CambodiaCambodia's Draft Law on Personal Data Protection, personal data breach notification
Draft Law on Personal Data Protection, articles 21-22 (personal data breach notification)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc8-42d5-80a6-8db777f61d1c/downl…A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- A data controller must notify the Ministry of Post and Telecommunications immediately, but no later than 72 hours of becoming aware of a personal data breach that may pose a risk to the data subject or another natural person, or give the Ministry valid reasons for any delay.
- A data controller must notify the affected data subject immediately upon becoming aware of a personal data breach that may pose a high risk to their rights and freedoms, unless the controller has already secured the data, has taken steps removing the high risk, or individual notice would be disproportionately burdensome, in which case a public notice serves instead.
- A data controller must notify the data subject where the Ministry of Post and Telecommunications requires it, if the Ministry considers the breach presents a high risk to the data subject's rights and freedoms, even where an exception applied.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 21 of the draft requires a controller to notify the Ministry of Post and Telecommunications immediately and within 72 hours of becoming aware of a personal data breach that may pose a risk, and to give valid reasons if it cannot meet the 72 hours. Article 22 requires notice to the data subject where the breach may pose a high risk, with listed exceptions, and lets the Ministry require that notice. These are duties to notify, and neither Article requires the breach to be documented or kept in a register; the procedure is left to the Common Guidelines. The row is a draft (Final Version, ). English: notify the Ministry within 72 hours.
- Kind
- None
- As of
What this law does
Article 21 would require a data controller to notify the Ministry of Post and Telecommunications of a personal data breach that may pose a risk to a data subject or other natural person immediately, but no later than 72 hours from becoming aware of it, or to give the Ministry valid reasons where it could not meet that deadline.
Article 22 would separately require a data controller to notify the affected data subject immediately upon becoming aware of a breach that may pose a high risk to their rights and freedoms, unless the controller had already secured the affected data with measures such as encryption, had taken subsequent steps removing the high risk, or notifying each data subject individually would be disproportionately burdensome, in which case a public notice would serve instead; even then, the Ministry could still require notice to the data subject where it considered the breach a high risk.
The glossary defines a data breach as an incident in which personal data was accessed, disclosed, or stolen without authorization. The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on that the draft remained at a pre-legislative validation-workshop stage.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .