Cambodia Data Protection & Privacy Regulation

Other Developments

Proposed penalty structure takes shape, though still unenacted. The draft law is reported to propose administrative penalties of up to 600 million riel for legal entities, together with the possibility of imprisonment for repeated offences, with enforcement vested in MPTC-appointed inspectors holding judicial-police status. None of this is currently in force; no enforcement action can occur under a penalty regime that has not been enacted, and the figures and powers described should be read as the current state of the draft text rather than as operative law.

Cross-Monitor Connections

The absence of an independent data-protection authority and the proposed judicial-police enforcement model sit alongside a broader pattern of institutional enforcement capacity-building visible in Cambodia's wider regulatory environment this period, where other regulators have likewise moved toward more formalised inspection and sanction powers. Readers tracking financial-integrity and payments-sector developments in Cambodia may find this enforcement-capacity pattern a relevant parallel, though the data-protection draft law remains a distinct, unenacted instrument and should not be read as already operative.

Outlook

The draft Law on Personal Data Protection remains under consultation with no confirmed enactment timeline. The 5 August 2026 workshop with the EU Delegation suggests continuing engagement toward finalisation, but no date for enactment has been disclosed. Until enacted, the proposed enforcement powers and penalty structure described above remain prospective rather than operative, and the absence of an independent data-protection authority continues to define the current institutional landscape.

1 earlier update not shown here.

Standing brief · as of 5 September 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Cambodia's Ministry of Post and Telecommunications held a Validation Workshop on the Draft Law on Personal Data Protection on 5 August 2026, bringing together government, private-sector, and EU Delegation participants ahead of the draft's passage through Cambodia's formal legislative process, at high confidence sourced to a primary MPTC publication. This is the most concrete institutional milestone to date in Cambodia's move toward a comprehensive, GDPR-influenced data-protection statute, and it anchors this cycle's material-change assessment for the jurisdiction's regulator-and-framework posture. This development is assessed at high confidence, resting on a Tier-1 primary source published directly by the Ministry of Post and Telecommunications, rather than on secondary legal commentary. The workshop is reported to have taken place ahead of the draft proceeding through the formal legislative process, indicating Cambodia's data-protection framework remains at the pre-enactment stage even as institutional momentum builds; no comprehensive, dedicated data-protection authority currently exists in the jurisdiction, and this remains the single most consequential standing fact against which this cycle's development should be read. The involvement of the EU Delegation in the validation workshop is itself notable: it suggests the draft LPDP's development benefits from external technical or policy engagement consistent with a GDPR-influenced drafting approach, though the extent of that influence on the draft's substantive content is not established by the material available this cycle.

Other Developments

The workshop doubled as a signal on AI governance linkage. The MPTC's Secretary of State stated during the workshop that personal-data protection serves as a cornerstone for the responsible development of artificial intelligence, at high confidence, an explicit framing that positions the draft LPDP as foundational to Cambodia's emerging approach to AI governance as well as to data protection narrowly construed. No enforcement regime yet exists. Pending enactment of the draft LPDP, Cambodia has no dedicated, operational data-protection authority and no general enforcement or redress mechanism specific to personal-data violations, at high confidence; the 5 August 2026 workshop is accordingly the most concrete near-term development moving the jurisdiction toward an eventual enforcement architecture, rather than itself constituting one. The draft LPDP is reported, at assessed confidence from secondary legal commentary, to define sensitive personal data broadly, though the detail of that definition sits outside this cycle's authorised regulator-and-framework and enforcement-and-redress coverage and is not elaborated here. What is significant for the enforcement-and-redress module specifically is the structural absence of any current enforcement mechanism: without an enacted statute and a designated authority, there is no regulator empowered to investigate, sanction, or provide redress for personal-data mishandling in Cambodia today, a gap that will persist until the legislative process concludes.

Cross-Monitor Connections

The MPTC's explicit linkage of data protection to responsible AI development connects this cycle's finding to the Artificial Intelligence monitor's coverage of Cambodia's AI-governance trajectory, where the draft LPDP is likely to be tracked as a foundational instrument once enacted. Separately, institutional data-handling developments of this kind often carry downstream relevance for the Financial Integrity monitor's coverage of beneficial-ownership and reporting-entity obligations, though no financial-integrity-specific data-protection finding was identified this cycle. More broadly, the pattern of an executive-branch ministry leading data-protection drafting, rather than a dedicated independent authority, is consistent with the jurisdiction's current institutional stage, pre-enactment, with the eventual enforcement body's identity and independence still undetermined; this is a structural observation relevant to any downstream monitor assessing Cambodia's institutional readiness for cross-border data-transfer or adequacy-style arrangements, though no adequacy-specific finding is asserted here.

Outlook

With no confirmed promulgation date and no body yet designated as Cambodia's data-protection authority, the principal items to watch next cycle are whether the draft LPDP proceeds from validation workshop to formal parliamentary or Council-of-Ministers process, and whether an implementing authority is named concurrently with or ahead of enactment. Given the EU Delegation's participation in the validation workshop, continued EU engagement in the drafting process is also worth monitoring as a signal of the eventual statute's alignment with GDPR-style requirements. Institutions and observers should also watch for whether the draft's timeline slips relative to the 2027 horizon currently assessed at a multi-year uncertainty band; validation workshops of this kind do not carry a fixed statutory deadline for subsequent legislative stages, and Cambodia's own gaps register notes that neither a confirmed promulgation date nor a designated data-protection authority has yet been established.

Outlook

Watch for whether the draft LPDP proceeds from validation workshop to Cambodia's formal legislative process, and for the naming of a specific data-protection authority, either of which would materially update this jurisdiction's regulatory-status assessment.