LaosLaw on Cyber Security, risk assessment, access control, encryption and network security
Law on Cyber Security (2025), arts. 25 to 28, risk assessment and security measures
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- As a legal person or organization operating in cyber security work in Laos, carry out a cyber security risk assessment covering your systems, data and important digital assets, and use the results to improve your security plan.
- Apply effective access control to your systems, granting users the least privilege.
- Encrypt important and sensitive data, both stored and in transit, with strong encryption.
- Secure your network with a firewall and an intrusion detection and prevention system.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 76 provides that a violator of the Law may be punished criminally under law, among other measures; the Law defines no criminal offense of its own and states no fine amount.
Who enforces it
Enforcement body
The Ministry of Technology and Communications, to which the Government assigns direct responsibility for the unified nationwide management of cyber security work under Article 67, together with the provincial and district technology and communications offices that make up the managing bodies.
Settledness
- As of
- Open questions
- Does the Law bind from , the day Article 79 names, or only from the later day on which the promulgating decree was entered in the official gazette, since Article 79 says that day follows (ພາຍຫຼັງ, "after") the President's decree and its entry in the official gazette?
What this law does
Article 6 applies the Law to individuals, legal persons and organizations, inside and outside Laos, that operate in and relate to cyber security work in Laos. Article 25 requires legal persons and organizations to carry out cyber security risk assessments covering their systems, data and important digital assets. Article 26 requires effective access control measures that give users the least privilege.
Article 27 requires strong encryption of important and sensitive data that is stored and that is sent over a network. Article 28 requires network security measures that install a firewall and an intrusion detection and prevention system.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, is a listed company, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.