Cambodia does not currently have a comprehensive, enacted personal data protection law.
A Draft Law on Personal Data Protection (June 2025 version) has been circulated for public consultation, with a workshop convened by the Ministry of Posts and Telecommunications on July 23, 2025. The Ministry indicated at the time that the government aimed to complete the law by the end of 2025 or early 2026. However, as of early 2026, the law had not been formally promulgated (source: DLA Piper, Data Protection Laws of the World, updated February 13, 2026).
Update: The Ministry of Post and Telecommunications held a validation workshop on the draft law on August 5, 2026. The law had not been enacted at that time, and its current status should be confirmed before relying on this page.
What law currently applies?
In the absence of a comprehensive data protection statute, data-related obligations in Cambodia derive from sector-specific laws and regulations, including:
- Law on E-Commerce (2019): Requires online sellers and service providers to disclose identity and contact information; establishes obligations concerning electronic records and consumer protection in online transactions.
- Law on Telecommunications: Governs data handling by telecommunications operators.
- National Bank of Cambodia regulations: Impose data-security and customer-information obligations on licensed financial institutions.
- General contractual obligations under the Civil Code may also be relevant to data-handling agreements between parties.
What should businesses do now?
Businesses operating in Cambodia should:
- Monitor the progress of the draft Personal Data Protection Law and its implementing regulations.
- Ensure compliance with applicable sector-specific obligations under existing laws.
- Consider implementing data-handling policies consistent with international best practices and regional frameworks, such as the ASEAN Personal Data Protection Framework, in anticipation of enactment of a comprehensive law.
- Review contractual data-handling provisions in commercial agreements to ensure they meet current and anticipated legal obligations.
This page will be updated when the Law on Personal Data Protection is formally enacted and promulgated.
