Data protection & privacy law in Cambodia (2026)

All 55 senators unanimously adopted Cambodia's first dedicated cybercrime statute without amendment, completing the legislative process and sending the bill to King Norodom Sihamoni for royal promulgation. Gang leaders of scam operations face 15-30 years in prison; life imprisonment applies where victims die, and organisers face fines up to $250,000.

All 112 members of Cambodia's National Assembly voted in favour of the country's first standalone cybercrime law, targeting online scam compounds with 2-5 year sentences and fines up to $125,000 for individual offenders. The passage followed intense international pressure and sanctions over Cambodia's role as a hub for cyber-fraud operations.

The Ministry of Posts and Telecommunications released the substantially revised final draft of Cambodia's first comprehensive data-protection law (LPDP), modelled on the EU GDPR; it mandates lawful-basis processing, data-subject rights, mandatory DPO appointment for all controllers and processors, cross-border transfer rules, and administrative fines up to ~$150,000 (600 million KHR) plus 10% of annual turnover. A two-year grace period will follow royal promulgation.

Cambodia's Ministry of Posts and Telecommunications distributed an initial draft Law on Personal Data Protection (LPDP) to selected companies and held workshops, the first formal step toward a standalone data-protection statute. Critics and industry groups noted the draft applied only to the private sector and delegated more than 20 key obligations to future ministerial decrees (prakas), leaving significant legal uncertainty.

Prime Minister Hun Sen signed Sub-Decree No. 23 requiring all domestic and international internet traffic to route through a government-controlled National Internet Gateway (NIG); ISPs must retain all traffic data for 12 months, block prohibited content, and report identifiable user activity to the Ministry of Posts and Telecommunications and the Telecommunications Regulator of Cambodia. Human-rights organisations condemned the measure as enabling mass surveillance incompatible with the right to privacy.

Cambodia's e-commerce law imposed the country's first explicit statutory data-security duties: any business electronically storing personal information must implement reasonable measures against loss, unauthorised access, alteration, or disclosure. It also introduced consumer disclosure requirements and rights to correct inaccurate data, making it the primary enacted instrument governing personal data in digital transactions until a comprehensive law is passed.

Cambodia's comprehensive Criminal Code (promulgated 2009, in force 2010) introduced Articles 317-320 and 427-432 covering unauthorised computer access and related offences, the first cyber-specific criminal provisions in Cambodian law. The provisions were narrow, lacked a definition of cybercrime, and contained no data-privacy enforcement mechanism, driving subsequent calls for a standalone cybercrime statute that took 17 years to materialise.

Cambodia's Civil Code formally listed privacy alongside life, identity, and dignity as a protected personal right under Article 10, giving individuals a civil-law basis to seek injunctions and damages for privacy violations. The provision is broadly drafted and lacks implementing regulations, so its practical scope has depended entirely on court interpretation.

Cambodia's post-UNTAC Constitution enshrined in Article 40 the rights to privacy of residence and to confidentiality of postal, telegraph, fax, telex, and telephone communications, the foundational constitutional basis for all subsequent data-protection claims. The provision predates the internet era and makes no reference to digital data, leaving a significant gap that modern legislation has been slow to fill.