CambodiaCambodia's Draft Law on Personal Data Protection, rights of data subjects
Draft Law on Personal Data Protection, articles 26-33 (rights of data subjects)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc8-42d5-80a6-8db777f61d1c/downl…A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- A data controller must give a data subject the information article 27 lists before processing their personal data, and must act on a request to access, rectify, erase, restrict, receive in a portable form, or object to the processing of their personal data, generally within one month of the request.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- A data controller must honor a data subject's objection to the processing of their personal data where it is used entirely for direct marketing purposes, a right the draft makes absolute.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 26 to 33 of the draft set out the data subject's rights (information, access, rectification, erasure, restriction, portability and objection) and the controller's general rules for answering requests: clear information, no rejection of a request unless the person cannot be identified, an answer within one month extendable by two months, and no charge except a reasonable fee after more than two requests in a quarter. They require no log or record of requests and give the Ministry no examination right in these Articles. The row is a draft (Final Version, ). English: a right to access or obtain a copy of one's personal data.
- Kind
- None
- As of
What this law does
Chapter 6 would carry the rights of data subjects: article 27 a right to information before processing, article 28 a right to access, article 29 a right to rectification, article 30 a right to erasure, article 31 a right to restriction, article 32 a right to portability, and article 33 a right to object, with an absolute right to object where processing is used entirely for direct marketing.
Article 26 would require a data controller to act on a data subject's request without undue delay and generally within one month. The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on that the draft remained at a pre-legislative validation-workshop stage.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .