CambodiaCambodia's Draft Law on Personal Data Protection, enforcement and penalties
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc8-42d5-80a6-8db777f61d1c/downl…An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- A data controller or processor must provide the Ministry of Post and Telecommunications with the personal data or information it instructs them to provide, and must allow it access to the personal data and information it needs to perform its functions and duties.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Chapter 2 names the Ministry of Post and Telecommunications as the authority and, in Article 4, gives it the tasks to regulate, audit and monitor personal data protection, to instruct controllers and processors to provide personal data or information it needs, and to access all personal data and information it needs. Chapters 8 to 10 create inspectors (Articles 40 to 44), dispute resolution with a conciliation report written by the Ministry (Article 45), and administrative and criminal penalties (Articles 47 to 51). The powers to audit, instruct and access are a regulator's power to demand information and not a duty on a controller to keep a log or record, so none is coded, and the audit cadence is on request. The records duty is in Article 18, which this row does not cite. The row is a draft (Final Version, ). English: the Ministry may instruct controllers and processors to provide information.
- Kind
- None
- As of
What this law does
Article 4 would make the Ministry of Post and Telecommunications the competent institution for personal data protection, empowered to regulate, audit, and monitor compliance, instruct a controller or processor to provide personal data or information, access personal data and information it needs, and receive complaints and mediate disputes.
Article 40 would let the Ministry appoint personal data inspectors with judicial police status to investigate and suppress offenses, and article 45 would let a disputing party bring a complaint to the Ministry, which would appoint a conciliator.
Article 48 would set administrative fines of up to 60,000,000 Riels for a natural person or up to the greater of 600,000,000 Riels or 10 percent of annual turnover for a legal person for noncompliance with the draft's chapters on processing, controller and processor obligations, the data protection officer, or data subject rights.
Article 51 would additionally punish a repeat natural-person offender with imprisonment from 6 days to 2 years and a fine of up to 60,000,000 Riels, and a repeat legal-person offender with a fine of up to 100,000,000 Riels. The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on that the draft remained at a pre-legislative validation-workshop stage.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .