--- title: "Cambodia Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/cambodia/ source_html: /jurisdictions/cambodia/index.html description: "Cambodia data protection and privacy regulation: 10 categories, 50 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border…" generated_at: 2026-11-07T14:58:19Z content_sha256: 98c6494030a8927a59ca8d7b37e7d8ed8f1fd8103110a8af4ff6035bb36dea4d generator: "fe-fleet/md-twin@1.0" --- # Cambodia Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap overlaps: artificial-intelligence Last updated 2026-10-25 · 10 categories · 50 claims · 17 sources in the cumulative register Download report (PDF) Expand all Cambodia's Ministry of Post and Telecommunications held a Validation Workshop on the Draft Law on Personal Data Protection on 5 August 2026, bringing together government, private-sector, and EU Delegation participants ahead of the draft's passage through Cambodia's formal legislative process, at high confidence sourced to a primary MPTC publication. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: AdTech & Commercial Privacy, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Controller/Processor Duties (3 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=CAMBODIA)[Build Report](/reports/?j=CAMBODIA)[Compare](/compare/?j=CAMBODIA) Framework posture Unregulated gap 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Ministry of Post and Telecommunications (MPTC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 8 Probable · 1 Uncertain · 1 Not yet assessed 10 Categories 8 Red categories 57 Sub-modules 50 Claims 1 Tier-1 sources Traffic-light mix 8 red 1 amber 1 n/a (sums to 10 rendered categories; click to filter) 8 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 1,073 Full executive summary 203 ###### Latest update · 25 October 2026 #### Lead Signal Cambodia continues to advance its draft Law on Personal Data Protection through consultation without reaching enactment. The Ministry of Posts and Telecommunications organised a Workshop to Verify the Draft Law on Personal Data Protection on 5 August 2026, held with the EU Delegation, reflecting a continuing review process rather than a finalised instrument. No independent data-protection authority currently exists in Cambodia; the draft law envisages enforcement through MPTC-appointed inspectors holding judicial-police status, a model that would centre enforcement powers within the issuing ministry itself rather than in a separate regulatory body. #### Other Developments Proposed penalty structure takes shape, though still unenacted. The draft law is reported to propose administrative penalties of up to 600 million riel for legal entities, together with the possibility of imprisonment for repeated offences, with enforcement vested in MPTC-appointed inspectors holding judicial-police status. None of this is currently in force; no enforcement action can occur under a penalty regime that has not been enacted, and the figures and powers described should be read as the current state of the draft text rather than as operative law. #### Cross-Monitor Connections The absence of an independent data-protection authority and the proposed judicial-police enforcement model sit alongside a broader pattern of institutional enforcement capacity-building visible in Cambodia's wider regulatory environment this period, where other regulators have likewise moved toward more formalised inspection and sanction powers. Readers tracking financial-integrity and payments-sector developments in Cambodia may find this enforcement-capacity pattern a relevant parallel, though the data-protection draft law remains a distinct, unenacted instrument and should not be read as already operative. #### Outlook The draft Law on Personal Data Protection remains under consultation with no confirmed enactment timeline. The 5 August 2026 workshop with the EU Delegation suggests continuing engagement toward finalisation, but no date for enactment has been disclosed. Until enacted, the proposed enforcement powers and penalty structure described above remain prospective rather than operative, and the absence of an independent data-protection authority continues to define the current institutional landscape. 1 earlier update not shown here. ###### Standing brief · as of 5 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Cambodia's Ministry of Post and Telecommunications held a Validation Workshop on the Draft Law on Personal Data Protection on 5 August 2026, bringing together government, private-sector, and EU Delegation participants ahead of the draft's passage through Cambodia's formal legislative process, at high confidence sourced to a primary MPTC publication. This is the most concrete institutional milestone to date in Cambodia's move toward a comprehensive, GDPR-influenced data-protection statute, and it anchors this cycle's material-change assessment for the jurisdiction's regulator-and-framework posture. This development is assessed at high confidence, resting on a Tier-1 primary source published directly by the Ministry of Post and Telecommunications, rather than on secondary legal commentary. The workshop is reported to have taken place ahead of the draft proceeding through the formal legislative process, indicating Cambodia's data-protection framework remains at the pre-enactment stage even as institutional momentum builds; no comprehensive, dedicated data-protection authority currently exists in the jurisdiction, and this remains the single most consequential