Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Laos Data Protection & Privacy Regulation

LA schema gdpri-v2 trajectory: not yet assessed unregulated gap overlaps: Sentinel (AML/CFT), World Payments

Last updated 2026-11-04 · 10 categories · 73 claims · 21 sources in the cumulative register

Data collected 2026-11-01Data published 2026-11-04

AI-assembled from cited sources

Not covered: AdTech & Commercial Privacy, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Data Subject Rights, Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (5 open gaps).

Evidence re-verified: 2026-11-04·Position last changed: 2026-11-04·

Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build Report Compare

Framework postureUnregulated gap9 of 10 modules populated · AI-synthesised · Tier-1/2 verified

Lead supervisory authorityMinistry of Technology and Communications (MTC)Primary statutory & supervisory perimeter

Next milestone (> 2026-10-26)None scheduledNo dated future statutory milestone on record

Module coverage & confidence9 / 10 modules assessed0 Confirmed · 8 Probable · 1 Uncertain · 1 Not yet assessed

Jurisdiction brief

Latest update · 25 October 2026

Lead Signal

Laos has brought a new Law on Cybersecurity, numbered 87/NA, into force, with gazettal recorded on 20 March 2026 and an effective date understood to reach back to 1 September 2025. The instrument sits alongside the existing Law on Electronic Data Protection No. 25/NA rather than replacing it, and the two now operate as parallel regimes covering overlapping ground without a single authority positioned to reconcile them. The Ministry of Technology and Communications, which already carried responsibility for the 2017 data-protection law, continues as the body overseeing compliance and enforcement, and Laos still has no independent data-protection authority separate from that ministry.

The new law is understood to introduce a Critical National Information Infrastructure designation, identifying sectors -- reporting places finance and banking among them -- subject to heightened obligations. It is also understood to establish a National Cybersecurity Operations System that combines expert personnel with big-data analytics and artificial intelligence for continuous, around-the-clock monitoring and response. The law's text is silent on whether that monitoring system is already operational and on how it relates to the country's existing computer emergency response function, leaving the practical reach of the new monitoring capability unclear for now.

Other Developments

Beyond the cybersecurity law, standing features of the Lao framework continue unaltered. The Ministry of Technology and Communications retains a dual role: it both sets and implements rules under the 2017 data-protection law and is also the body coordinating enforcement, with no structural separation between rule-setter, business-facilitator and enforcer. Analysis drawing on World Bank material frames this concentration as a structural weakness bearing on how effectively any obligation -- old or new -- can be independently enforced against regulated entities, including the state itself.

Cross-Monitor Connections

The Critical National Information Infrastructure designation is understood to reach the finance and banking sector specifically, a point of relevance to monitoring of financial-sector regulatory obligations; readers tracking financial-integrity developments in Laos should note that heightened security-measures duties may now attach to institutions in that sector under the new cybersecurity law, independent of any existing financial-regulatory requirements.

Outlook

The near-term question is less whether these obligations exist on paper than how they will be operationalised given the absence of an independent enforcer. Whether the National Cybersecurity Operations System becomes a functioning monitoring capability, and how its relationship to existing cyber-incident response arrangements is clarified, will shape how the designation and security-measures duties are felt in practice. Entities falling within the named critical-infrastructure sectors, including finance and banking, face the more immediate question of how the risk-assessment, encryption, access-screening, backup and system-monitoring duties under the new law are expected to interact with obligations already running under the 2017 data-protection law, given that neither instrument is positioned to override the other and no single body has been identified as responsible for resolving conflicts between them.

1 earlier update not shown here.

Standing brief · as of 22 September 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Laos is understood to have no independent data-protection authority, with the Ministry of Technology and Communications combining rule-setting, business-facilitation and enforcement functions under the electronic data protection law. This finding is carried forward this cycle at a corrected, more conservative confidence level following an internal review of single-source claims.

Other Developments

Several further findings from this cycle's baseline research into the Lao framework merit attention. Reports suggest the core statutory instrument's identity is itself contested, cited variously as Law No. 25/NA of 12 May 2017 or a presidential-decree Law No. 117/PO of 23 June 2017. The framework is understood to rely on consent as the near-exclusive lawful basis for processing, without purpose-limitation or data-minimisation safeguards. It is also understood to lack any defined special category of personal data, such as health, biometric or criminal-history information. Breach-type responsibilities are understood to fall on a 'data owner' concept rather than on a clearly identified controller or processor. This cycle's challenger review is understood to have reversed an earlier finding of a wholesale absence of data subject rights, with convergent secondary sourcing indicating that access, rectification, erasure and objection rights are granted under Law No. 25/NA. The framework is understood to lack a cross-border-transfer regime comparable to international good practice, with no identified adequacy decisions, standard contractual clauses or binding corporate rules.

Cross-Monitor Connections

Two sectoral overlays identified this cycle fall outside this monitor's remit. The Law on Anti-Money-Laundering and Counter-Financing of Terrorism (No. 50/NA) is understood to govern financial-sector data-sharing relevant to AML compliance, a dimension routed to the financial-integrity monitor. The Bank of Lao PDR is understood to oversee national payment-system regulation under the Law on Payment Systems, a dimension routed to the world-payments monitor.

Outlook

This is a first baseline cycle for Laos, and core statutory identity, effective dates and rights-enforcement mechanics all await primary-source verification before this framework can be assessed with higher confidence.

Latest update · 25 October 2026

Regulatory Status

Laos now operates two parallel instruments touching personal and official data: the 2017 Law on Electronic Data Protection No. 25/NA, built around consent-based processing and overseen by the Ministry of Technology and Communications, and the newly in-force Law on Cybersecurity No. 87/NA, gazetted 20 March 2026 and understood to have taken effect from 1 September 2025. The ministry remains the sole body overseeing compliance and enforcement across the framework; Laos has no independent data-protection authority.

The cybersecurity law introduces a Critical National Information Infrastructure designation covering named sectors including finance and banking, and imposes baseline security duties -- routine risk assessment, encryption, access screening and multi-location backup -- on all legal entities, with additional physical-access-control, system-monitoring and third-party-oversight duties on designated infrastructure operators. It also establishes a National Cybersecurity Operations System pairing personnel with big-data analytics and artificial intelligence for continuous monitoring and response, though the law is silent on whether that system is operational and how it relates to the country's existing computer emergency response arrangements. Separately, cross-border transfer of personal or official data out of Laos continues to require the consent of the Information Owner or Data Administrator under the 2017 law, and must not contravene Lao law or national interests.

World Bank analysis has flagged that the Ministry of Technology and Communications' combined role as implementer and enforcer of the data-protection law leaves no structural separation between rule-setter, business-facilitator and enforcer, a concern that now extends to its administration of the cybersecurity law as well.

Outlook

The near-term trajectory is one of tightening: a second major instrument has entered into force layering security and monitoring duties onto an already consent-centric regime, without a reconciling authority or clarified operational scope for the new monitoring system. How the Critical National Information Infrastructure designation is applied in practice, particularly to finance and banking entities, and whether the National Cybersecurity Operations System becomes visibly active, are the two developments most likely to determine how this tightening is felt by regulated entities and individuals in Laos.

Standing brief · as of 22 September 2026

Regulatory Status

Laos is understood to have no independent data-protection authority, with the Ministry of Technology and Communications combining rule-setting, business-facilitation and enforcement functions under the electronic data protection law. Reports suggest the instrument's identity remains contested, cited as either Law No. 25/NA of 12 May 2017 or a presidential-decree Law No. 117/PO of 23 June 2017, alongside an implementing Guideline No. 2128 of 2018. The Law on Electronic Data Protection No. 25/NA is understood to grant data subject rights including access, rectification, erasure and objection to processing, with portability and restriction additionally noted by a single secondary source; practical enforcement mechanisms and statutory response deadlines remain unclear. The framework is understood to lack a cross-border-transfer regime comparable to international good practice, with no identified adequacy decisions, standard contractual clauses or binding corporate rules. The Law on Anti-Money-Laundering and Counter-Financing of Terrorism (No. 50/NA) is understood to govern financial-sector data-sharing obligations relevant to AML compliance.

Outlook

As a first baseline cycle, Laos carries a HIGH risk rating pending primary-source verification of its core statutory instrument, effective dates, and rights-enforcement mechanics.

Key regulatory facts for Laos
Regulatory Dimension	Laos Standing Position
Jurisdiction	Laos (LA)
Regulatory Scope	Data Protection & Privacy Regulation (10 modules, 73 sourced findings)
Regulator & Framework	No independent regulator; core instrument identity/number is contested across otherwise authoritative sources; World Bank explicitly characterizes the framework as non-comprehensive.
Lawful Processing & Special Data	Absence of special-category protections and of purpose-limitation/minimisation principles is an explicit, sourced gap finding.
Data Subject Rights	No sourced evidence of an operative subject-rights regime; treated as an explicit gap rather than silently omitted.
Controller/Processor Duties	Explicit, sourced World Bank finding of misallocated breach responsibility and absent accountability infrastructure.
Primary Instruments Cited	World Bank, Council of Europe, Lao Trade Portal, Lao Trade Portal, Asia IP Law
Last Confirmed / Updated	2026-11-04 (21 sources in cumulative register)

#

No independent regulator; core instrument identity/number is contested across otherwise authoritative sources; World Bank explicitly characterizes the framework as non-comprehensive.

Primary frameworkLaw on Electronic Data Protection No. 25/NA (12 May 2017), also cited as Law on Protection of Electronic Data No. 117/PO (23 June 2017), with implementing Guideline No. 2128 (2018)

Supervisory authorityMinistry of Technology and Communications (MTC)

Traffic-light rationale — RedNo independent regulator; core instrument identity/number is contested across otherwise authoritative sources; World Bank explicitly characterizes the framework as non-comprehensive.

Sub-modules (5)

Regulator And AuthorityRed

MTC is the implementing ministry for electronic data protection; there is no independent DPA equivalent to GDPR-style supervisory authorities.

Claims (6):

The Ministry of Technology and Communications is the implementing authority for Laos's electronic data protection law, and Laos has no independent data-protection authority separating rule-setting, business-facilitation and enforcement functions.
Ministry of Technology and Communications (MTC) is sole implementing and enforcing authority: MTC both implements and coordinates enforcement of the Law on Electronic Data Protection; no independent DPA exists.
Ministry of Technology and Communications (MTC) — The Law on Electronic Data Protection, with no independent data-protection authority in Laos.
Ministry of Technology and Communications (MTC) — implements and enforces data protection law with no independent authority: true
Ministry of Technology and Communications (MTC) — MTC both implements and coordinates enforcement of the Law on Electronic Data Protection; no independent DPA exists
Ministry of Technology and Communications (MTC) — MTC oversees compliance and enforcement of Law 25/NA; Laos has no independent data-protection authority.

Act And InstrumentsAmber

The core instrument is the Law on Electronic Data Protection, subject to a two-number discrepancy (No. 25/NA vs No. 117/PO) plus an implementing 2018 guideline.

Claims (8):

The Law on the Protection of Electronic Data (No. 25/NA) was enacted in 2017.
A discrepancy exists across otherwise authoritative sources as to the instrument's reference number and date: National Assembly Law No. 25/NA dated 12 May 2017 (Lao Trade Portal, Council of Europe) versus presidential-decree No. 117/PO dated 23 June 2017 (World Bank), both apparently referring to the same underlying statute, alongside an implementing Guideline No. 2128 of 2018.
Law on Cybersecurity No. 87/NA was gazetted on: Published in the Lao Official Gazette on 20 March 2026, for the first time defining 'cybersecurity' and 'critical national information infrastructure' (CNII) in Lao legislation.
Law on Cybersecurity No. 87/NA revises definition of: Revisits the definition of personal data to align it more closely with international standards.
Law on Electronic Data Protection No.25/NA — 12 May 2017, supplemented by a 2018 Implementing Guideline (No.2128).
Law on Cybersecurity No. 87/NA — Published in the Lao Official Gazette on 20 March 2026 and entered into force from 1 September 2025.
Law on Cybersecurity No. 87/NA — Published in the Lao Official Gazette on 20 March 2026, for the first time defining 'cybersecurity' and 'critical national information infrastructure' (CNII) in Lao legislation
Law on Cybersecurity No. 87/NA — Revisits the definition of personal data to align it more closely with international standards

Material ScopeAmber

Scope extends to 'general' and 'specific' categories of electronic data across public and private sectors, broader than a narrow personal-data definition.

Claims (3):

Laos's electronic data protection law is broader-than-typical in scope, covering 'general' and 'specific' electronic data rather than personal data alone.
Law on Electronic Data Protection No. 25/NA covers scope of: 'General' and 'specific' (sensitive) electronic data, broader than personal data alone.
Law on Electronic Data Protection No. 25/NA — 'General' and 'specific' (sensitive) electronic data, broader than personal data alone

Territorial ScopeRed

No explicit extraterritorial-application clause for non-established controllers was identified in available secondary sources.

Claims (3):

Law on Electronic Data Protection No. 25/NA applies territorially to: Domestic and foreign entities operating within Laos; does not extend on a pure targeting basis to entities with no Lao presence.
Law 25/NA — extends territorial scope to foreign entities without physical presence: true
Law on Electronic Data Protection No. 25/NA — Domestic and foreign entities operating within Laos; does not extend on a pure targeting basis to entities with no Lao presence

Regulator Registration And FilingRed

No controller registration or filing regime with a data-protection authority was identified; MTC-administered licensing (e.g., software/internet-content-center licensing) exists for related ICT services but is not a DP filing obligation.

Claims (1):

Related ICT-sector licensing (e.g., Software Business and Internet Content Center licensing under Decision No. 143/MPT) requires operators to respect and protect personal data of service users, including a general prohibition on disclosure except at the request of relevant government authorities, but this is a sector licensing condition rather than a DPA filing/registration regime.

Category narrative 124 words

Laos has no independent data-protection authority. The Ministry of Technology and Communications (MTC) implements the Law on Electronic Data Protection, creating no separation between rule-setter, business-facilitator and enforcer. The primary instrument is variously cited as Law on Electronic Data Protection No. 25/NA (12 May 2017) per the Lao Trade Portal and Council of Europe, and as Law on Protection of Electronic Data No. 117/PO (23 June 2017) per the World Bank, with an implementing Guideline No. 2128 of 2018; both are treated as referring to the same underlying instrument pending clarification. The law covers both 'general' and 'specific' electronic data — a broader scope than typical personal-data statutes — but the World Bank's own assessment finds it falls short of a general-purpose, GDPR-comparable regime.

Periodic update · new data 2026-11-04

Regulator & Framework

Laos has no independent data-protection authority. The Ministry of Technology and Communications itself implements and coordinates enforcement of the country's electronic data protection law, a structure a 2022 World Bank assessment confirms remains the operative arrangement. The foundational instrument, the Law on Electronic Data Protection (No. 25/NA), was enacted on 12 May 2017 and continues to apply without a dedicated regulator sitting apart from the Ministry's general remit. Its territorial scope is understood to extend to foreign entities without a physical presence in Laos that engage in activities subject to the law's provisions, a reading corroborated across more than one secondary source.

A new instrument layers onto this base: the Law on Cybersecurity (No. 87/NA), published in the Official Gazette on 20 March 2026, introduces a concept of Critical National Information Infrastructure spanning five designated sectors. This is a structural addition to the regulatory architecture rather than a replacement of the 2017 data-protection law, and it brings incident-reporting and infrastructure-protection obligations into the framework alongside the existing consent-centred data-protection regime.

