Cybersecurity law & regulation in Cambodia (2026)

Legal framework

Law on Cybercrime (2015); Law on Combating Technology-based Fraud (promulgated 7 April 2026); Telecommunications Law (2015); Ministry of Post and Telecommunications (MPTC) / Telecommunications Regulator of Cambodia (TRC)

Key points: cybersecurity in Cambodia

1. 01Law on Cybercrime (2015)

   The principal enacted instrument covers offences including illegal access, illegal system retention, data interference, and system interference; the Criminal Code (Arts. 317-320, 427-432) provides supplementary provisions on secrecy of communications and IT offences. A later redraft was shelved over civil-liberties concerns.

   coe.int mptc.gov.kh

2. 02Anti-Technology Fraud Law (April 2026)

   Promulgated by Royal Decree on 7 April 2026 and immediately in force, the Law on Combating Technology-based Fraud criminalises online scam operations, human trafficking for forced labour, and crypto money-laundering, with prison terms up to life imprisonment for ringleaders where victims die.

   m.en.freshnewsasia.com aljazeera.com

3. 03Telecoms regulatory framework

   The Telecommunications Law (2015) established the Telecommunications Regulator of Cambodia (TRC) under MPTC to oversee operators and ISPs, with authority extending to network security obligations for licensed providers.

   tilleke.com

4. 04Draft Personal Data Protection Law (not yet enacted)

   A final draft PDPL was released on 23 June 2025. It would require data controllers to notify MPTC of personal data breaches within 72 hours and to notify affected individuals of high-risk breaches immediately. Administrative fines could reach ~USD 150,000 or 10% of annual turnover. As of May 2026 it has not been promulgated.

   data.opendevelopmentcambodia.net dlapiperdataprotection.com

5. 05Draft Cybersecurity Law (pending)

   MPTC has been developing a dedicated Cybersecurity Law; as of 2026 it remains in draft stage and has not been tabled for parliamentary approval. Access Now's legal analysis (2023) flagged broad government-access provisions as potential rights risks.

   accessnow.org

6. 06Capacity building & digital policy

   MPTC runs cybersecurity training under the Digital Economy and Society Policy Framework 2021-2035 and Digital Government Policy 2022-2035, supported by Japan's JICA Cybersecurity Resilience Improvement Project. There are no mandatory incident-reporting obligations to a national CERT in currently enacted law.

   mptc.gov.kh mptc.gov.kh

Timeline of decisions

1. 6 Apr 2026Law
   Law on Combating Technology-based Fraud Promulgated

   Acting Head of State Hun Sen signed the Royal Decree promulgating Cambodia's first dedicated anti-cybercrime statute, which takes immediate effect and imposes sentences of 2-30 years (life imprisonment where victims die) on scammers, gang leaders, and financiers of technology-based fraud including pig-butchering, crypto scams, and forced-labour compounds. Cambodia had previously lacked any legislation specifically targeting cybercrime.

   Fresh News Asia

2. 3 Apr 2026Law
   National Assembly Passes First Dedicated Cybercrime Law

   Cambodia's parliament passed a landmark law primarily targeting online scam centres, establishing tiered penalties ranging up to life imprisonment for ringleaders whose operations cause deaths, with five new offences covering directing scams, malicious data collection, and cybercrime-linked money laundering. The law was driven by international scrutiny over Cambodia's role as a hub for forced-labour scam compounds.

   Al Jazeera

3. 3 Apr 2026Law
   Senate Gives Final Approval to Law on Anti-Technology Fraud

   All 55 senators unanimously adopted Cambodia's first dedicated cybercrime statute without amendment, completing the legislative process and sending the bill to King Norodom Sihamoni for royal promulgation. Gang leaders of scam operations face 15-30 years in prison; life imprisonment applies where victims die, and organisers face fines up to $250,000.

   Xinhua News Agency

4. 30 Mar 2026Law
   National Assembly Unanimously Passes Anti-Technology Fraud Bill

   All 112 members of Cambodia's National Assembly voted in favour of the country's first standalone cybercrime law, targeting online scam compounds with 2-5 year sentences and fines up to $125,000 for individual offenders. The passage followed intense international pressure and sanctions over Cambodia's role as a hub for cyber-fraud operations.

   Al Jazeera

5. 1 Oct 2023Guidance
   Access Now and ICJ Demand Withdrawal of Draft Cybersecurity Law

   Access Now and the International Commission of Jurists published a joint legal analysis and open letter calling on MPTC and the Ministry of Justice to withdraw or substantially amend the draft Law on Cybersecurity, citing warrantless infrastructure seizure powers, an unlimited government right to monitor systems, and no judicial oversight, all incompatible with international human rights standards.

   Access Now / ICJ

6. 1 Jun 2023Guidance
   Draft Cybersecurity Law Surfaces Ahead of General Election

   MPTC circulated a draft Law on Cybersecurity for limited stakeholder review before the July 2023 national election; it would establish a corps of government cybersecurity inspectors empowered to monitor, seize, and compel access to any information system, drawing comparisons to China's cybersecurity statute and raising concerns that it would facilitate political surveillance.

