If your company website has enquiry forms, registrations or payment-related features, it likely handles personal data. Weak website settings can expose that data. On 13 August 2026, the Office of the Privacy Commissioner for Personal Data (PCPD) and the Hong Kong Internet Registration Corporation Limited (HKIRC) launched the Data Privacy and Web Security Scan Programme. It is free of charge and open to all schools, non-profit organisations and SMEs in Hong Kong.
Applications close on 16 November 2026 (Monday). If you run a public business website and have limited IT resources, it is worth applying soon.
What does the programme do?
According to the joint PCPD–HKIRC press release, the programme uses non-intrusive scanning so normal website operations are not disrupted. It helps organisations identify website security risks and personal data protection vulnerabilities, such as weak system configurations, inappropriate security settings, and other issues that could lead to unauthorised leakage or inadvertent exposure of sensitive personal data.
After the assessment, participants receive a tailored evaluation report plus consultancy support with concrete recommendations for security enhancements and remediation. The programme is also one of the initiatives marking the PCPD’s 30th anniversary.
Which Hong Kong SMEs is it for?
- You already have a public company website with enquiry forms, contact forms, membership or customer-data features
- You have limited staff or IT capacity and want an official scan to surface obvious risks first
- You plan to harden hosting, plugins or security settings and want a third-party report to prioritise fixes
- You are a school, NGO or SME as described in the official announcement
The programme aims to raise awareness of cybersecurity and privacy risks and to provide scanning plus consultancy advice. It does not finish every remediation for you, and it does not by itself mean you have met every duty under the Personal Data (Privacy) Ordinance. After you receive the report, you still need to follow up based on the recommendations and your own situation.
What to prepare before you apply
- Confirm the website is publicly reachable and note the correct URL
- List where the site collects personal data (enquiry forms, sign-ups, quotes or logins)
- Prepare an organisation contact email and a named contact for follow-up
- If you use enquiry forms, check whether you clearly explain collection purposes and related privacy information (see PCPD guidance on Personal Information Collection Statements)
- Assign someone responsible for the website or IT to act on the report later
How to apply
Interested schools, NGOs and SMEs can apply through the designated form: https://forms.cloud.microsoft.com/r/UkitjQw6Tg. The deadline is 16 November 2026. For programme questions, email [email protected].
Places and processing details follow the organisers’ latest arrangements. Do not wait until the deadline if you can help it, so you have time for the scan and report follow-up.
How this fits day-to-day website hygiene
A free scan can highlight weak settings, but you still need everyday basics: keep the site and plugins updated, limit admin access, use HTTPS, back up important data, and be clear about how you collect and use personal data. If you build or refresh your company site with tools such as Webetter, use the report to rank fixes in a sensible order.
For full details, read the joint HKIRC and PCPD press releases, and treat the official application channel and enquiry email as authoritative.