LexLint.ioBeta

Know the law your code answers to.

Law / Laos

Laos

5 of 9 named instruments researched to a stage, across two of the ten areas of law we track: 5 in force. As of .

  1. AI law
  2. Privacy law
  3. Scraping law 2
  4. Cybersecurity law 3
  5. Communications law not researched
  6. Content moderation law not researched
  7. Product and AI liability law not researched
  8. Digital accessibility law not researched
  9. Age gating law
  10. Reuse law

in forcenot yet in forceblocked by a courtproposedno longer in force

Scraping law2 instruments, 2 in force

Research summary (305 words)

Laos has no scraping-specific statute, so general law governs each dimension separately, and no reported Lao case has tested any of them.

The Penal Code (Law No. 26/NA, ) criminalises illegal access to a computer system, but only where the actor defeats a special protection system with intent to obtain commercial, financial or private data, so a plain reading does not reach a scraper reading an unauthenticated public page; the Code separately criminalises intercepting non-public data transmissions and interfering with a computer system, neither of which is addressed to open-web reading.

No Lao statute or reported decision addresses the enforceability of a browsewrap or clickwrap terms-of-service against a scraper.

The Law on Intellectual Property No. 50/NA () has no text-and-data-mining exception; its general fair-use provision permits quotation, teaching and research uses, incidental reproduction, and reproduction of newspaper and periodical articles by the press, broadcasting or wire, subject to a fair-practice and purpose-justified extent test and a source-attribution duty, but that exception does not cover reproduction obtained by circumventing a technological protection measure or removing rights-management information, so training a model on scraped copyrighted Lao content rests only on that general ground.

The same Law protects a compilation of data as a literary work only where the selection or arrangement of its contents is itself an intellectual creation, and expressly does not extend protection to the underlying data or material, so Laos confers no sui generis database right. Laos' personal-data statute, the Law on Electronic Data Protection No. 25/NA, is named in official listings; its text has not been read from primary source, so its reach over scraped public data is not described here.

No Lao statute or reported case establishes a scraping-specific unfair-competition, misappropriation or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.

Computer misuse

Penal Code, Illegal Access to a Computer System

Penal Code No. 26/NA (), arts. 164-165Official Gazette text of the Penal Code

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2021. Publisher's page: https://laoofficialgazette.gov.la/kcfinder/upload/files/1Oct2020_Lao%20Penal%20Code_English%20version.pdf

In force. Binds public and private bodies.

What this law does

Article 165 criminalises using electronic instruments in a computer system that has a special protection system, with intent to illegally obtain commercial, financial or individuals' privately held data, punishable by three months to one year imprisonment and a fine of 2,000,000 to 5,000,000 kip.

Article 164 separately criminalises disclosing the special protection measures themselves against illegal access to a computer system, where the disclosure is made without permission and causes damage to the State, individuals, legal persons, organizations or society.

The Penal Code also criminalises, in the same chapter, illegal interception of non-public computer data transmissions (art. 167) and interference with a computer system (art. 170), neither of which is addressed to reading a page a publisher has made public. Article 425 provides that the Penal Code comes into force from the date the President of the Lao PDR issues a Presidential Decree to promulgate it and after it is published in the Official Gazette for fifteen days.

The Official Gazette records the Code as published on , and no source stating the day it came into force has been located.

What it requires

Copyright and text and data mining (TDM)

Law on Intellectual Property, Copyright Exceptions and Data Compilations

Law on Intellectual Property No. 50/NA (), arts. 103, 113Law No. 50/NA of , on Intellectual Property, WIPO Lex official record and text

In force since . Binds public and private bodies.

What this law does

Article 113 permits, without the copyright owner's consent, quotations from a lawfully published work compatible with fair use and not exceeding what the purpose justifies, including quotations from newspaper and periodical articles in the form of press summaries, and separately permits reproduction of newspaper and periodical articles on current economic, political or religious topics by the press, broadcasting or wire, and reproduction of works seen or heard while reporting a current event, each subject to a fair-use and source-indication test.

Laos has no text-and-data-mining exception distinct from this general fair-use ground, and Article 113 expressly does not apply to reproduction that requires circumventing a technological protection measure or removing rights-management information, so reproducing copyrighted Lao-hosted content for crawling or AI training rests only on the general fair-use ground and does not reach content behind a defeated technical measure.

Article 103 protects a compilation of data or other material as a literary work only where the selection or arrangement of its contents is itself an intellectual creation, and states that protection does not extend to the data or material itself, so Laos confers no sui generis database right of the kind some jurisdictions grant to a compiler regardless of originality.

What it requires

Cybersecurity law3 instruments, 3 in force

Research summary (374 words)

Laos has no product-security-requirements statute. Its Law on Cyber Security, listed as current in the Official Gazette, binds legal persons and organizations acting in cyber security work in Laos: risk assessment, access control, encryption and network defenses, incident reporting, an annual report to the Ministry of Technology and Communications, and further duties for critical information infrastructure.

The Law on Prevention and Combating Cyber Crime (2015) establishes the Lao Computer Emergency Response Team (LaoCERT) and, per LaoCERT's own published account of the law and a secondary tracker (the Digital Watch Observatory), defines ten categories of offense committed against or through a computer system: unauthorized access, disclosure of a system's protection measures, unauthorized alteration of content, unauthorized taking of data, causing harm through social media, disseminating obscene material, interfering with a system, forging computer data, destroying computer data, and dealing in tools for computer crime.

Each binds the person committing the offense rather than the system's operator or manufacturer, so the statute belongs with the scraping topic's computer-misuse family rather than with this one, and LaoCERT's own published role is coordination, threat monitoring, and voluntary incident intake, with no legislated duty on a private operator to report an incident or to maintain a security programme found in the material reached.

The statute's own primary text could not be read, because the only located copy is a scanned PDF with no extractable text layer, so this finding rests on the government's own summary of the law on LaoCERT's website together with the secondary tracker, not the statute's own wording.

Laos' Law on Electronic Data Protection No. 25/NA () is the jurisdiction's personal-data statute; its text has not been located at any official channel by this corpus's privacy research, so whether it carries its own security-of-processing provision cannot be assessed here, and any such provision would belong to the privacy topic's row for that law rather than to this one.

No standalone security regulation for the financial sector was confirmed: the Bank of the Lao PDR publishes its own legislation index (law, decree, decision, regulation, instruction, and prudential regulations for commercial banks), but no cybersecurity or IT-risk directive for licensed institutions could be confirmed within the material reached, so that question is open rather than resolved.

Sector security regimes

Law on Cyber Security, critical information infrastructure

Law on Cyber Security (2025), arts. 3(2) and 15 to 21, critical information infrastructureLaw on Cyber Security, official gazette text (Lao Official Gazette, Ministry of Justice)

In force since . Binds public and private bodies.

What this law does

Article 3(2) defines a critical information infrastructure entity as a legal person, organization or body that owns, operates or manages a system that is important to the nation. Article 15 lists the sectors as defense and public security, technology and communications, finance and banking, energy, and trade, transport and logistics, plus other sectors. Article 17 has the Government approve the list of critical information infrastructure entities.

Article 18 requires those entities to have physical protection and access control. Article 19 requires their suppliers and external service providers to pass a baseline check and be certified by the technology and communications sector. Article 20 requires an emergency to be reported immediately to the unit responsible for cyber security. Article 21 requires a backup system ready for use if the main system fails.

What it requires

Security baseline statutes

Law on Cyber Security, risk assessment, access control, encryption and network security

Law on Cyber Security (2025), arts. 25 to 28, risk assessment and security measuresLaw on Cyber Security, official gazette text (Lao Official Gazette, Ministry of Justice)

In force since . Binds public and private bodies.

What this law does

Article 6 applies the Law to individuals, legal persons and organizations, inside and outside Laos, that operate in and relate to cyber security work in Laos. Article 25 requires legal persons and organizations to carry out cyber security risk assessments covering their systems, data and important digital assets. Article 26 requires effective access control measures that give users the least privilege.

Article 27 requires strong encryption of important and sensitive data that is stored and that is sent over a network. Article 28 requires network security measures that install a firewall and an intrusion detection and prevention system.

What it requires

Vulnerability and incident reporting

Law on Cyber Security, incident response, incident reporting and annual report

Law on Cyber Security (2025), arts. 30, 31, 40, 43 and 44, incident response and reportingLaw on Cyber Security, official gazette text (Lao Official Gazette, Ministry of Justice)

In force since . Binds public and private bodies.

What this law does

Article 6 applies the Law to individuals, legal persons and organizations, inside and outside Laos, that operate in and relate to cyber security work in Laos. Article 40 requires legal persons and organizations to report a cyber security incident that causes damage. The report goes to the unit responsible for cyber security immediately after the incident is discovered.