   Rest of World

7. 1 Nov 2022Guidance
   MPTC Completes First Draft of Stand-alone Cybersecurity Law

   The Ministry of Post and Telecommunications announced completion of the inaugural draft of a dedicated Law on Cybersecurity and committed to drafting a companion Personal Data Protection Law once the cybersecurity text was finalised, marking Cambodia's first formal attempt to enact sector-specific cybersecurity obligations.

   Khmer Times

8. 15 Feb 2022Decision
   Government Suspends National Internet Gateway Implementation

   The Royal Government announced indefinite postponement of the NIG, originally scheduled to go live the following day, after three UN Special Rapporteurs issued a joint statement warning it would seriously harm internet freedom, and Human Rights Watch called for the decree to be scrapped; the gateway has not been activated as of 2026.

   The Diplomat

9. 16 Feb 2021Law
   Sub-Decree No. 23 on National Internet Gateway Signed

   Prime Minister Hun Sen signed Sub-Decree No. 23 requiring all internet service providers to route domestic and cross-border traffic through a single government-controlled gateway; operators must retain traffic data for 12 months, verify user real identities, block prohibited content on demand, and face licence suspension and bank-account freezing for non-compliance, the most sweeping cybersecurity and surveillance instrument in Cambodia's history.

   Human Rights Watch

10. 6 Feb 2021Law
    First Draft Cybersecurity Law Circulated (Version 0)

    MPTC circulated Version 0 of a draft Cybersecurity Law on 6 February 2021; subsequent revisions drew civil-society criticism for broad ministerial powers. As of early 2026 the law remains unenacted, a gap that Cambodia's own UNESCO readiness assessment identifies as a structural weakness in its AI governance framework.

    Open Development Cambodia (official draft repository)

11. 1 Jan 2021Guidance · official
    Digital Economy and Society Policy Framework 2021-2035 Published

    MPTC published Cambodia's 15-year digital roadmap making cybersecurity an explicit national policy pillar, covering critical-infrastructure protection, a national awareness campaign, and a mandate to enact cybersecurity laws, providing the formal policy basis for all subsequent draft legislation and institutional capacity-building.

    Ministry of Post and Telecommunications (MPTC)

12. 13 Nov 2020Guidance
    Human Rights Watch Flags Sweeping Surveillance Powers in Draft Cybercrime Law

    Human Rights Watch published an analysis of the August 2020 third-iteration draft Law on Cybercrime, warning that it would compel service providers to retain internet traffic data for at least 180 days on government demand, enable warrantless monitoring, and criminalise undefined online speech; the draft was never enacted but its provisions reappeared in subsequent cybersecurity law drafts.

    Human Rights Watch

13. 2 Nov 2019Law
    Law on Electronic Commerce Enacted

    Cambodia became the last ASEAN member to adopt a domestic e-commerce statute (entering force 23 May 2020); the law imposes a general obligation on all entities storing electronic data to implement 'all necessary measures' protecting it from unauthorised access, alteration, loss, or disclosure, Cambodia's earliest statutory data-security requirement applicable to businesses.

    Tilleke & Gibbins

14. 1 May 2012Decision
    Royal Government Initiates First Cybercrime Law Drafting Process

    Cambodian authorities began drafting a cybercrime law with technical assistance from the Council of Europe's Economic Crime Unit and regional partners, aiming to prevent the online spread of 'false information' by 'ill-willed groups.' The decade-long drafting process was repeatedly stalled by civil society objections to provisions threatening privacy and free expression.

    Konrad-Adenauer-Stiftung

15. 1 Jan 2009Law
    Criminal Code Enacted with First Cyber-Offense Provisions

    Cambodia's comprehensive Criminal Code (promulgated 2009, in force 2010) introduced Articles 317-320 and 427-432 covering unauthorised computer access and related offences, the first cyber-specific criminal provisions in Cambodian law. The provisions were narrow, lacked a definition of cybercrime, and contained no data-privacy enforcement mechanism, driving subsequent calls for a standalone cybercrime statute that took 17 years to materialise.

    Konrad-Adenauer-Stiftung Cambodia

Sources

1. 1.coe.int/en/web/octopus/-/cambodia
2. 2.mptc.gov.kh/en/2015/06/clarification-on-draft-of-cybercrime-law/
3. 3.m.en.freshnewsasia.com/index.php/en/localnews/69527-2026-04-07-07-38-38.html
4. 4.aljazeera.com/news/2026/4/3/cambodia-parliament-approves-law-to-combat-cybercrime-s
5. 5.data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc
6. 6.dlapiperdataprotection.com/index.html?t=breach-notification&c=KH
7. 7.accessnow.org/wp-content/uploads/2023/10/Legal-Analysis-Cambodia-Cybersecurity-Draf
8. 8.mptc.gov.kh/en/2026/04/secretary-of-state-khov-makara-presided-over-the-closing-c
9. 9.tilleke.com/wp-content/uploads/2024/07/Tilleke-Cybersecurity-and-Data-Protection-
10. 10.mptc.gov.kh/en/2026/03/secretary-of-state-liv-sophanarith-presided-over-the-closi