standing fact against which this cycle's development should be read. The involvement of the EU Delegation in the validation workshop is itself notable: it suggests the draft LPDP's development benefits from external technical or policy engagement consistent with a GDPR-influenced drafting approach, though the extent of that influence on the draft's substantive content is not established by the material available this cycle. #### Other Developments The workshop doubled as a signal on AI governance linkage. The MPTC's Secretary of State stated during the workshop that personal-data protection serves as a cornerstone for the responsible development of artificial intelligence, at high confidence, an explicit framing that positions the draft LPDP as foundational to Cambodia's emerging approach to AI governance as well as to data protection narrowly construed. No enforcement regime yet exists. Pending enactment of the draft LPDP, Cambodia has no dedicated, operational data-protection authority and no general enforcement or redress mechanism specific to personal-data violations, at high confidence; the 5 August 2026 workshop is accordingly the most concrete near-term development moving the jurisdiction toward an eventual enforcement architecture, rather than itself constituting one. The draft LPDP is reported, at assessed confidence from secondary legal commentary, to define sensitive personal data broadly, though the detail of that definition sits outside this cycle's authorised regulator-and-framework and enforcement-and-redress coverage and is not elaborated here. What is significant for the enforcement-and-redress module specifically is the structural absence of any current enforcement mechanism: without an enacted statute and a designated authority, there is no regulator empowered to investigate, sanction, or provide redress for personal-data mishandling in Cambodia today, a gap that will persist until the legislative process concludes. #### Cross-Monitor Connections The MPTC's explicit linkage of data protection to responsible AI development connects this cycle's finding to the Artificial Intelligence monitor's coverage of Cambodia's AI-governance trajectory, where the draft LPDP is likely to be tracked as a foundational instrument once enacted. Separately, institutional data-handling developments of this kind often carry downstream relevance for the Financial Integrity monitor's coverage of beneficial-ownership and reporting-entity obligations, though no financial-integrity-specific data-protection finding was identified this cycle. More broadly, the pattern of an executive-branch ministry leading data-protection drafting, rather than a dedicated independent authority, is consistent with the jurisdiction's current institutional stage, pre-enactment, with the eventual enforcement body's identity and independence still undetermined; this is a structural observation relevant to any downstream monitor assessing Cambodia's institutional readiness for cross-border data-transfer or adequacy-style arrangements, though no adequacy-specific finding is asserted here. #### Outlook With no confirmed promulgation date and no body yet designated as Cambodia's data-protection authority, the principal items to watch next cycle are whether the draft LPDP proceeds from validation workshop to formal parliamentary or Council-of-Ministers process, and whether an implementing authority is named concurrently with or ahead of enactment. Given the EU Delegation's participation in the validation workshop, continued EU engagement in the drafting process is also worth monitoring as a signal of the eventual statute's alignment with GDPR-style requirements. Institutions and observers should also watch for whether the draft's timeline slips relative to the 2027 horizon currently assessed at a multi-year uncertainty band; validation workshops of this kind do not carry a fixed statutory deadline for subsequent legislative stages, and Cambodia's own gaps register notes that neither a confirmed promulgation date nor a designated data-protection authority has yet been established. Read full brief · 1073 words Standing brief, as of 5 September 2026. #### Regulatory Status Cambodia's data-protection framework remains pre-enactment, but this cycle's Ministry of Post and Telecommunications Validation Workshop on the Draft Law on Personal Data Protection, held 5 August 2026 with EU Delegation participation, marks the most concrete institutional milestone identified to date toward a comprehensive, GDPR-influenced statute. No dedicated data-protection authority currently exists, and no enforcement or redress mechanism specific to personal-data violations is in place; both are expected to follow enactment of the draft LPDP, whose timeline remains unconfirmed and is assessed at a multi-year uncertainty band. In the interim, Cambodia's only binding data-handling obligations rest in narrow sectoral instruments: a National Bank of Cambodia reporting requirement for cross-border data handling in banking-sector outsourcing, and an E-Commerce Law marketing opt-out requirement. Eight of the ten modules in this monitor's spine, spanning lawful processing, data-subject rights, controller/processor duties, cross-border transfer, sectoral watch, adtech, algorithmic governance, and children's protections, carried no material development this cycle and are not addressed in this brief. #### Outlook Watch for whether the draft LPDP proceeds from validation workshop to Cambodia's formal