Article 31 requires them to handle and respond to cyber security emergencies by developing and carrying out an emergency response plan. Article 30 requires an effective system for detecting and analyzing cyber security incidents. Article 44 requires them to submit an annual report on their cyber security situation and work to the Ministry of Technology and Communications.

The annual report covers the cyber security measures carried out and the cyber incidents or threats that occurred and how they were resolved. Article 43 requires them to cooperate with the investigating bodies, including by providing data, evidence and access to systems, where a cyber security breach is a criminal offense.

What it requires

Where nothing was found4 areas of law

These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.

AI law

Laos has no confirmed AI-transparency, AI-risk, AI-training-specific, AI-prohibited-practice, AI-governance, or AI-sector statute.

The Government announced in January 2026 that a forthcoming National AI Strategy will draw on findings from UNESCO's AI Ethics Readiness Assessment Methodology, launched at a national workshop with the Ministry of Technology and Communications; as of that announcement no strategy text or implementing decree had been published, so it creates no binding legal obligation and is not catalogued here.

The National Assembly reviewed a draft Law on Cybersecurity, comprising ten parts, eleven chapters and seventy-nine articles, at its 9th Ordinary Session on , addressing digital-infrastructure and data-security governance generally rather than any AI-specific conduct; its enacted text has not been located through an official channel, so its final content and status are not confirmed here.

Laos' personal-data statute, the Law on Electronic Data Protection No. 25/NA, is reported elsewhere to include a data subject's right to object to automated decision-making, but a duty of that kind attaches to personal data rather than to an AI system and is treated under the jurisdiction's privacy-topic finding, which itself records that this statute's text has not been read from primary source.

As of .

Privacy law

Laos's personal-data law has not been located at primary source. The Law on Electronic Data Protection No. 25/NA () is named by the Lao Department of Cybersecurity's own listing, but its text is not served at any official or quasi-official channel, so its provisions are not described here; what is reported about the law's substance comes from a single secondary tracker (Digital Watch Observatory), which does not meet this topic's source-quality bar, so no instrument is catalogued.

Only the named statute itself is retained, as an unverified record; nothing is stated on public data coverage, the publicly-available exemption, biometric sensitivity, or cross-border transfer posture.

As of .

Age gating law

Laos has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code. The Law on the Media No. 01/NA (), which licenses and regulates media organisations including their use of the internet, contains no minor-consent, age-verification or age-gating provision of any kind.

The Law on Protection of the Rights and Interests of Children No. 05/NA () criminalises sexual offences against children and child trafficking and sets a minimum working age, but contains no internet, online or age-verification provision; several of its penalty articles were later folded into the Penal Code, Law No. 26/NA (), which separately criminalises disseminating pornographic material through computer systems, but that offence runs against the disseminator generally and imposes no age-verification or age-gating duty on a service provider.

As of .

Reuse law

Laos has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, no hot-news or misappropriation doctrine distinct from ordinary copyright, and no dedicated ruling on hyperlinking or framing; no reported Lao decision addresses a news aggregator's reproduction of headlines or snippets.

The Law on Intellectual Property No. 50/NA () permits, without the copyright owner's consent, quotations from newspaper articles and periodicals in the form of press summaries, and separately permits reproduction of newspaper and periodical articles on current economic, political or religious topics by the press, broadcasting or wire, and reproduction of works seen or heard while reporting a current event, in each case subject to a fair-use and source-indication test with no headline-length or short-extract cap distinct from that test and no reservation right allowing a publisher to withhold its articles from the exception.

The same Law has no text-and-data-mining-specific exception, and its compilation-copyright provision protects only the creativity of a compiler's selection or arrangement, never the underlying data, so no sui generis database right exists either.

As of .

Case law

  • No current case law for Laos AI law
  • No current case law for Laos privacy law
  • No current case law for Laos scraping law
  • No current case law for Laos cybersecurity law
  • No current case law for Laos communications law
  • No current case law for Laos content moderation law
  • No current case law for Laos product and AI liability law
  • No current case law for Laos digital accessibility law
  • No current case law for Laos age gating law
  • No current case law for Laos reuse law

Reporting clocks that run here1 instrument

The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Laos comes first, then the law of the bodies above it that applies here.

The law of Laos

Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

This page covers the instruments LexLint has researched to a stage. Instruments named in the law library but not yet researched are counted in the head and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.