Free Website Security Scan for Hong Kong SMEs: Applications Open Until 16 November 2026
Hong Kong SMEs may apply free of charge for the PCPD and HKIRC Data Privacy and Web Security Scan Programme by 16 November 2026. Learn the eligibility, non-intrusive scan, report and support scope, application route and limits.
The Office of the Privacy Commissioner for Personal Data (PCPD) and Hong Kong Internet Registration Corporation Limited (HKIRC) jointly launched the Data Privacy and Web Security Scan Programme on 13 August 2026. Applications are open until 16 November 2026 (Monday).
FAQ: Who can apply, and is it free?
The joint official release says the Programme is free of charge and open to all schools, non-profit-making organisations and small-and-medium sized enterprises in Hong Kong. This article focuses on SMEs, but the other two groups are also within the stated eligibility.
The releases reviewed do not define “SME” further or state additional documentary criteria. Organisations should use the official application channel or contact HKIRC if their eligibility is unclear.
What does the scan cover?
The Programme uses non-intrusive scanning technology intended to identify potential website security vulnerabilities and personal-data protection risks without disrupting normal website operations. The official description includes system-configuration weaknesses, inappropriate security settings and other vulnerabilities that could contribute to unauthorised leakage or inadvertent exposure of sensitive personal data.
This is an assessment service, not a do-it-yourself vulnerability-remediation guide.
What may a participating organisation receive?
According to the joint release, participating organisations will receive a tailored evaluation report and consultancy support services with recommendations for security enhancement and remediation. These terms apply to participating organisations; submitting an application should not be described as confirmed acceptance.
Are places limited or acceptance guaranteed?
The official releases reviewed state no quota, number of places, selection criteria or first-come-first-served rule. They also do not promise that every applicant will be accepted. Businesses should avoid delaying an application, while recognising that submission is not confirmation of participation.
How and when should an SME apply?
Apply through the designated official channel by 16 November 2026: https://forms.cloud.microsoft/r/UkitjQw6Tg
Programme questions may be sent to the contact stated in the release: cybersec@hkirc.hk
Before submitting, an organisation should identify the website it wants assessed and ensure that the information supplied through the official form is accurate and authorised. This article does not reproduce or extend the form’s requirements.
Who is responsible for the Programme?
PCPD and HKIRC jointly launched the Programme and jointly issued the announcement. The broader Memorandum of Understanding was signed by PCPD, the Hong Kong International Data Privacy Academy and HKIRC; the Programme is described as the first collaborative initiative launched by PCPD and HKIRC.
Important limits
A non-intrusive scan and evaluation report can help identify potential issues at the time of assessment, but they do not guarantee that every weakness will be found or removed. Participation is not a security guarantee, risk-elimination promise, legal or regulatory compliance certification, or substitute for case-specific professional assessment. Scope, timing, participation and support arrangements remain subject to confirmation by the Programme organisers.
Official sources and application
- HKIRC joint release, 13 August 2026: https://www.hkirc.hk/en/news-insights/press-release/data_privacy_and_web_security-scan_programme/
- PCPD joint release, 13 August 2026: https://www.pcpd.org.hk/english/news_events/media_statements/press_20260813.html
- Designated application channel: https://forms.cloud.microsoft/r/UkitjQw6Tg
Disclaimer: This article is for general information only and does not constitute legal, privacy, cybersecurity, compliance, accounting or other professional advice. Eligibility, acceptance, assessment scope, timing and support should be confirmed through the current official sources and application channel.