Cambodia: Releases New Draft of Personal Data Protection Law

Written By Jerry Sin

Phnom Penh, August 2025 — Cambodia has moved a step closer to enacting its first comprehensive personal data protection law. On July 23, the Ministry of Post and Telecommunications (MPTC) issued the third draft of the Personal Data Protection Law, according to updates confirmed by OneTrust DataGuidance with DFDL Cambodia.

The draft law is designed to regulate how organizations collect, use, and protect personal data, setting out strict requirements and penalties for those who fail to comply.

Broad Scope of Application

The law applies to both Cambodian and foreign organizations that process the personal data of individuals residing in Cambodia. This includes companies outside the country that supply goods, services, or monitor the behavior of Cambodian residents. Personal data is defined broadly as any information that identifies or can identify a natural person.

Exemptions are limited to data handled by public authorities within their official duties, and personal or household use.

Oversight and Enforcement

The MPTC will oversee compliance, with the option for a specialized Personal Data Protection Unit to be established.

Key Requirements

The draft law places significant obligations on organizations, including:

  • Establishing a lawful basis for data processing.

  • Implementing technical and organizational safeguards.

  • Maintaining records of processing activities.

  • Conducting impact assessments for high-risk data use.

  • Reporting data breaches to authorities and affected individuals.

The law also guarantees rights for individuals, including access, correction, deletion, portability, objection, and the right to seek remedies.

Notably, all organizations must appoint a Data Protection Officer (DPO) and notify the Ministry within 30 working days of appointment.

Penalties for Non-Compliance

Failure to comply could result in severe consequences. Administrative fines range up to 600 million Cambodian Riel (about USD $150,000) or 10% of a company’s annual turnover. Repeat offenders may also face criminal liability, with individuals subject to imprisonment of up to two years and additional fines.

The draft law is currently available in Khmer - here

Jerry Sin
Next

APEC: to Launch AI Initiative by 2025, Pushes for Safer, More Connected Digital World