Cybersecurity law & regulation in Laos (2026)

Laos formally enacted its first dedicated Law on Cybersecurity, published in the Official Gazette. The law defines critical national information infrastructure across five sectors (defence, technology and communications, finance and banking, energy, commerce/transport), mandates immediate incident reporting and annual cybersecurity returns to the Ministry of Technology and Communications, and introduces a 24/7 National Cybersecurity Operations System using AI and big-data analytics. Violations may attract warnings, fines, civil liability, or criminal penalties.

During the 9th Ordinary Session of the 9th National Assembly, Laos reviewed the draft Law on Cybersecurity presented by Minister of Technology and Communications Boviengkham Vongdala, marking the final legislative stage before enactment of the country's first standalone cybersecurity statute.

The Ministry of Finance of Laos suffered a data breach attributed to the cybercriminal group Funksec, exposing government financial data and underscoring the state's vulnerability to ransomware and extortion-oriented threat actors ahead of the new cybersecurity law's passage.

The Ministry of Technology and Communications approved the National Cyber Security Development Strategic Plan through 2035, establishing a long-term roadmap for building cyber resilience and supporting Laos's transition to a digital economy.

Vietnam's Ministry of Public Security agreed to assist Laos in deploying a national information-security monitoring and management system, issuing cyber-attack alerts to government agencies, and training Lao National Cyber Security Centre staff, significantly boosting Laos's operational cyber capacity as it assumed the ASEAN Chairmanship for 2024.

The Lao People's Democratic Republic Police Force inaugurated the country's first Digital Forensics Laboratory, providing dedicated capacity to analyse digital evidence from cybercrime investigations and strengthening law-enforcement's ability to prosecute offences under the 2015 Cybercrime Law.

The National Assembly enacted the Law on Electronic Data Protection, establishing consent requirements, data-minimisation obligations, security safeguards, and cross-border transfer restrictions for electronic data. MOTC and LaoCERT were designated co-enforcement authorities, creating Laos's first personal-data protection regime.

Prime Minister Decree No. 171/PM separated LaoCERT from the Lao National Internet Center, making it the independent national Computer Emergency Response Team under the Ministry of Posts and Telecommunications, with dedicated divisions for incident handling, network monitoring, research and development, and international cooperation.

Laos's first dedicated cybercrime statute criminalised unauthorised access, data interference, and online fraud, mandated the creation of LaoCERT as the national CSIRT, and provided substantive, procedural, and international-cooperation provisions, forming the cornerstone of the cybersecurity legal framework that governed the country for the next decade.