Cambodia

Cambodia has no comprehensive, enacted data protection statute in force. The Ministry of Post and Telecommunications (MPTC) unveiled a draft Law on Personal Data Protection (LPDP) that, if passed, would be Cambodia's first omnibus privacy framework, but as of the most recent reporting it remains a draft with no confirmed enactment or grace-period start date. In the interim, data-related obligations arise only incidentally from adjacent instruments such as the 2019 E-Commerce Law and the Law on Telecommunications, neither of which constitutes a GDPR-equivalent omnibus regime.

The draft LPDP proposes a GDPR-style set of lawful bases and a broad definition of special/sensitive categories, but none of this is currently binding law. No enacted Cambodian statute presently codifies lawful-basis or consent standards for general personal data processing.

The draft LPDP proposes a GDPR-familiar suite of data-subject rights, but these carry no current legal force since the law has not been enacted. No existing Cambodian statute grants a general subject-access or erasure right outside the draft.

The draft LPDP would impose GDPR-familiar controller/processor duties — DPIAs, DPO appointment (mandatory and universal, unlike GDPR's risk-based trigger), records of processing, security measures, and breach notification — but none of these obligations are currently binding since the statute has not been enacted.

The draft LPDP proposes cross-border transfer restrictions and an overseas-representative requirement, but no enacted transfer regime, adequacy determination, or localisation mandate currently applies to Cambodia. Cambodia has neither received nor granted any adequacy decision identified in available sources.

No confirmed Cambodia-specific sectoral overlay (financial, health, telecoms/ePrivacy, employment, credit, education, or insurance) displacing or supplementing a general DP regime was identified, since no general DP regime is yet in force. Cambodia's existing Law on Telecommunications is referenced in EU official documentation as part of the domestic legal framework, but its specific data-confidentiality content could not be confirmed from available sources.

No Cambodia-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rules, cross-context advertising rules, or direct-marketing consent/suppression regime was identified in available sources. Sectoral prescriptions for advertising referenced in regional trade-press coverage relate to other ASEAN jurisdictions (e.g., Vietnam), not Cambodia, and are excluded here to avoid JID misattribution.

The draft LPDP would classify biometric and genetic data as sensitive personal data, with the latter defined more broadly than under GDPR. Public authorities performing official duties are exempted from the draft's scope. A National Internet Gateway sub-decree approved in February 2021 raises surveillance concerns but has not been implemented, per official EU reporting. No profiling-restriction, ADM-transparency, or AI-risk-assessment regime specific to Cambodia was identified.

No Cambodia-specific provisions on age of consent for data processing, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections were identified in available sources, whether in the draft LPDP summaries reviewed or in existing sectoral law.

Because no comprehensive DP statute is in force, there is currently no operative enforcement regime, penalty schedule, enforcement activity, or redress mechanism for general data protection in Cambodia. The draft LPDP proposes MPTC-appointed inspectors with judicial police status and penalties including fines and imprisonment for repeat offenses, but this is not yet binding. The most recent 180-day development is continued draft status reported as of late May 2026, with expectation (as of a September 2025 legal-industry seminar) that the law would be passed within roughly twelve months.