legislative process, and for the naming of a specific data-protection authority, either of which would materially update this jurisdiction's regulatory-status assessment. Read full brief · 203 words Key regulatory facts for Cambodia Regulatory Dimension Cambodia Standing Position Jurisdiction Cambodia (KH) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 50 sourced findings) Regulator & Framework No comprehensive data protection law is currently in force; the draft LPDP is pre-enactment and provides no binding rights or obligations yet. Lawful Processing & Special Data All lawful-basis and special-category content derives from a pre-enactment draft; nothing is currently in force. Data Subject Rights Rights framework exists only in draft form; no binding rights are currently enforceable. Controller/Processor Duties All accountability, DPO, ROPA, security, and breach-notification content is drawn from a pre-enactment draft. Primary Instruments Cited OneTrust DataGuidance, IAPP, DLA Piper Data Protection Laws of the World, Ministry of Post and Telecommunications (MPTC), Hogan Lovells Last Confirmed / Updated 2026-10-25 (17 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Cambodia: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No comprehensive data protection law is currently in force; the draft LPDP is pre-enactment and provides no binding rights or obligations yet. Primary framework Draft Law on Personal Data Protection (LPDP) — not yet enacted Supervisory authority Ministry of Post and Telecommunications (MPTC) Traffic-light rationale — Red No comprehensive data protection law is currently in force; the draft LPDP is pre-enactment and provides no binding rights or obligations yet. #### Sub-modules (5) #### Regulator And AuthorityAmber The MPTC is the ministry drafting and administering the LPDP and is expected to appoint inspectors with judicial police status to enforce it once the law is passed; no dedicated independent DPA currently exists. Claims (4): - Under the draft LPDP, MPTC-appointed inspectors would hold judicial police status and be responsible for oversight, investigation, and suppression of data-related offenses. - As of August 2026, Cambodia has not enacted its comprehensive Law on Personal Data Protection and has no dedicated, operational data-protection authority. - Ministry of Post and Telecommunications — No independent data-protection authority exists in Cambodia; draft LPDP envisages MPTC-appointed inspectors with judicial-police status as enforcement mechanism - Cambodia has no dedicated data-protection law and no regulatory or enforcement authority specifically tasked with data-protection matters. #### Act And InstrumentsRed The LPDP is Cambodia's first comprehensive draft data protection framework; it remains unenacted. Claims (4): - Cambodia's PDP Law remains a draft, with the MPTC continuing to describe it as a 'Draft Law on Personal Data Protection' and no official enactment or grace-period start date announced. - Draft Law on Personal Data Protection — Reviewed at 5 August 2026 MPTC/EU Delegation workshop; remains a draft, not yet promulgated - Ministry of Post and Telecommunications (MPTC) — The MPTC held a Validation Workshop on the Draft Law on Personal Data Protection on 5 August 2026, involving government, private sector and EU Delegation participation, ahead of the draft proceeding through the formal legislative process. - MPTC held a Validation Workshop on the draft Law on Personal Data Protection on 5 August 2026; no enactment has followed. #### Material ScopeAmber The draft LPDP defines personal data broadly and enumerates sensitive/special categories including biometric and genetic data. Claims (3): - The draft LPDP defines personal data broadly as information relating to an identifiable natural person, with sensitive personal data including biometric and genetic data, health status, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and sexual orientation. - Draft LPDP — Art. 2: applies to processing of personal data through automated or non-automated means forming a filing system - The draft LPDP's scope provision applies to controllers/processors in Cambodia and, for foreign controllers, only to in-Cambodia collection/processing. #### Territorial ScopeAmber The draft LPDP is designed to apply extraterritorially to foreign entities offering goods or services to Cambodian residents, mirroring GDPR Art 3. Claims (1): - The draft LPDP applies to data processing in Cambodia and to overseas processing related to Cambodian residents, with specific exclusions for public authorities and personal activities. #### Regulator Registration And FilingRed No registration or filing regime is currently operative for Cambodia; the draft law's registration/filing mechanics (if any) have not been confirmed in available secondary sources. Cambodia has no comprehensive, enacted data protection statute in force. The Ministry of Post and Telecommunications (MPTC) unveiled a draft Law on Personal Data Protection (LPDP) that, if passed, would be Cambodia's first omnibus privacy framework, but as of the most recent reporting it remains a draft with no confirmed enactment or grace-period start date. In the interim, data-related obligations arise only incidentally from adjacent instruments such as the 2019 E-Commerce Law and the Law on Telecommunications, neither of which constitutes a GDPR-equivalent omnibus regime. Periodic update · new data 2026-10-25 #### Regulator & Framework Cambodia has no independent