Cambodia

Article 21 would require a data controller to notify the Ministry of Post and Telecommunications of a personal data breach that may pose a risk to a data subject or other natural person immediately, but no later than 72 hours from becoming aware of it, or to give the Ministry valid reasons where it could not meet that deadline.

Article 22 would separately require a data controller to notify the affected data subject immediately upon becoming aware of a breach that may pose a high risk to their rights and freedoms, unless the controller had already secured the affected data with measures such as encryption, had taken subsequent steps removing the high risk, or notifying each data subject individually would be disproportionately burdensome, in which case a public notice would serve instead; even then, the Ministry could still require notice to the data subject where it considered the breach a high risk.

The glossary defines a data breach as an incident in which personal data was accessed, disclosed, or stolen without authorization. The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on 5 August 2026 that the draft remained at a pre-legislative validation-workshop stage.

Article 2 would apply the draft to the processing of personal data by a data controller or processor located in Cambodia, and to one located outside Cambodia that supplies goods or services to, or monitors, a data subject residing there, excluding a public authority acting within its jurisdiction and a natural person acting only for personal or household activities.

Article 7 would require one of six legal bases, including the data subject's consent, before processing personal data, and Article 8 would require the verified consent of a parent or guardian before processing the personal data of a data subject under the age of 16.

Article 15 would require personal data protection by design and by default, Article 16 would require a controller or processor located outside Cambodia to appoint a local representative, and Article 17 would require a written contract between a controller and a processor.

Article 18 would require records of processing activities, Article 19 a personal data impact assessment where processing may pose a high risk, and Article 20 technical and organizational measures to secure personal data against unauthorized access, loss, or destruction. Article 24 would require a data protection officer, notified to the Ministry of Post and Telecommunications within 30 working days of appointment.

The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on 5 August 2026 that the draft remained at a pre-legislative validation-workshop stage.

Article 23 would bar a data controller from transferring personal data outside Cambodia unless the Ministry of Post and Telecommunications grants permission, the controller assesses that appropriate safeguards are in place, or the transfer rests on one of six listed circumstances, including the data subject's written consent, the necessity of performing a contract with the data subject, or the protection of the data subject's or another person's life.

A controller relying on the safeguards or listed-circumstance grounds would have to be able to provide the Ministry with evidence of them. The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on 5 August 2026 that the draft remained at a pre-legislative validation-workshop stage.

Cambodia's Draft Law on Personal Data Protection is a ministry draft; the Ministry of Post and Telecommunications confirmed on 5 August 2026 that the draft remained at a pre-legislative validation-workshop stage.

If enacted as drafted, article 34 would give a data subject the right to request human involvement where an automated decision produces a legal effect that impacts their legitimate interests or similarly affects them, unless the decision is necessary to perform a contract, is authorized by specific legal provisions, or rests on the data subject's own explicit consent.

Chapter 6 would carry the rights of data subjects: article 27 a right to information before processing, article 28 a right to access, article 29 a right to rectification, article 30 a right to erasure, article 31 a right to restriction, article 32 a right to portability, and article 33 a right to object, with an absolute right to object where processing is used entirely for direct marketing.

Article 26 would require a data controller to act on a data subject's request without undue delay and generally within one month. The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on 5 August 2026 that the draft remained at a pre-legislative validation-workshop stage.

Article 4 would make the Ministry of Post and Telecommunications the competent institution for personal data protection, empowered to regulate, audit, and monitor compliance, instruct a controller or processor to provide personal data or information, access personal data and information it needs, and receive complaints and mediate disputes.

Article 40 would let the Ministry appoint personal data inspectors with judicial police status to investigate and suppress offenses, and article 45 would let a disputing party bring a complaint to the Ministry, which would appoint a conciliator.

Article 48 would set administrative fines of up to 60,000,000 Riels for a natural person or up to the greater of 600,000,000 Riels or 10 percent of annual turnover for a legal person for noncompliance with the draft's chapters on processing, controller and processor obligations, the data protection officer, or data subject rights.

Article 51 would additionally punish a repeat natural-person offender with imprisonment from 6 days to 2 years and a fine of up to 60,000,000 Riels, and a repeat legal-person offender with a fine of up to 100,000,000 Riels. The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on 5 August 2026 that the draft remained at a pre-legislative validation-workshop stage.

Article 14 would prohibit the processing of sensitive personal data unless a data controller both has a legal basis under article 7 and meets one of nine additional listed conditions, beginning with the data subject's explicit consent.

The glossary defines sensitive personal data as personal data revealing racial origin, political opinions, religious or philosophical beliefs, or trade union membership, biometric data, genetic data, health data, and data concerning a natural person's sex life or sexual orientation.

It defines biometric data as personal data resulting from technical processing relating to an individual's physical, physiological, or behavioural characteristics from which they can be identified, giving a facial image or fingerprints as examples. The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on 5 August 2026 that the draft remained at a pre-legislative validation-workshop stage.