LexLint.ioBeta

Know the law your code answers to.

Law / Cambodia

Draft Law on Personal Data Protection, final draft

Draft Law on Personal Data Protection (Final Draft, ) articles 1-13, 15-20, 24-25 and 37-39 (general provisions, principles and lawful basis, controller and processor obligations, security of processing, data protection officer, and guidelines)

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc8-42d5-80a6-8db777f61d1c/downl…

A comprehensive regime rule binding public and private bodies.

How the hook was established
express
What makes it apply
Operator establishment, Market targeting, Data subject residence
Obligation class
Consent, Security, Governance, DPIA, Licensing, Age verification
Audit expectation
on_request
Who audits it
Regulator
Where the report goes
Produced on request

What it requires

  • A data controller or processor needs one of six legal bases, including the data subject's consent, before processing personal data, and needs a parent or guardian's verified consent before processing the personal data of a data subject under the age of 16.NIST Privacy FrameworkCT.PO-P1
  • A data controller or processor must implement personal data protection by design and by default, and must secure personal data with technical and organizational measures against unauthorized access, collection, use, disclosure, copying, modification, or destruction, and against the loss of any storage medium on which it is held.NIST Privacy FrameworkGV.PO-P2NIST Privacy FrameworkPR.DS-P5
  • A data controller that determines its processing may pose a high risk to a data subject's rights and freedoms must conduct a personal data impact assessment and submit its report to the Ministry of Post and Telecommunications.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkGV.PO-P5
  • A data controller and processor must each appoint a personal data protection officer and notify the Ministry of Post and Telecommunications of that appointment within 30 working days, maintain records of processing activities, and, if located outside Cambodia, appoint a local representative.NIST Privacy FrameworkGV.PO-P3NIST Privacy FrameworkID.IM-P4NIST Privacy FrameworkGV.PO-P5

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • ID.IM-P4Data actions of the systems/products/services are inventoried.
  • ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
  • GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
  • GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
  • GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
1 more
  • PR.DS-P5Protections against data leaks are implemented.
NIST CSF 2.0
  • PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
FINOS AIGF
7 more

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

Who enforces it

Settledness

As of
Open questions
Would Article 2(b) of the draft, which reaches a controller or processor outside Cambodia "for the purpose of supplying goods or services to data subjects or monitoring activities related to data subjects residing in the Kingdom of Cambodia", cover a foreign app that does not target Cambodia but is available to users who reside there?

What it makes you log

Who may demand the log

Regulator

Logging duty

Article 18 of the draft requires every data controller and data processor to prepare and maintain records of all personal data processing activities under its responsibility or control, and leaves the conditions, formalities and procedures to the Common Guidelines (Article 37). The draft's Article 18 names no fields, so the contents list is empty, and no period for keeping the records is stated. Beside the register, Article 8 requires the controller to be able to demonstrate the data subject's consent, Article 6 to demonstrate compliance with the processing principles, Article 10 to show the legal provisions it relies on, Article 11 to show a reasonable basis for a threat to life, Article 13 to carry out a legitimate interest assessment, Article 19 to file a data protection impact assessment report with the Ministry of Post and Telecommunications, and Article 39 to be able to demonstrate its technical and organizational measures; none of these names a record. Article 4(a) and (b) give the Ministry the task to regulate, audit and monitor and the power to instruct controllers and processors to provide the information it needs, which is why the register is open to it on request. The row is a draft (Final Version, ). English: a record of all processing activities must be prepared and maintained.

Kind
Explicit
As of
Provision
Article 18 (a record of all personal data processing activities, prepared and maintained by every controller and processor), read with Article 8 (the controller must be able to demonstrate consent) and Article 4(b) (the Ministry may instruct controllers to provide information)
Trigger
personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 2 would apply the draft to the processing of personal data by a data controller or processor located in Cambodia, and to one located outside Cambodia that supplies goods or services to, or monitors, a data subject residing there, excluding a public authority acting within its jurisdiction and a natural person acting only for personal or household activities.

Article 7 would require one of six legal bases, including the data subject's consent, before processing personal data, and Article 8 would require the verified consent of a parent or guardian before processing the personal data of a data subject under the age of 16.

Article 15 would require personal data protection by design and by default, Article 16 would require a controller or processor located outside Cambodia to appoint a local representative, and Article 17 would require a written contract between a controller and a processor.

Article 18 would require records of processing activities, Article 19 a personal data impact assessment where processing may pose a high risk, and Article 20 technical and organizational measures to secure personal data against unauthorized access, loss, or destruction. Article 24 would require a data protection officer, notified to the Ministry of Post and Telecommunications within 30 working days of appointment.

The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on that the draft remained at a pre-legislative validation-workshop stage.

When LexLint raises it

When your app profile says your app serves under-18s or processes personal data.

Back to the example  ·  Lint your app

Page updated .