LaosLaw on Cyber Security, critical information infrastructure
Law on Cyber Security (2025), arts. 3(2) and 15 to 21, critical information infrastructure
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Reporting, Governance
As of .
What it requires
- As an entity that owns, operates or administers a system important to the nation in a sector the Law lists, once the Government includes you on its approved list, have physical protection and access control for the system.
- Make your suppliers and external service providers pass a baseline check and be certified by the technology and communications sector.
- Report an emergency immediately to the unit responsible for cyber security.
- Keep a backup system ready for use if the main system fails.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 76 provides that a violator of the Law may be punished criminally under law, among other measures; the Law defines no criminal offense of its own and states no fine amount.
Who enforces it
Enforcement body
The Ministry of Technology and Communications, to which the Government assigns direct responsibility for the unified nationwide management of cyber security work under Article 67, together with the provincial and district technology and communications offices that make up the managing bodies.
Settledness
- As of
- Open questions
- Does the Law bind from , the day Article 79 names, or only from the later day on which the promulgating decree was entered in the official gazette, since Article 79 says that day follows (ພາຍຫຼັງ, "after") the President's decree and its entry in the official gazette?
What this law does
Article 3(2) defines a critical information infrastructure entity as a legal person, organization or body that owns, operates or manages a system that is important to the nation. Article 15 lists the sectors as defense and public security, technology and communications, finance and banking, energy, and trade, transport and logistics, plus other sectors. Article 17 has the Government approve the list of critical information infrastructure entities.
Article 18 requires those entities to have physical protection and access control. Article 19 requires their suppliers and external service providers to pass a baseline check and be certified by the technology and communications sector. Article 20 requires an emergency to be reported immediately to the unit responsible for cyber security. Article 21 requires a backup system ready for use if the main system fails.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, provides telecom services or provides cloud services.