Outlook

The absence of an independent supervisory authority remains the central structural feature of the Lao framework as at this record. The newly gazetted Cybersecurity Law adds a further compliance layer without resolving that gap, and a separate unresolved question records two differing official reference numbers for the 2017 statute itself, leaving which citation is operative unsettled.

2 earlier distinct update(s)

Periodic update · new data 2026-10-25

Regulator & Framework

Laos's Law on Cybersecurity No. 87/NA was gazetted on 20 March 2026 and is understood to have entered into force from 1 September 2025. The Ministry of Technology and Communications oversees compliance and enforcement of the 2017 Law on Electronic Data Protection No. 25/NA, and Laos has no independent data-protection authority standing apart from the ministry itself. The arrival of the cybersecurity law changes the shape of the framework without replacing any part of it: the two instruments now stand side by side, the older one built around consent and the newer one built around security duties and a national monitoring capacity, with no single body named as responsible for reconciling them where they touch the same ground.

World Bank analysis of Laos's digital readiness has identified the concentration of rule-setting, implementation and enforcement functions inside the same ministry as a structural weakness in how obligations of this kind can be made to bite. That finding predates the new cybersecurity law but applies with at least equal force to it, since the same ministry is positioned to administer both instruments.

Outlook

What remains open is whether the two instruments will be formally harmonised or left to operate in parallel, and whether the ministry's dual position as both implementer and enforcer will be revisited as the new law's obligations come into practical effect.

Periodic update · new data 2026-10-11

Regulator & Framework

Laos's data-protection and data-security architecture rests on two statutes whose relationship to one another is, as at this cycle, unresolved. The base instrument is the Law on Electronic Data Protection No. 25/NA, dated 12 May 2017, which covers both general electronic data and a specific category of sensitive data, a scope broader than personal data alone. Implementation and enforcement coordination for this law sits with the Ministry of Technology and Communications, which functions as the sole body with this role; Laos has no independent data protection authority, a fact confirmed by the World Bank's own 2022 digital-economy gap analysis of the country.

Into this existing framework, the Lao Official Gazette published on 20 March 2026 a new Law on Cybersecurity, No. 87/NA. This is, per secondary legal commentary reviewed this cycle, the first Lao statute to define the terms "cybersecurity" and "critical national information infrastructure," positioning the law as part of the country's broader digital-transformation agenda. The same commentary states that the 2026 law also revisits the definition of personal data, in a manner intended to bring it more closely into line with international standards. What is not established by the sources reviewed is whether this revision amends the 2017 law's treatment of personal and sensitive data directly, whether the Cybersecurity Law operates as a free-standing parallel regime, or whether the two instruments are meant to be read together without either formally superseding the other. No primary gazette text establishing an explicit amendment, repeal, or consolidation relationship was retrieved this cycle, and this is recorded as an open gap rather than resolved by inference.

This is a structural development rather than an incremental one: a second national statute now touches the definition of personal data and related obligations in a jurisdiction that previously had a single governing instrument on the subject. Until primary text resolving the relationship between the two laws becomes available, any assessment of Laos's data-protection perimeter must treat the 2017 law's definitions and the 2026 law's definitions as potentially divergent sources of obligation, administered by the same ministry but without a dedicated oversight body positioned to reconcile them. The absence of an independent regulator is itself a notable structural feature here: in jurisdictions with an active, independent supervisory authority, exactly this kind of definitional overlap between two statutes would typically be resolved or at least publicly flagged by that authority's own guidance. In Laos, no such clarifying voice exists, and the practical reading of the regime is left to secondary commentary from law firms and multilateral institutions rather than to the regulator itself.

A secondary but related open question concerns the base law's own citation. Sources reviewed this cycle show a discrepancy between "Law on Electronic Data Protection No. 25/NA, 12 May 2017" and an alternative citation of "No. 117/PO, 23 June 2017" appearing elsewhere; this discrepancy was not resolved from the sources available and is carried forward as an open gap rather than silently reconciled.

Outlook

The question of how the Law on Cybersecurity No. 87/NA interacts with the Law on Electronic Data Protection No. 25/NA is the single most consequential open item for the Lao framework going into the next quarter. If, as stated in the Ministry's own regulatory horizon tracking, this relationship is clarified in the final quarter of 2026, it is likely to come either through an implementing decree under the new Cybersecurity Law or through further Ministry of Technology and Communications guidance. Until such clarification, any compliance assessment of Laos's data-protection regime should treat the two instruments as running in parallel, with the 2017 law's consent-centred processing rules and the 2026 law's security and critical-infrastructure provisions both potentially applicable. No change to the absence of an independent data protection authority has been identified, and the Ministry of Technology and Communications remains the sole implementing body for the foreseeable period covered by this cycle's research.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (21)

