult a qualified Hong Kong criminal solicitor for tailored guidance.

• At a street stop (no arrest, no written order): “Officer, I am happy to cooperate. Could you please show me the written authorisation for this request? I would like to exercise my right to consult a solicitor before providing access to my device.”
• At a border or immigration checkpoint: “I understand you may have authority to inspect my device. Could you confirm the legal basis for this request? I would like to consult a solicitor if possible before complying.”
• During detention or a recorded interview: “I have been advised to say nothing further until my solicitor is present. I am not refusing to cooperate; I am exercising my right to legal advice.”

Safety note for travellers: if you are a foreign national, you should also request that your consulate be notified, as is your right under the Vienna Convention on Consular Relations.

If You Refuse: Legal Defence Strategies and Practical Risks

Where a person decides, on legal advice, to refuse to provide a device password in Hong Kong, several defence strategies and risk factors come into play.

The primary statutory defence is “reasonable excuse.” While the amended implementation rules do not exhaustively define this term, the following arguments may be available:

• Genuine inability. A forgotten password or a device that is no longer functional may constitute a reasonable excuse, provided the claim is credible and supported by evidence.
• Procedural challenge. If the demand was made without proper authorisation, or if the underlying investigation was not lawfully commenced, the demand itself may be unlawful. Defence counsel should scrutinise the authorising instrument for technical defects.
• Legal professional privilege. Material on the device that is subject to legal professional privilege may be shielded from compelled disclosure. However, providing the password itself, which unlocks all content, risks waiving privilege for the entire device contents. A partial-disclosure protocol, negotiated through counsel, may be the safest approach.
• Self-incrimination arguments. While the privilege against self-incrimination is well established in Hong Kong’s common-law tradition, the national security law framework operates in parallel with domestic criminal procedure, and the extent to which self-incrimination arguments apply to password-compulsion orders remains a developing area.

Evidence Handling and Chain of Custody

If a device is seized, defence counsel should immediately request a formal record of the seizure, including the make, model, serial number and condition of the device. Any break in the chain of custody, or any evidence of forensic tampering, can be challenged in subsequent proceedings. Requesting an independent forensic examination at the earliest opportunity is advisable.

When to Negotiate Disclosure or Seek Bail

In some cases, a negotiated disclosure, providing access to specific files or categories of data rather than wholesale device access, may be possible. This approach balances compliance with the protection of privileged or irrelevant material. Bail applications should address device seizure and any conditions imposed on the suspect’s use of technology during the investigation.

For Businesses and In-House Counsel: Cybercrime Reform in Hong Kong and Compliance Checklist

The password-compulsion powers under L.N. 27/2026 do not exist in isolation. On January 9, 2026, the Law Reform Commission published its report on cyber-dependent crimes and jurisdictional issues, recommending the creation of five new categories of cyber-dependent offences in Hong Kong. The HKSAR Government acknowledged the report on the same date, signalling that legislation is likely to follow.

The LRC’s proposed offences cover:

• Illegal access to programs or data. Unauthorised access to computer systems or stored data.
• Illegal interception of computer data. Covert capture of data in transit.
• Illegal interference with computer data. Deliberate corruption, deletion or alteration of data.
• Illegal interference with a computer system. Disruption of system availability or functionality (e.g., DDoS attacks).
• Making available or possessing a device or data for committing a crime. Supply-chain liability for tools used in cybercrime.

Industry observers expect these proposals to intersect directly with the NSL device-access regime: organisations subject to a national security investigation may face compounded exposure under both frameworks. The LRC report proposes maximum sentences ranging up to life imprisonment for the most aggravated offences.

Immediate Compliance Checklist for In-House Counsel

1. Conduct a gap analysis of existing device and encryption policies against L.N. 27/2026 requirements.
2. Update incident-response plans to include a protocol for lawful device-password demands.
3. Review and update data-retention schedules, avoid both over-retention and premature deletion.
4. Audit employee access controls for corporate devices, cloud storage and encrypted communications.
5. Brief the board and senior management on the new legal landscape and residual risks.
6. Train staff on what to do if a device-password demand is made during office hours or at a company premises.
7. Review supplier and contractor agreements for data-access and cooperation clauses.
8. Establish a legal-privilege protocol to protect privileged material stored on corporate devices.
9. Engage external criminal counsel on a standing retainer for urgent advice.
10. Monitor the legislative progress of the LRC’s cybercrime reform proposals and plan for compliance with any new statutory obligations.

Border, Immigration and Traveller Considerations

The U.S. Consulate General Hong Kong & Macau issued a security alert on March 26, 2026 advising travellers to “review the contents of their electronic devices” before entering Hong Kong and warning that local authorities may require provision of device passwords. While the alert does not have the force of law, it reflects a practical reality that travellers should take seriously.

Reports from journalists and travellers since March 2026 indicate that device inspections at Hong Kong’s land, sea and air borders have increased in frequency. Devices may be seized for examination, and travellers who decline to cooperate may face short-term detention and follow-up investigation. For those with concerns about Hong Kong immigration changes in 2026, or who are considering global immigration pathways for Hong Kong residents, these developments add a new layer of risk assessment.

Pre-travel checklist for travellers:

• Minimise sensitive personal and professional data on devices carried into Hong Kong.
• Consider using a dedicated travel device with only essential data.
• Back up all data to a secure, off-device location before travel.
• Be aware that deliberate deletion of data in anticipation of a specific investigation may carry legal risks.
• Register with your consulate and carry consular contact details.
• Identify a Hong Kong criminal solicitor before arrival in case urgent advice is needed.

Comparison Table: Obligations and Penalties by Entity Type

Conclusion: Protecting Your Rights When Police Demand Your Phone Password in Hong Kong

The legal landscape around police phone password demands in Hong Kong changed fundamentally on March 23, 2026. L.N. 27/2026 creates a clear statutory obligation for specified persons to provide device passwords and decryption assistance during national security investigations, and refusal without reasonable excuse is now a criminal offence. At the same time, the LRC’s cybercrime reform proposals signal that the regulatory framework will continue to tighten.

The practical advice is straightforward: know your rights, ask for written authority, request legal representation immediately, and do not destroy evidence. Whether you are an individual, a business or a traveller, the time to prepare is now, not when an officer is standing in front of you with a written demand.

If you need immediate legal advice on device-password obligations, criminal defence in national security matters, or compliance planning for the new cybercrime framework, find a Hong Kong criminal solicitor through the Global Law Experts directory.

Sources

1. HKSAR Government Press Release, Response re: Implementation Rules (Amendment) (March 27, 2026)
2. DOJ / LegCo Paper Referencing L.N. 27 of 2026 (March 24, 2026)
3. Law Reform Commission, Cyber-Dependent Crimes and Jurisdictional Issues Report (January 9, 2026)
4. U.S. Consulate General Hong Kong & Macau, Security Alert (March 26, 2026)
5. South China Morning Post, Withholding Device Passwords Punishable Under Tightened National Security Rules (March 23, 2026)
6. BBC News, Hong Kong Phone Password Rules (March 23, 2026)
7. The Guardian, Hong Kong Phone Passwords and National Security Law (March 24, 2026)
8. HKSAR news.gov.hk, Government Acknowledgement of LRC Cybercrime Proposals (January 9, 2026)