LaosLaw on Cyber Security, incident response, incident reporting and annual report
Law on Cyber Security (2025), arts. 30, 31, 40, 43 and 44, incident response and reporting
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security, Governance
As of .
What it requires
- As a legal person or organization operating in cyber security work in Laos, report a cyber security incident that causes damage to the unit responsible for cyber security immediately after discovering it.
- Develop and carry out a cyber emergency response plan.
- Use an effective system for detecting and analyzing cyber incidents.
- Submit an annual report on your cyber security situation and work, including the measures carried out and the incidents or threats that occurred and how they were resolved, to the Ministry of Technology and Communications.
- Cooperate with the investigating bodies, providing data, evidence and the system access they need, where a cyber security breach is a criminal offense.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 76 provides that a violator of the Law may be punished criminally under law, among other measures; the Law defines no criminal offense of its own and states no fine amount.
Who enforces it
Enforcement body
The Ministry of Technology and Communications, to which the Government assigns direct responsibility for the unified nationwide management of cyber security work under Article 67, together with the provincial and district technology and communications offices that make up the managing bodies.
Settledness
- As of
- Open questions
- Does the Law bind from , the day Article 79 names, or only from the later day on which the promulgating decree was entered in the official gazette, since Article 79 says that day follows (ພາຍຫຼັງ, "after") the President's decree and its entry in the official gazette?
What this law does
Article 6 applies the Law to individuals, legal persons and organizations, inside and outside Laos, that operate in and relate to cyber security work in Laos. Article 40 requires legal persons and organizations to report a cyber security incident that causes damage. The report goes to the unit responsible for cyber security immediately after the incident is discovered.
Article 31 requires them to handle and respond to cyber security emergencies by developing and carrying out an emergency response plan. Article 30 requires an effective system for detecting and analyzing cyber security incidents. Article 44 requires them to submit an annual report on their cyber security situation and work to the Ministry of Technology and Communications.
The annual report covers the cyber security measures carried out and the cyber incidents or threats that occurred and how they were resolved. Article 43 requires them to cooperate with the investigating bodies, including by providing data, evidence and access to systems, where a cyber security breach is a criminal offense.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, is a listed company, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.