Probable World Bank — The Ministry of Technology and Communications is the implementing authority for Laos's electronic data protection law, and Laos has no independent data-protection authority separating rule-setting, business-facilitation and enforcement functions. observed 2026-08-06
Probable Council of Europe — The Law on the Protection of Electronic Data (No. 25/NA) was enacted in 2017. observed 2026-08-06
Uncertain Lao Trade Portal — A discrepancy exists across otherwise authoritative sources as to the instrument's reference number and date: National Assembly Law No. 25/NA dated 12 May 2017 (Lao Trade Portal, Council of Europe) versus presidential-decree No. 117/PO dated 23 June 2017 (World Bank), both apparently referring to the same underlying statute, alongside an implementing Guideline No. 2128 of 2018. observed 2026-08-06
Probable World Bank — Laos's electronic data protection law is broader-than-typical in scope, covering 'general' and 'specific' electronic data rather than personal data alone. observed 2026-08-06
Probable Lao Trade Portal — Related ICT-sector licensing (e.g., Software Business and Internet Content Center licensing under Decision No. 143/MPT) requires operators to respect and protect personal data of service users, including a general prohibition on disclosure except at the request of relevant government authorities, but this is a sector licensing condition rather than a DPA filing/registration regime. observed 2026-08-06
Probable World Bank — Ministry of Technology and Communications (MTC) is sole implementing and enforcing authority: MTC both implements and coordinates enforcement of the Law on Electronic Data Protection; no independent DPA exists. observed 2026-11-01
Probable Asia IP Law — Law on Cybersecurity No. 87/NA was gazetted on: Published in the Lao Official Gazette on 20 March 2026, for the first time defining 'cybersecurity' and 'critical national information infrastructure' (CNII) in Lao legislation. observed 2026-10-11
Probable iLaw Asia — Law on Cybersecurity No. 87/NA revises definition of: Revisits the definition of personal data to align it more closely with international standards. observed 2026-10-11
Probable Lao Trade Portal — Law on Electronic Data Protection No. 25/NA covers scope of: 'General' and 'specific' (sensitive) electronic data, broader than personal data alone. observed 2026-11-01
Uncertain Digwatch — Law on Electronic Data Protection No. 25/NA applies territorially to: Domestic and foreign entities operating within Laos; does not extend on a pure targeting basis to entities with no Lao presence. observed 2026-11-01
Probable Lao Trade Portal — Ministry of Technology and Communications (MTC) — The Law on Electronic Data Protection, with no independent data-protection authority in Laos.
Probable World Bank — Law on Electronic Data Protection No.25/NA — 12 May 2017, supplemented by a 2018 Implementing Guideline (No.2128).
Probable World Bank — Ministry of Technology and Communications (MTC) — implements and enforces data protection law with no independent authority: true
Probable CaseGuard — Law 25/NA — extends territorial scope to foreign entities without physical presence: true observed 2026-11-01
Probable DLA Piper — Law on Cybersecurity No. 87/NA — Published in the Lao Official Gazette on 20 March 2026 and entered into force from 1 September 2025. observed 2026-10-11
Probable https://thedocs.worldbank.org/en/doc/c01714a0bc2ca257bdfe8f3f75a64adc-0070062022/original/Positioning-The-Lao-PDR-for-a-Digital-Future-11-10-22.pdf — Ministry of Technology and Communications (MTC) — MTC both implements and coordinates enforcement of the Law on Electronic Data Protection; no independent DPA exists
Probable Asia IP Law — Law on Cybersecurity No. 87/NA — Published in the Lao Official Gazette on 20 March 2026, for the first time defining 'cybersecurity' and 'critical national information infrastructure' (CNII) in Lao legislation observed 2026-10-11
Probable iLaw Asia — Law on Cybersecurity No. 87/NA — Revisits the definition of personal data to align it more closely with international standards observed 2026-10-11
Probable https://www.laotradeportal.gov.la/en-gb/site/display/1718 — Law on Electronic Data Protection No. 25/NA — 'General' and 'specific' (sensitive) electronic data, broader than personal data alone
Uncertain Multilaw — Law on Electronic Data Protection No. 25/NA — Domestic and foreign entities operating within Laos; does not extend on a pure targeting basis to entities with no Lao presence observed 2026-10-25
Probable https://www.clym.io/regulations/e-data-protection-law-no-25na-laos — Ministry of Technology and Communications (MTC) — MTC oversees compliance and enforcement of Law 25/NA; Laos has no independent data-protection authority.

#

Absence of special-category protections and of purpose-limitation/minimisation principles is an explicit, sourced gap finding.

Primary frameworkLaw on Electronic Data Protection No. 25/NA (12 May 2017) / No. 117/PO (23 June 2017)

Supervisory authorityMinistry of Technology and Communications (MTC)

Traffic-light rationale — RedAbsence of special-category protections and of purpose-limitation/minimisation principles is an explicit, sourced gap finding.

D2 · Lawful Processing — Full Module Record4 sub-modules · 51 words · 9 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

No sourced evidence of an operative subject-rights regime; treated as an explicit gap rather than silently omitted.

Primary frameworkLaw on Electronic Data Protection No. 25/NA (12 May 2017) / No. 117/PO (23 June 2017)

Traffic-light rationale — RedNo sourced evidence of an operative subject-rights regime; treated as an explicit gap rather than silently omitted.

Sub-modules (5)

Access RightRed

No statutory subject-access-request mechanism identified.

