Cybersecurity regulation in Laos (2026)

Laos published a standalone Law on Cybersecurity in the Lao Official Gazette on 20 March 2026, following National Assembly review on 23 June 2025. It introduces a comprehensive framework covering risk management, access control, encryption, network security, incident response, and registration requirements for online service providers.

The 2026 law designates five critical national information infrastructure sectors: national defence and public security; technology and communications; finance and banking; energy; and commerce, transport and logistics. Operators of these sectors face heightened security obligations including physical protection, access control, and third-party service provider oversight.

All covered entities must immediately report cybersecurity incidents to the MTC/LaoCERT. In addition, organisations must submit annual cybersecurity reports to the MTC every January, maintain data backups across multiple locations, and establish documented incident response procedures.

The 2026 law establishes a National Cybersecurity Operations System, a 24/7 central monitoring and response structure integrating big data analytics and AI. LaoCERT, operating as a division of the MTC's Department of Cyber Security, serves as the national CSIRT and front-line receiver of security breach reports from individuals and legal entities.

The Law on Prevention and Combating Cyber Crime (15 July 2015) criminalises cyber offences and established LaoCERT; the Law on Electronic Data Protection No. 25/NA (12 May 2017) requires data controllers to implement technical and organisational security measures, data backup and recovery systems, and imposes fines of up to LAK 15 million for violations.

Violations of the 2026 Law on Cybersecurity may result in warnings, fines, civil liability, or criminal penalties. The MTC is the primary supervisory authority; LaoCERT handles operational incident coordination. The 2017 data protection law additionally provides criminal sanctions for serious breaches.