data-protection authority. The draft Law on Personal Data Protection envisages that enforcement will be carried out by Ministry of Posts and Telecommunications-appointed inspectors holding judicial-police status, placing enforcement powers inside the issuing ministry rather than a separate regulatory body. The draft law remains under active consultation: the Ministry of Posts and Telecommunications organised a Workshop to Verify the Draft Law on Personal Data Protection on 5 August 2026, held together with the EU Delegation, continuing a review process that has run since at least mid-2025. The draft law's material scope, as reported in its Article 2, is stated to apply to the processing of personal data through automated or non-automated means that form a filing system, a formulation that tracks familiar data-protection drafting conventions found in comparable regional instruments. No Cambodian government gazette or original ministry publication of the draft text has been located; the findings here rest on secondary legal commentary and a single workshop announcement, so the precise and final wording of the law as eventually enacted may differ from what is currently described. #### Outlook No enactment timeline has been confirmed. The continuing workshop and consultation process, most recently evidenced by the 5 August 2026 session with the EU Delegation, suggests the law remains a live legislative priority, but without a disclosed date, the timing of enactment and the final content of the regulator-and-framework provisions remain uncertain. 1 earlier distinct update(s) Periodic update · new data 2026-10-19 #### Regulator & Framework Cambodia has no independent or dedicated data-protection regulatory and enforcement authority as at this cycle. The draft Law on Personal Data Protection names the Ministry of Post and Telecommunications as the prospective competent authority, but this designation carries no present legal effect because the draft remains unenacted. The most recent confirmed milestone in the legislative process is a Workshop to Verify the Draft Law on Personal Data Protection, held on 5 August 2026 and co-chaired by MPTC and the EU Delegation to Cambodia. The workshop was structured to review the draft text and gather input before it proceeds to the formal legislative process; no enactment date, and no confirmation of submission to the Council of Ministers or the National Assembly, has followed. The draft law's material scope, as described in secondary legal commentary, is limited primarily to the private sector, with some public-sector aspects included. Collection, use and disclosure of personal data by public authorities generally, other than public establishments of an administrative character and public enterprises, would remain governed by other legal instruments rather than by the data-protection law itself. This scope limitation means that, even once enacted, the law would not create a single unified data-protection regime covering all public-sector data processing in Cambodia. Earlier commentary had suggested that the draft law might pass within twelve months of September 2025. That timetable has not been publicly reconfirmed, and the 5 August 2026 workshop, occurring roughly eleven months after that commentary, appears to represent a validation step still prior to formal legislative submission rather than a sign that the earlier timetable has been met. The practical reader-facing consequence is that Cambodia continues to operate, as at this cycle, with no comprehensive data-protection statute, no independent regulator, and no confirmed date by which either will come into existence. #### Outlook The development to watch is whether the draft Law on Personal Data Protection moves beyond the 5 August 2026 validation workshop toward formal submission to the Council of Ministers or the National Assembly. Confirmation of such a submission, or of a revised enactment timetable, would be the next material signal for this module. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (12) - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what) — Under the draft LPDP, MPTC-appointed inspectors would hold judicial police status and be responsible for oversight, investigation, and suppression of data-related offenses. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what) — Cambodia's PDP Law remains a draft, with the MPTC continuing to describe it as a 'Draft Law on Personal Data Protection' and no official enactment or grace-period start date announced. - [IAPP](https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance) — The draft LPDP defines personal data broadly as information relating to an identifiable natural person, with sensitive personal data including biometric and genetic data, health status, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and sexual orientation. