Law / Cambodia

Draft Law on Personal Data Protection, final draft

Draft Law on Personal Data Protection (Final Draft, 23 June 2025) articles 1-13, 15-20, 24-25 and 37-39 (general provisions, principles and lawful basis, controller and processor obligations, security of processing, data protection officer, and guidelines)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Proposed: draft date not recorded.

A comprehensive regime rule binding public and private bodies.

As of 19 September 2026.

What it requires

Cambodia's Draft Law on Personal Data Protection has not been enacted and creates no binding duty as of the date shown; the Ministry of Post and Telecommunications confirmed on 5 August 2026 that the draft remained at a pre-legislative validation-workshop stage.
If enacted as drafted, a data controller or processor would need one of six legal bases, including the data subject's consent, before processing personal data, and would need a parent or guardian's verified consent before processing the personal data of a data subject under the age of 16.
If enacted as drafted, a data controller or processor would have to implement personal data protection by design and by default, and would have to secure personal data with technical and organizational measures against unauthorized access, collection, use, disclosure, copying, modification, or destruction, and against the loss of any storage medium on which it is held.
If enacted as drafted, a data controller determining that its processing may pose a high risk to a data subject's rights and freedoms would have to conduct a personal data impact assessment and submit its report to the Ministry of Post and Telecommunications.
If enacted as drafted, a data controller and processor would each have to appoint a personal data protection officer and notify the Ministry of Post and Telecommunications of that appointment within 30 working days, maintain records of processing activities, and, if located outside Cambodia, appoint a local representative.

What it reaches

Obligation class

Consent, Security, Governance, DPIA, Licensing, Age verification

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 2 would apply the draft to the processing of personal data by a data controller or processor located in Cambodia, and to one located outside Cambodia that supplies goods or services to, or monitors, a data subject residing there, excluding a public authority acting within its jurisdiction and a natural person acting only for personal or household activities.

Article 7 would require one of six legal bases, including the data subject's consent, before processing personal data, and Article 8 would require the verified consent of a parent or guardian before processing the personal data of a data subject under the age of 16.

Article 15 would require personal data protection by design and by default, Article 16 would require a controller or processor located outside Cambodia to appoint a local representative, and Article 17 would require a written contract between a controller and a processor.

Article 18 would require records of processing activities, Article 19 a personal data impact assessment where processing may pose a high risk, and Article 20 technical and organizational measures to secure personal data against unauthorized access, loss, or destruction. Article 24 would require a data protection officer, notified to the Ministry of Post and Telecommunications within 30 working days of appointment.

The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on 5 August 2026 that the draft remained at a pre-legislative validation-workshop stage, so nothing in this row binds anyone today.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
serves_minors

Read the law

official draft text, Ministry of Post and Telecommunications (published via Open Development Cambodia), Internet Archive capture

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived December 5, 2025. Publisher's page: https://data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc8-42d5-80a6-8db777f61d1c/downl…

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app