Online safety & content laws in Cambodia (2026)

Cambodia's parliament passed a landmark law primarily targeting online scam centres, establishing tiered penalties ranging up to life imprisonment for ringleaders whose operations cause deaths, with five new offences covering directing scams, malicious data collection, and cybercrime-linked money laundering. The law was driven by international scrutiny over Cambodia's role as a hub for forced-labour scam compounds.

A government sub-decree created a national body charged with monitoring online 'false information' and promoting Cambodia's 'positive image' and 'prestige.' Critics identified it as a formalised mechanism to suppress dissent and control public discourse under a disinformation mandate.

The Ministry of Posts and Telecommunications circulated a GDPR-modelled Draft Law on Personal Data Protection, mandating data protection officers for all controllers and processors and proposing a new Data Protection Authority with fines up to approximately USD 150,000. As of mid-2026 the law had not been enacted, leaving Cambodia among the last ASEAN states without comprehensive data privacy legislation.

The Telecommunications Regulator of Cambodia directed ISPs to block the websites and social media accounts of Radio Free Asia, the Cambodia Daily, and the Kamnotra accountability database days before the July 23 general election, citing content deemed harmful to the government's reputation. The action drew condemnation from the Committee to Protect Journalists and Reporters Without Borders.

The Ministry of Posts and Telecommunications finalised a draft Cybersecurity Law that would designate Cybersecurity Inspectors as judicial police officers and impose mandatory data localisation requirements. Access Now and international stakeholders warned that the bill's expansive government powers could enable mass surveillance and suppress online expression.

Prime Minister Hun Sen signed Sub-Decree No. 23 requiring all domestic and international internet traffic to pass through a government-controlled National Internet Gateway, with authority to block connections affecting 'national security, social order, dignity, culture, traditions, and customs' and mandatory retention of traffic data for one year. Implementation was delayed beyond the February 2022 deadline amid COVID-19 disruption and sustained international pressure, but the decree remained in force.

A third iteration of Cambodia's long-stalled Cybercrime Bill was circulated, expanding surveillance powers and criminalising broad categories of online speech, including defamation, insults, and incitement, with vague definitions. Human Rights Watch and regional civil society called on the government to scrap the bill entirely, warning it would entrench authoritarian internet control.

The Ministries of Post and Telecommunications and Information jointly issued a proclamation requiring all ISPs to install surveillance software to monitor internet content, granting authorities the power to block websites and social media accounts deemed illegal or harmful to society without judicial authorisation. This established Cambodia's first formal legal framework for online content censorship.

Cambodia adopted the Law on Telecommunications, formalising the Ministry of Post and Telecommunications' licensing authority over ISPs and digital infrastructure while permitting undeclared monitoring of private communications without judicial oversight or procedural safeguards. The law provided a broad statutory foundation for state surveillance of online activity.

Cambodian authorities began drafting a cybercrime law with technical assistance from the Council of Europe's Economic Crime Unit and regional partners, aiming to prevent the online spread of 'false information' by 'ill-willed groups.' The decade-long drafting process was repeatedly stalled by civil society objections to provisions threatening privacy and free expression.

Cambodia's 2009 Penal Code criminalised defamation (Article 305), public insult (Article 307), and incitement (Article 495) using vague definitions that authorities subsequently applied to social media posts, shares, and online commentary. These provisions became the primary legal tools for prosecuting internet users and journalists for the next decade and beyond.