CambodiaCriminal Code, offences in the information technology sector
Criminal Code of the Kingdom of Cambodia (2009), Arts. 427-432
In force.
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not fraudulently access or maintain access to a computer system located in Cambodia, including to copy, alter, or delete data from it.
- Reading a public, unauthenticated page without deception has not itself been held to meet this standard, and no reported case has tested the question.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Imprisonment from one month to one year and a fine from KHR 100,000 to KHR 2,000,000 for the base offence (Art. 427); imprisonment from one to two years and a fine from KHR 2,000,000 to KHR 4,000,000 where access alters or deletes data or system functioning (Art. 427, second paragraph), for obstructing system operations (Art. 428), for fraudulently introducing, deleting, or modifying data (Art. 429), or for participating in a group formed to prepare such an offence (Art. 430); an attempt draws the same penalties (Art. 431).
Penalty structure
Tiered fixed fines: KHR 100,000 to KHR 2,000,000 for the base offence under Art. 427, rising to KHR 2,000,000 to KHR 4,000,000 for the aggravated form of Art. 427 and for Arts. 428 to 430; each fine tier carries an imprisonment term.
- Rule
- Fixed only
- As of
- Currency
- KHR
- Fixed cap
- 4,000,000
What it makes you log
Logging duty
Articles 427 to 432 define offences against automated data processing systems (fraudulent access or maintaining access, obstructing operation, fraudulent introduction, deletion or modification of data), preparation, attempt and additional penalties. None creates a duty to create, keep, produce or review a log or record. The Code's general rules on where it applies (Articles 12 to 19) are not invoked by these articles, so no territorial hook is read from them.
- Kind
- None
- As of
What this law does
Article 427 punishes fraudulently accessing or maintaining access to a system of automated data processing with imprisonment of one month to one year and a fine of KHR 100,000 to KHR 2,000,000. Where the access results in deleting or modifying the system's data or altering how the system functions, the same article raises the penalty to imprisonment of one to two years and a fine of KHR 2,000,000 to KHR 4,000,000.
Article 428 punishes obstructing the operations of an automated data processing system, and Article 429 punishes fraudulently introducing, deleting, or modifying data in such a system, each at the same one-to-two-year, KHR 2,000,000-to-4,000,000 tier. Article 430 extends that same tier to participating in a group or agreement formed to prepare an offence under the Chapter. Article 431 applies the same penalties to an attempt.
None of these articles conditions liability on infringing a security measure, and no reported Cambodian case addresses whether reading a public, unauthenticated page satisfies the "fraudulent" access standard. Article 672 provides that the Code's provisions other than Book 1 apply one year after the Code's entry into force, and the text names no day for that entry into force. No notice stating the day has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .