Data protection & privacy law in Laos (2026)
Data protection in Laos: comprehensive law.
Laos enacted the Law on Electronic Data Protection (No. 25/NA) in May 2017, establishing a legal framework for the collection, processing, and protection of personal data in electronic/digital form. The Ministry of Technology and Communications (MTC) serves as the primary supervisory authority, supported by its provincial departments and the Lao Computer Emergency Response Team (LaoCERT). No major amendments or new comprehensive privacy legislation have been identified as enacted through 2025-2026.
Legal framework
Law on Electronic Data Protection No. 25/NA (12 May 2017), supervised by the Ministry of Technology and Communications (MTC)
Key points: data & privacy in Laos
Scope, electronic data only
The law covers personal data exclusively in electronic/digital form; physical or paper-based records fall outside its scope. It applies to domestic and foreign individuals, organisations, and legal entities handling electronic data within Lao PDR.
Data classification
The law distinguishes 'general data' (personal/organisational data accessible with proper identification) from 'specific data' (official and personal data requiring explicit owner or authority permission before access, use, or disclosure).
Data subject rights
Individuals hold rights to be informed, to access, to rectification, to erasure, and to object/opt-out of processing. Consent from the data owner is required as a baseline for collection and processing.
Cross-border transfer restrictions
Transferring personal or official electronic data outside Lao PDR requires consent from the designated Data Administrator and must not contravene national interests or security.
Supervisory authority and enforcement
The Ministry of Technology and Communications (MTC) and its 17 provincial departments are the primary enforcement bodies. Penalties for violations range from 5 million to 50 million Lao Kip (approximately USD 250-2,500). Implementing regulations were issued in 2018.
Complementary sectoral rules
The Bank of Lao PDR's Decree on Consumer Protection Concerning Financial Services No. 225/GOV (April 6, 2020) requires financial service providers to notify affected customers of data breaches and report significant incidents to the central bank, supplementing the general electronic data protection law.
Timeline of decisions
- Law · officialLaw on Electronic Data Protection (No. 25/NA) Enacted
The National Assembly enacted the Law on Electronic Data Protection, establishing consent requirements, data-minimisation obligations, security safeguards, and cross-border transfer restrictions for electronic data. MOTC and LaoCERT were designated co-enforcement authorities, creating Laos's first personal-data protection regime.
Lao Services Portal — Ministry of Industry and Commerce
Sources
- dig.watch/resource/laos-law-on-electronic-data-protection-no-25-na
- dlapiperdataprotection.com/index.html?t=law&c=LA
- dataguidance.com/notes/lao-pdr-data-protection-overview
- ilo.org/dyn/natlex/natlex4.detail?p_lang=en&p_isn=107518&p_country=LAO&p_clas
- lsp.moic.gov.la/?r=site/displaylegal&id=289
- tilleke.com/wp-content/uploads/2024/07/Tilleke-Cybersecurity-and-Data-Protection-
- ogletree.com/international-employment-update/articles/july-2020/laos/2020-06-08/la
- dlapiperdataprotection.com/?t=authority&c=LA
Next for Laos: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026