CambodiaCambodia's Draft Law on Personal Data Protection, cross-border data transfer
Draft Law on Personal Data Protection, article 23 (data transfer outside Cambodia)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc8-42d5-80a6-8db777f61d1c/downl…A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- A data controller must not transfer personal data outside Cambodia unless the Ministry of Post and Telecommunications grants permission, the controller assesses that appropriate safeguards are in place, or the transfer rests on one of six listed circumstances such as the data subject's written consent.NIST Privacy FrameworkCT.PO-P2
- A data controller relying on the safeguards or listed-circumstance grounds must be able to give the Ministry of Post and Telecommunications evidence of them.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 23 of the draft bars transfer of personal data outside Cambodia unless the Ministry of Post and Telecommunications gives permission, the controller assesses that appropriate safeguards are in place, or a listed circumstance applies (written consent, contract necessity, public interest, protection of life, the data subject's legitimate interests, or legal claims). Where the controller relies on safeguards or a listed circumstance, it must be able to provide evidence to the Ministry, which cannot be done without a record of the assessment or circumstance. The Article names no log, no fields, no period for keeping the evidence and no audit report. The Article sets no territorial test of its own (Article 2 is not cited by this row). The row is a draft (Final Version, ). English: the controller must be able to provide evidence to the Ministry.
- Kind
- Implicit
- As of
- Provision
- Article 23, paragraph 2 (the controller must be able to provide evidence to the Ministry where it relies on appropriate safeguards or on a listed circumstance)
- Trigger
- personal_data_processing
What this law does
Article 23 would bar a data controller from transferring personal data outside Cambodia unless the Ministry of Post and Telecommunications grants permission, the controller assesses that appropriate safeguards are in place, or the transfer rests on one of six listed circumstances, including the data subject's written consent, the necessity of performing a contract with the data subject, or the protection of the data subject's or another person's life.
A controller relying on the safeguards or listed-circumstance grounds would have to be able to provide the Ministry with evidence of them. The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on that the draft remained at a pre-legislative validation-workshop stage.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .