There’s a lot to digest here, both in terms of the detail and also direction of travel. From a data privacy perspective, you should plan now to keep data on HK citizens within China…:
[…] At the risk of stating the obvious, institutions, organisations and individuals in Hong Kong should be fully aware of and comply with the provisions of the National Security Law, and should not engage in any act or activity which endangers national security.
Those carrying on business in Hong Kong may need to pay particular attention to whether any funds or properties they receive, provide or process will be used to support activities that may be perceived as endangering national security, as the National Security Law makes it unlawful for a person to assist in, abet or provide pecuniary or other financial assistance or property for the commission of crimes of secession8 or subversion9. It is also an offence for a person to provide support, assistance or facility such as training, weapons, information, funds, supplies, labour, transport, technologies or venues to a terrorist organisation10 or a terrorist, or for the commission of a terrorist activity11. Businesses should therefore conduct appropriate levels of due diligence and monitoring on their business counterparties with whom they have or will have dealings to ensure that these dealings would not be caught by the prohibitions under the National Security Law. It will also be prudent to develop a contingency plan in anticipation of potential detection of any counterparties’ involvement in activities endangering national security.
In addition, Article 2 of the National Security Law stipulates that no institution, organisation or individual in Hong Kong shall, in exercising their rights and freedoms, contravene the principles set out in Articles 1 and 12 of Hong Kong’s Basic Law (i.e. that Hong Kong is an inalienable part of the PRC, and that Hong Kong shall be a local administrative region of the PRC, enjoying a high degree of autonomy and coming directly under the Central People’s Government). This prohibition may be of particular relevance to the business sector when it comes to communications with the general public, and businesses should exercise caution in this regard.