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what) — The draft LPDP applies to data processing in Cambodia and to overseas processing related to Cambodian residents, with specific exclusions for public authorities and personal activities. - [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/index.html?t=law&c=KH) — Draft Law on Personal Data Protection — Reviewed at 5 August 2026 MPTC/EU Delegation workshop; remains a draft, not yet promulgated - [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/index.html?t=law&c=KH) — As of August 2026, Cambodia has not enacted its comprehensive Law on Personal Data Protection and has no dedicated, operational data-protection authority. - [Ministry of Post and Telecommunications (MPTC)](https://mptc.gov.kh/en/2026/08/ministry-of-post-and-telecommunications-holds-validation-workshop-on-the-draft-law-on-personal-data-protection/) — Ministry of Post and Telecommunications (MPTC) — The MPTC held a Validation Workshop on the Draft Law on Personal Data Protection on 5 August 2026, involving government, private sector and EU Delegation participation, ahead of the draft proceeding through the formal legislative process. - [Ministry of Post and Telecommunications (MPTC)](https://mptc.gov.kh/en/2026/08/ministry-of-post-and-telecommunications-holds-validation-workshop-on-the-draft-law-on-personal-data-protection/) — Ministry of Post and Telecommunications — No independent data-protection authority exists in Cambodia; draft LPDP envisages MPTC-appointed inspectors with judicial-police status as enforcement mechanism - [Hogan Lovells](https://www.hlc.com/en/publications/cambodia-moves-to-enact-comprehensive-data-privacy-law) — Draft LPDP — Art. 2: applies to processing of personal data through automated or non-automated means forming a filing system - [Ministry of Post and Telecommunications (MPTC)](https://mptc.gov.kh/en/2026/08/ministry-of-post-and-telecommunications-holds-validation-workshop-on-the-draft-law-on-personal-data-protection/) — Cambodia has no dedicated data-protection law and no regulatory or enforcement authority specifically tasked with data-protection matters. - [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/index.html?t=law&c=KH) — MPTC held a Validation Workshop on the draft Law on Personal Data Protection on 5 August 2026; no enactment has followed. - [News-Brain](https://news-brain.net/news/57adce58-bd74-4c8b-b3a1-69f03c348464) — The draft LPDP's scope provision applies to controllers/processors in Cambodia and, for foreign controllers, only to in-Cambodia collection/processing. ### Cambodia: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ All lawful-basis and special-category content derives from a pre-enactment draft; nothing is currently in force. Primary framework Draft LPDP — not yet enacted Supervisory authority Ministry of Post and Telecommunications (MPTC) Traffic-light rationale — Red All lawful-basis and special-category content derives from a pre-enactment draft; nothing is currently in force. D2 · Lawful Processing — Full Module Record 4 sub-modules · 40 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cambodia: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ Rights framework exists only in draft form; no binding rights are currently enforceable. Primary framework Draft LPDP — not yet enacted Supervisory authority Ministry of Post and Telecommunications (MPTC) Traffic-light rationale — Red Rights framework exists only in draft form; no binding rights are currently enforceable. #### Sub-modules (5) #### Access RightAmber The draft LPDP includes an access right among the data-subject rights. Claims (3): - The draft LPDP's data subject rights include access, rectification, erasure, restriction, portability, and objection, with specific timelines for responses. - Draft Law on Personal Data Protection — Grants rights including access, rectification, erasure, restriction, portability and objection, with specific timelines for responses; deadline figure not independently verified - The draft LPDP proposes a GDPR-style data-subject rights suite, not yet in force. #### Rectification And ErasureAmber Rectification and erasure rights are included in the draft LPDP's rights suite. Claims (1): - The draft LPDP's data subject rights include access, rectification, erasure, restriction, portability, and objection, with specific timelines for responses. #### Restriction And ObjectionAmber Restriction and objection rights are included in the draft LPDP's rights suite. Claims (1): - The draft LPDP's data subject rights include access, rectification, erasure, restriction, portability, and objection, with specific timelines for responses. #### Data PortabilityAmber A portability right is included in the draft LPDP's rights suite. Claims (1): - The draft LPDP's data subject rights include access, rectification, erasure, restriction, portability, and objection, with specific timelines for responses. #### Deadlines And Response WindowsRed Secondary sources confirm the draft prescribes specific response timelines for data-subject requests, but the exact number of days has not been confirmed in available materials. The draft LPDP proposes a GDPR-familiar suite of data-subject rights, but these carry no current legal force since the law has not been enacted. No existing Cambodian statute grants a general subject-access or erasure right outside the draft. Sources and claims (3) - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what) — The draft LPDP's data subject rights include access, rectification, erasure, restriction, portability, and objection, with specific timelines for responses. - [https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what](https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what) — Draft Law on Personal Data Protection — Grants rights including access, rectification, erasure, restriction, portability and objection, with specific timelines for responses; deadline figure not independently verified - [Multilaw](https://multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_Cambodia.aspx) — The draft LPDP proposes a GDPR-style data-subject rights suite, not