Claims (4):

Law on Electronic Data Protection No. 25/NA recognises rights of: Access, rectification, erasure, portability and objection, per secondary commentary, without a statutory response deadline, extension test or fee rule located in primary text.
Law on Electronic Data Protection No.25/NA — Individuals may request access to, rectification of, and deletion of electronic data no longer necessary for its original purpose.
Individuals under Law 25/NA — have right to access personal data: true
Law on Electronic Data Protection No. 25/NA — Access, rectification, erasure, portability and objection, per secondary commentary, without a statutory response deadline, extension test or fee rule located in primary text

Rectification And ErasureRed

No statutory right to rectification or erasure identified.

Restriction And ObjectionRed

No statutory restriction or objection right identified.

Data PortabilityRed

No portability right identified.

Deadlines And Response WindowsRed

No statutory controller response deadlines identified.

Category narrative 40 words

No comprehensive, GDPR-analogue data-subject-rights framework (access, rectification/erasure, restriction/objection, portability, statutory response deadlines) was identified for Laos in available Tier-1/Tier-2 secondary sources. This is consistent with the World Bank's characterization of the statute as falling short of general-application data-protection good practice.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (4)

Uncertain Multilaw — Law on Electronic Data Protection No. 25/NA recognises rights of: Access, rectification, erasure, portability and objection, per secondary commentary, without a statutory response deadline, extension test or fee rule located in primary text. observed 2026-10-25
Probable Digwatch — Law on Electronic Data Protection No.25/NA — Individuals may request access to, rectification of, and deletion of electronic data no longer necessary for its original purpose. observed 2026-11-01
Uncertain Digwatch — Individuals under Law 25/NA — have right to access personal data: true observed 2026-11-01
Uncertain https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_Laos.aspx — Law on Electronic Data Protection No. 25/NA — Access, rectification, erasure, portability and objection, per secondary commentary, without a statutory response deadline, extension test or fee rule located in primary text

#

Explicit, sourced World Bank finding of misallocated breach responsibility and absent accountability infrastructure.

Primary frameworkLaw on Electronic Data Protection No. 25/NA (12 May 2017) / No. 117/PO (23 June 2017); Decision on Software and Data Center Business No. 143/MPT (2017)

Supervisory authorityMinistry of Technology and Communications (MTC)

Traffic-light rationale — RedExplicit, sourced World Bank finding of misallocated breach responsibility and absent accountability infrastructure.

Periodic update · new data 2026-10-25

Controller/Processor Duties

The Law on Cybersecurity requires all legal entities to carry out routine risk assessments, apply data encryption, screen access and maintain multi-location data backup. Entities designated as Critical National Information Infrastructure across five named sectors face additional duties covering physical access control, system monitoring and oversight of third parties. These duties sit alongside, rather than inside, the obligations already running under the 2017 data-protection law, so an entity operating critical infrastructure in Laos is now working from two instruments rather than one.

Outlook

The practical weight of the new security-measures duties will depend on how the Critical National Information Infrastructure designation is applied sector by sector, and on what, if any, guidance follows to clarify how the screening, monitoring and backup requirements are to be evidenced.

Periodic update · new data 2026-10-11

Controller/Processor Duties

Controllers and processors operating in Laos now face obligations drawn from at least three distinct sources, each with different scope, different triggers, and different consequences for non-compliance. The longest-standing of these is Article 26 of the Law on Electronic Data Protection No. 25/NA, which requires notification to LaoCERT in the event of an intrusion or electronic data breach. This notification duty is oriented primarily toward obtaining technical assistance rather than toward informing affected individuals; the law as reviewed does not establish a mandatory individual-notification duty, nor does it state a sanction for a failure to notify LaoCERT.

Sitting alongside Article 26 is a sector-specific decree applicable to financial service providers, which requires those providers to notify affected customers immediately upon a breach and to report the breach to the Bank of the Lao PDR where it has an "important adverse impact" or is "large scale." Neither of these two qualifying terms is defined in the decree, and no sanction attaches to a failure to report. This leaves financial institutions operating under a notification duty whose triggering threshold is, in practical terms, a matter of judgment rather than a bright-line test, and whose enforceability is correspondingly uncertain.

The most significant recent addition to this landscape is the Law on Cybersecurity No. 87/NA, gazetted 20 March 2026, which imposes duties of risk assessment, encryption, access screening, and multi-location backup on all legal entities, not merely financial-sector participants or entities handling sensitive data. This is a materially broader and more prescriptive set of security obligations than anything previously identified in the Lao framework, and it applies on a general basis rather than being confined to a particular sector or a particular category of data. Because the relationship between this new law and the 2017 base law remains unresolved in the sources reviewed, it is not yet clear whether these Cybersecurity Law duties operate as an overlay on top of the Article 26 breach-notification regime, replace it for certain categories of entity, or exist as a wholly separate compliance track.

Two further duties are referenced only in secondary commentary and were not confirmed against primary legal text this cycle: an impact-assessment-like obligation for high-risk processing (without a located DPIA trigger list), and a requirement to maintain a team or employee supervising the protection of sensitive data, which falls well short of a GDPR-style Data Protection Officer in that it carries no defined duties, rights, scope, or registration requirement. Both of these should be treated as unconfirmed pending retrieval of primary text, rather than as settled features of the regime.

Taken together, these developments point to an accountability framework that is accreting breadth, particularly through the new Cybersecurity Law's general security-measures duty, while remaining comparatively shallow in its enforcement architecture: none of the three notification-and-security regimes identified this cycle carries a clearly stated penalty for non-compliance, and the Ministry of Technology and Communications' role as sole implementing authority means there is no independent body positioned to issue clarifying guidance on how the regimes interact.

Outlook

Entities with a Lao presence should expect the practical compliance burden to increase as the Cybersecurity Law's risk-assessment, encryption, access-screening and backup duties come into effect across all legal entities, regardless of sector. Clarification of how this new general duty interacts with the sector-specific financial-services breach decree and with the narrower Article 26 LaoCERT notification channel is the key item to watch; absent such clarification, entities face the practical choice of complying with the most conservative reading across all three regimes. No change to the absence of a defined DPIA trigger list or to the under-specified sensitive-data-supervision role has been identified this cycle.

D4 · Controller & Processor — Full Module Record7 sub-modules · 64 words · 16 traced claims · Re-verified 2026-11-04

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Sourced confirmation of absence of a clear transfer-mechanism regime, notwithstanding a general cross-border/encryption reference in the underlying law.

Primary frameworkLaw on Electronic Data Protection No. 25/NA (12 May 2017) / No. 117/PO (23 June 2017)

Supervisory authorityMinistry of Technology and Communications (MTC)

Traffic-light rationale — RedSourced confirmation of absence of a clear transfer-mechanism regime, notwithstanding a general cross-border/encryption reference in the underlying law.

D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 56 words · 8 traced claims · Re-verified 2026-11-04

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Financial and telecoms sectoral instruments are sourced; health/employment/credit/education/insurance overlays are an explicit, sourced gap.

Primary frameworkLaw on Anti-Money Laundering and Counter-Financing of Terrorism No. 50/NA; Law on Payment Systems (2017); Law on Telecommunications (Amended) No. 09/NA (2021)

Supervisory authorityBank of Lao PDR (BoL) / Telecommunications Regulatory Authority (TRA)

Traffic-light rationale — AmberFinancial and telecoms sectoral instruments are sourced; health/employment/credit/education/insurance overlays are an explicit, sourced gap.

Periodic update · new data 2026-11-04

Sectoral Watch

The Law on Cybersecurity (No. 87/NA), gazetted on 20 March 2026, designates finance and banking as one of five Critical National Information Infrastructure sectors, alongside national defence and public security, technology and communications, energy, and commerce, transport and logistics. This is a newly surfaced sectoral overlay: entities operating within the finance and banking sector now sit within a designated infrastructure-protection category under the Cybersecurity Law, layered on top of whatever obligations already attach to them under the 2017 electronic data protection framework.

This development is distinct from, and additional to, the data-protection law's general consent-based processing rules; it is a national-security and infrastructure-resilience designation rather than a personal-data-specific obligation, though its reach into the finance and banking sector gives it direct relevance for any organisation processing personal data within that sector's systems.

Outlook

As at 20 March 2026, the finance-sector designation is in force under the Cybersecurity Law. No further sector-specific guidance or implementing regulation detailing the practical content of the finance-sector overlay has been located in this record.

D6 · Sectoral Watch — Full Module Record7 sub-modules · 65 words · 4 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Comprehensive absence of an adtech/commercial-privacy regime; explicit gap finding rather than silent omission.

Traffic-light rationale — RedComprehensive absence of an adtech/commercial-privacy regime; explicit gap finding rather than silent omission.

D7 · AdTech & Marketing — Full Module Record6 sub-modules · 27 words · 1 traced claims · Re-verified 2026-11-04

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

No profiling/ADM/biometric/genetic regime found; only a narrow, sourced state-surveillance carve-out exists, without independent oversight limits.

Primary frameworkLaw on Prevention and Combating Cyber Crime No. 61/NA (2015)

Supervisory authorityMinistry of Public Security / LaoCERT

Traffic-light rationale — RedNo profiling/ADM/biometric/genetic regime found; only a narrow, sourced state-surveillance carve-out exists, without independent oversight limits.

Periodic update · new data 2026-10-25

Algorithmic, Biometric & Surveillance Governance

The Law on Cybersecurity establishes a National Cybersecurity Operations System combining expert personnel with big-data analytics and artificial intelligence, intended to provide continuous, round-the-clock monitoring and response. The law does not state whether the system is already operational, and its relationship to the country's existing computer emergency response function is not addressed in the text. This is the first instrument in Laos to place artificial intelligence and large-scale data analytics explicitly inside a state monitoring function, rather than leaving such activity to unwritten practice.

Outlook

Whether the monitoring system becomes operationally distinct from, or absorbed into, existing incident-response arrangements will determine how visible its activity becomes to entities and individuals affected by it.

D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 66 words · 5 traced claims · Re-verified 2026-11-04

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Comprehensive absence of a children/vulnerable-groups data protection regime; explicit gap finding.

Traffic-light rationale — Not assessedComprehensive absence of a children/vulnerable-groups data protection regime; explicit gap finding.

Sub-modules (5)

Age VerificationRed

No age-verification requirement identified.

Minor Profiling BansRed

No minor-profiling ban identified.

Education SettingsRed

No education-settings-specific data rule identified.

