{
 "jurisdiction_id": "KH",
 "jurisdiction": "Cambodia",
 "url": "https://dataprotection.gi/jurisdictions/cambodia/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-05",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 21,
  "sub_modules": 57,
  "source_register": 5
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "red",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cambodia/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "No comprehensive data protection law is currently in force; the draft LPDP is pre-enactment and provides no binding rights or obligations yet.",
   "claims": [
    {
     "statement": "Under the draft LPDP, MPTC-appointed inspectors would hold judicial police status and be responsible for oversight, investigation, and suppression of data-related offenses.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Cambodia's PDP Law remains a draft, with the MPTC continuing to describe it as a 'Draft Law on Personal Data Protection' and no official enactment or grace-period start date announced.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The draft LPDP defines personal data broadly as information relating to an identifiable natural person, with sensitive personal data including biometric and genetic data, health status, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and sexual orientation.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The draft LPDP applies to data processing in Cambodia and to overseas processing related to Cambodian residents, with specific exclusions for public authorities and personal activities.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "red",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cambodia/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "All lawful-basis and special-category content derives from a pre-enactment draft; nothing is currently in force.",
   "claims": [
    {
     "statement": "The draft LPDP requires establishing a lawful basis for processing — consent, contractual necessity, legal obligation, legitimate interests, among others.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Unlike the GDPR's precise genetic-data definition limited to physiological or health contexts, Cambodia's draft LPDP covers all genetic data linked to identity or characteristics.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "red",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cambodia/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "Rights framework exists only in draft form; no binding rights are currently enforceable.",
   "claims": [
    {
     "statement": "The draft LPDP's data subject rights include access, rectification, erasure, restriction, portability, and objection, with specific timelines for responses.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "red",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cambodia/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "All accountability, DPO, ROPA, security, and breach-notification content is drawn from a pre-enactment draft.",
   "claims": [
    {
     "statement": "The draft LPDP requires conducting data protection impact assessments for high-risk operations.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The draft LPDP's mandatory appointment of a certified data protection officer applies to all controllers and processors regardless of size or severity of their processing.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The draft LPDP requires maintaining detailed records of processing.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The draft LPDP requires implementing appropriate technical and organizational measures.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The draft LPDP includes GDPR-familiar duties covering mandatory breach notifications, DPIA submissions, and the appointment of overseas representatives.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "red",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cambodia/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "No binding transfer mechanism, adequacy status, or localisation mandate is currently in force.",
   "claims": [
    {
     "statement": "The draft LPDP requires controllers to follow strict procedures for cross-border transfers of personal data and to appoint overseas representatives where applicable.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "red",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cambodia/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "No sector-specific overlay content could be confirmed for KH beyond the bare existence of a Telecommunications Law.",
   "claims": [
    {
     "statement": "Cambodia's Law on Telecommunications is identified in official EU documentation as one of Cambodia's enacted statutes forming part of the domestic legal framework, though its specific data-confidentiality obligations were not confirmed in available sources.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "EUR-Lex",
     "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX%3A32020R0550",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "red",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cambodia/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "No adtech/commercial-privacy content specific to KH was located.",
   "claims": []
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cambodia/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "Biometric/genetic classification exists only in draft form; the surveillance-related sub-decree is unimplemented, and ADM/AI-specific governance is absent.",
   "claims": [
    {
     "statement": "The draft LPDP's sensitive personal data category includes biometric and genetic data alongside health status, racial/ethnic origin, political opinions, religious beliefs, trade union membership, and sexual orientation.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Cambodia's draft LPDP covers all genetic data linked to identity or characteristics, unlike the GDPR's more precise genetic-data definition limited to specific physiological or health contexts.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The draft LPDP exempts natural persons acting in a personal capacity and public authorities performing official duties from its scope.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "A Cambodian government sub-decree on a National Internet Gateway, approved in February 2021, increased the risk for online censorship and surveillance but had not been implemented as of the most recent official EU reporting reviewed.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "EUR-Lex",
     "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52023SC0360",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "red",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cambodia/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "No children/vulnerable-groups content specific to KH was located in any reviewed source.",
   "claims": []
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "red",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cambodia/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "No enforcement powers, penalties, or redress mechanisms are currently in force; all content is drawn from a pre-enactment draft.",
   "claims": [
    {
     "statement": "MPTC-appointed inspectors under the draft LPDP would have judicial police status and be responsible for enforcing the law, including oversight, investigation, and suppression of data-related offenses, with penalties including fines and imprisonment for repeated offenses.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Cambodia's PDP Law was, as of a September 2025 MPTC-led seminar, expected to be passed within the next 12 months, with a two-year transition period from promulgation.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "As of the most recent regional trade-press reporting reviewed, the LPDP's full effect is tentatively projected for later in the reporting year or early the following year, following a two-year rehabilitation/transition period after promulgation.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  }
 ]
}