Legal Consultant for Your Innovation

The law applies to all data controllers and processors who process personal data in Cambodia, regardless of whether the processing takes place within or outside Cambodia, as long as it relates to offering goods or services to data subjects in Cambodia or monitoring their behavior.

The law is based on fundamental principles including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability in personal data processing.

Processing is lawful when based on: consent, contractual necessity, legal obligation compliance, vital interests protection, public task performance, or legitimate interests (balanced against data subject rights and freedoms).

Key requirements include maintaining Records of Processing Activities (RoPA), conducting Data Protection Impact Assessments (DPIA) for high-risk processing, implementing appropriate technical and organizational measures, and ensuring lawful basis for all data processing activities.

The law is expected to be promulgated by the end of 2025 or early 2026, with organizations typically having a transition period to achieve full compliance once it takes effect.