Dependent AdultsRed

No dependent-adults data protection provision identified.

Category narrative 25 words

No age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adults protection specific to electronic/personal data processing was identified for Laos in available secondary sources.

#

No independent enforcement body, no sourced penalty/redress framework, and no recent developments identified — an explicit, sourced gap.

Primary frameworkLaw on Electronic Data Protection No. 25/NA (12 May 2017) / No. 117/PO (23 June 2017)

Supervisory authorityMinistry of Technology and Communications (MTC)

Traffic-light rationale — RedNo independent enforcement body, no sourced penalty/redress framework, and no recent developments identified — an explicit, sourced gap.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 69 words · 5 traced claims · Re-verified 2026-11-04

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 73 claim(s) (73 category placement(s)), 21 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 24 Oct 2026: not upheld (3 confirmed against the cited source; 1 contradicted by the cited source; 8 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (43 mapped).

Show article map

GDPR article to category mapping
Article	Category	Sub-module
`Art. 5`	Controller/Processor Duties	accountability and dpia
`Art. 6`	Lawful Processing & Special Data	lawful bases
`Art. 7`	Lawful Processing & Special Data	consent thresholds
`Art. 9`	Lawful Processing & Special Data	special categories
`Art. 13`	Data Subject Rights	access right
`Art. 14`	Data Subject Rights	access right
`Art. 15`	Data Subject Rights	access right
`Art. 16`	Data Subject Rights	rectification and erasure
`Art. 17`	Data Subject Rights	rectification and erasure
`Art. 18`	Data Subject Rights	restriction and objection
`Art. 19`	Data Subject Rights	restriction and objection
`Art. 20`	Data Subject Rights	data portability
`Art. 21`	Data Subject Rights	restriction and objection
`Art. 22`	Algorithmic, Biometric & Surveillance Governance	automated decision making transparency
`Art. 25`	Controller/Processor Duties	accountability and dpia
`Art. 28`	Controller/Processor Duties	joint controller arrangements
`Art. 30`	Controller/Processor Duties	ropa requirements
`Art. 32`	Controller/Processor Duties	security measures
`Art. 33`	Controller/Processor Duties	breach notification
`Art. 34`	Controller/Processor Duties	breach notification
`Art. 35`	Controller/Processor Duties	accountability and dpia
`Art. 37`	Controller/Processor Duties	dpo requirements
`Art. 38`	Controller/Processor Duties	dpo requirements
`Art. 39`	Controller/Processor Duties	dpo requirements
`Art. 44`	Cross-Border & Adequacy	transfer mechanisms
`Art. 45`	Cross-Border & Adequacy	adequacy received
`Art. 46`	Cross-Border & Adequacy	sccs and bcrs
`Art. 47`	Cross-Border & Adequacy	sccs and bcrs
`Art. 48`	Cross-Border & Adequacy	transfer mechanisms
`Art. 49`	Cross-Border & Adequacy	transfer mechanisms
`Art. 77`	Enforcement & Redress	regulator powers and penalties
`Art. 78`	Enforcement & Redress	private right of action
`Art. 79`	Enforcement & Redress	private right of action
`Art. 80`	Enforcement & Redress	collective redress and class actions
`Art. 81`	Enforcement & Redress	regulator powers and penalties
`Art. 82`	Enforcement & Redress	regulator powers and penalties
`Art. 83`	Enforcement & Redress	regulator powers and penalties
`Art. 84`	Enforcement & Redress	regulator powers and penalties
`Art. 13-22`	Data Subject Rights	access right
`Art. 32-34`	Controller/Processor Duties	security measures
`Art. 37-39`	Controller/Processor Duties	dpo requirements
`Art. 44-49`	Cross-Border & Adequacy	transfer mechanisms
`Art. 77-84`	Enforcement & Redress	regulator powers and penalties

Laos Data Protection & Privacy Regulation

Jurisdiction brief

Latest update · 25 October 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Standing brief · as of 22 September 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Latest update · 25 October 2026

Regulatory Status

Outlook

Standing brief · as of 22 September 2026

Regulatory Status

Outlook

Laos: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Probable▾#

Sub-modules (5)

Regulator And AuthorityRed

Act And InstrumentsAmber

Material ScopeAmber

Territorial ScopeRed

Regulator Registration And FilingRed

Regulator & Framework

Outlook

Regulator & Framework

Outlook

Regulator & Framework

Outlook

Laos: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾#

Laos: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾#

Sub-modules (5)

Access RightRed

Rectification And ErasureRed

Restriction And ObjectionRed

Data PortabilityRed

Deadlines And Response WindowsRed

Laos: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾#

Controller/Processor Duties

Outlook

Controller/Processor Duties

Outlook

Laos: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾#

Laos: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾#

Sectoral Watch

Outlook

Laos: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾#

Laos: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾#

Algorithmic, Biometric & Surveillance Governance

Outlook

Laos: D9 Children & Vulnerable Groups COVERAGE GAP5 sub-modules Not assessed ▾#

Sub-modules (5)

Age VerificationRed

Parental ConsentRed

Minor Profiling BansRed

Education SettingsRed

Dependent AdultsRed

Laos: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾#

Provenance and declared absence

GDPR article map

#

#

#

#

#

#

#

#

#

#