yet in force. ### Cambodia: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ All accountability, DPO, ROPA, security, and breach-notification content is drawn from a pre-enactment draft. Primary framework Draft LPDP — not yet enacted Supervisory authority Ministry of Post and Telecommunications (MPTC) Traffic-light rationale — Red All accountability, DPO, ROPA, security, and breach-notification content is drawn from a pre-enactment draft. D4 · Controller & Processor — Full Module Record 7 sub-modules · 43 words · 10 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cambodia: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No binding transfer mechanism, adequacy status, or localisation mandate is currently in force. Primary framework Draft LPDP — not yet enacted Supervisory authority Ministry of Post and Telecommunications (MPTC) Traffic-light rationale — Red No binding transfer mechanism, adequacy status, or localisation mandate is currently in force. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 38 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cambodia: D6 Sectoral Watch7 sub-modulesRedEnacted in forceModule confidence: Probable▾ No sector-specific overlay content could be confirmed for KH beyond the bare existence of a Telecommunications Law. Traffic-light rationale — Red No sector-specific overlay content could be confirmed for KH beyond the bare existence of a Telecommunications Law. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 61 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cambodia: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No adtech/commercial-privacy content specific to KH was located. Traffic-light rationale — Red No adtech/commercial-privacy content specific to KH was located. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 49 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cambodia: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Biometric/genetic classification exists only in draft form; the surveillance-related sub-decree is unimplemented, and ADM/AI-specific governance is absent. Primary framework Draft LPDP — not yet enacted Supervisory authority Ministry of Post and Telecommunications (MPTC) Traffic-light rationale — Amber Biometric/genetic classification exists only in draft form; the surveillance-related sub-decree is unimplemented, and ADM/AI-specific governance is absent. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 65 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cambodia: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No children/vulnerable-groups content specific to KH was located in any reviewed source. Traffic-light rationale — Not assessed No children/vulnerable-groups content specific to KH was located in any reviewed source. #### Sub-modules (5) #### Age VerificationRed No age-of-consent or age-verification provisions for Cambodia were identified. #### Parental ConsentRed No parental-consent mechanism for Cambodia was identified. #### Minor Profiling BansRed No minor-profiling ban for Cambodia was identified. #### Education SettingsRed No education-settings-specific data rules for Cambodia were identified. #### Dependent AdultsRed No dependent-adult data protections for Cambodia were identified. No Cambodia-specific provisions on age of consent for data processing, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections were identified in available sources, whether in the draft LPDP summaries reviewed or in existing sectoral law. ### Cambodia: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No enforcement powers, penalties, or redress mechanisms are currently in force; all content is drawn from a pre-enactment draft. Primary framework Draft LPDP — not yet enacted Supervisory authority Ministry of Post and Telecommunications (MPTC) Traffic-light rationale — Red No enforcement powers, penalties, or redress mechanisms are currently in force; all content is drawn from a pre-enactment draft. Periodic update · new data 2026-10-25 #### Enforcement & Redress The draft Law on Personal Data Protection proposes administrative penalties of up to 600 million riel for legal entities, along with the possibility of imprisonment for repeated offences. Enforcement is proposed to be carried out by Ministry of Posts and Telecommunications-appointed inspectors holding judicial-police status, a structure that would give the ministry's own appointees direct investigative and enforcement powers rather than routing enforcement through an independent court-adjacent regulator or a separate data-protection authority. None of this framework is currently in force: the law remains a draft, and no enforcement action, penalty, or redress mechanism under it currently has legal effect. The reported penalty figures and the judicial-police enforcement model should accordingly be read as the current state of the draft text, which may be revised before any eventual enactment. #### Outlook Because the enforcement and penalty provisions described here exist only in draft form, their practical significance depends entirely on the law's eventual enactment and on whether the judicial-police inspector model and the 600 million riel penalty ceiling survive into the final text. No enactment date has been disclosed, so the enforcement and redress landscape for personal data protection in Cambodia remains undefined in binding terms for the time being. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 87 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties