Data protection & privacy law in Cambodia (2026)

Legal framework

Draft Law on Personal Data Protection (LPDP, July 2025), not yet enacted; existing regime relies on Sub-Decree No. 252 (2021), the E-Commerce Law, and general constitutional/civil/criminal-code privacy provisions. Designated supervisory authority (under draft): Ministry of Post and Telecommunications (MPTC).

Key points: data & privacy in Cambodia

1. 01Draft LPDP (2025)

   Cambodia's Ministry of Post and Telecommunications published a final English-language draft of the Law on Personal Data Protection on 23 June/July 2025. The draft adopts GDPR-style principles, lawful basis, data-subject rights, data-breach notification, and cross-border transfer controls, but had not been promulgated into law as of May 2026.

   data.opendevelopmentcambodia.net hoganlovells.com

2. 02Sub-Decree No. 252 (2021), narrow scope

   Sub-Decree No. 252 of 22 December 2021 on the Management, Use, and Security Protection of Personal Identification Data applies only to personal identification data held by the Ministry of Interior (national ID system); it does not extend to private-sector data processing.

   data.opendevelopmentmekong.net dlapiperdataprotection.com

3. 03Sectoral and general-law privacy protections

   Outside Sub-Decree 252, privacy is protected in broad terms under the Constitution, Civil Code (2007), Criminal Code (2009), and specific sectoral laws such as the E-Commerce Law (limited to virtual/digital consumer-data contexts) and the Banking Law. No single comprehensive statute governs private-sector data controllers.

   dataguidance.com dlapiperdataprotection.com

4. 04Designated supervisory authority (MPTC)

   The draft LPDP designates the Ministry of Post and Telecommunications (MPTC) as the primary data-protection supervisory authority, with powers to issue regulations (Prakas), conduct audits, receive complaints, mediate disputes, and manage cross-border transfer approvals. Critics note the draft delegates substantial rule-making to ministerial Prakas, limiting legal certainty.

   hoganlovells.com papers.ssrn.com

5. 05Extraterritorial scope in the draft

   The LPDP draft targets both Cambodian-based and foreign entities that offer goods or services to individuals residing in Cambodia, mirroring GDPR's territorial reach. Sensitive categories (biometrics, health, race/ethnicity, political opinion, religion, sexual orientation) attract heightened protection.

   dataguidance.com appdi.org

6. 06Implementation timeline

   Once promulgated, the LPDP is expected to enter force after a two-year transitional/implementation period, giving organisations time to comply. As of May 2026 the law had not yet been signed or tabled before the National Assembly, and no official promulgation date had been announced.

   hoganlovells.com dlapiperdataprotection.com

Timeline of decisions

1. 23 Jun 2025Guidance
   MPTC Publishes Final Consultation Draft of Law on Personal Data Protection

   The Ministry of Posts and Telecommunications released the substantially revised final draft of Cambodia's first comprehensive data-protection law (LPDP), modelled on the EU GDPR; it mandates lawful-basis processing, data-subject rights, mandatory DPO appointment for all controllers and processors, cross-border transfer rules, and administrative fines up to ~$150,000 (600 million KHR) plus 10% of annual turnover. A two-year grace period will follow royal promulgation.

   Open Development Cambodia / MPTC

2. 25 Jul 2023Guidance
   MPTC Releases Draft Personal Data Protection Law for Public Consultation

   The Ministry of Posts and Telecommunications circulated a GDPR-modelled Draft Law on Personal Data Protection, mandating data protection officers for all controllers and processors and proposing a new Data Protection Authority with fines up to approximately USD 150,000. As of mid-2026 the law had not been enacted, leaving Cambodia among the last ASEAN states without comprehensive data privacy legislation.

   DataGuidance

3. 25 Jul 2023Law
   MPTC Releases Draft Law on Personal Data Protection for Public Consultation

   MPTC published a draft Law on Personal Data Protection (LPDP) for consultation on 25 July 2023, modelled substantially on the EU GDPR; the law remains unenacted but is identified as a critical enabling instrument for responsible AI data governance in Cambodia.

   DataGuidance (reporting on MPTC consultation)

4. 1 Jul 2023Guidance
   MPTC Circulates First Draft Personal Data Protection Law for Industry Consultation

   Cambodia's Ministry of Posts and Telecommunications distributed an initial draft Law on Personal Data Protection (LPDP) to selected companies and held workshops, the first formal step toward a standalone data-protection statute. Critics and industry groups noted the draft applied only to the private sector and delegated more than 20 key obligations to future ministerial decrees (prakas), leaving significant legal uncertainty.

   Global Data Alliance (formal comments on draft)

5. 16 Feb 2021Law
   Sub-Decree on National Internet Gateway Signed, Mandating 12-Month Traffic Data Retention

   Prime Minister Hun Sen signed Sub-Decree No. 23 requiring all domestic and international internet traffic to route through a government-controlled National Internet Gateway (NIG); ISPs must retain all traffic data for 12 months, block prohibited content, and report identifiable user activity to the Ministry of Posts and Telecommunications and the Telecommunications Regulator of Cambodia. Human-rights organisations condemned the measure as enabling mass surveillance incompatible with the right to privacy.

   Human Rights Watch

6. 2 Nov 2019Law
   Law on Electronic Commerce Enacted, First Statutory Digital Data-Protection Obligations

   Cambodia's e-commerce law imposed the country's first explicit statutory data-security duties: any business electronically storing personal information must implement reasonable measures against loss, unauthorised access, alteration, or disclosure. It also introduced consumer disclosure requirements and rights to correct inaccurate data, making it the primary enacted instrument governing personal data in digital transactions until a comprehensive law is passed.

   Tilleke & Gibbins

7. 1 Jan 2007Law · official
   Civil Code Promulgated, Article 10 Recognises Privacy as a Personal Right

   Cambodia's Civil Code formally listed privacy alongside life, identity, and dignity as a protected personal right under Article 10, giving individuals a civil-law basis to seek injunctions and damages for privacy violations. The provision is broadly drafted and lacks implementing regulations, so its practical scope has depended entirely on court interpretation.

   FAO FAOLEX (UN Food and Agriculture Organisation)

8. 21 Sept 1993Law · official
   Constitution Adopted, Article 40 Enshrines Right to Privacy of Communications

   Cambodia's post-UNTAC Constitution enshrined in Article 40 the rights to privacy of residence and to confidentiality of postal, telegraph, fax, telex, and telephone communications, the foundational constitutional basis for all subsequent data-protection claims. The provision predates the internet era and makes no reference to digital data, leaving a significant gap that modern legislation has been slow to fill.

   OHCHR Cambodia (official constitutional text)

Sources

1. 1.data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc
2. 2.data.opendevelopmentcambodia.net/laws_record/draft-law-on-personal-data-protection
3. 3.hoganlovells.com/en/publications/cambodia-moves-to-enact-comprehensive-data-privacy-la
4. 4.dlapiperdataprotection.com/index.html?t=law&c=KH
5. 5.dataguidance.com/notes/cambodia-data-protection-overview
6. 6.data.opendevelopmentmekong.net/laws_record/sub-decree-no-252-on-the-management-usage-and-security-pr
7. 7.papers.ssrn.com/sol3/papers.cfm?abstract_id=5206970
8. 8.appdi.org/cambodia-pdpl-final-draft/
9. 9.dlapiperdataprotection.com/guide.pdf?c=KH
10. 10.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what