Cambodia

Cambodia's data rules are scattered across sector instruments rather than a single statute. The Law on Electronic Commerce (adopted late 2019) applies to electronic transactions and imposes a security duty on service providers. Financial firms are reached through the National Bank of Cambodia's supervisory guidelines, which apply to the licensed entity wherever its technology sits. The Ministry of Commerce, the Ministry of Post and Telecommunications and the Ministry of Interior each handle data questions inside their own remit; none of them is a general data protection authority.

Sector by sector, checked on 18 August 2026. BANKING, LENDING AND PAYMENTS: the central bank's Technology and Cyber Risk Management Guidelines, issued January 2026, require at least one primary data centre inside Cambodia; a data centre outside Cambodia needs central-bank approval and may only be a secondary or disaster-recovery site, with a written exit plan to move back. Separately, moving or hosting customer personal data abroad needs a risk assessment of the destination and prior approval from the central bank. Rating: mirror. TELECOMS: no storage-location rule found in force; the National Internet Gateway sub-decree of February 2021 would concentrate all international traffic through a state-controlled gateway but has never been implemented. Rating today: open, with a live dormant switch. GOVERNMENT AND PUBLIC SECTOR: no binding localisation rule found. The government's own Digital Government Policy admits that only about 30 percent of ministries use local data centres and the rest rely on overseas cloud, and sets building national data centres as a goal rather than a duty. Rating: open. INSURANCE AND SECURITIES: the insurance regulator and the securities regulator publish laws, sub-decrees and prakas, but their document libraries load dynamically and we could not read the contents; no residency rule found, and this is recorded as unconfirmed rather than as a negative. HEALTH, EDUCATION, GAMING, MAPPING AND DEFENCE: no Cambodian government source found imposing a data storage or transfer rule; again recorded as not found rather than as absent.

Because Cambodia has no transfer regime, there is also no adequacy concept, no standard contractual clauses and no binding corporate rules. In practice the controls that bite on Cambodian operations are contractual ones imposed by overseas customers and parent companies rather than by Cambodian law. Inside the financial sector, paragraph 9.0.3 of the central bank's 2026 guidelines requires a comprehensive risk assessment of the geographic location plus prior approval from the National Bank of Cambodia; paragraph 3.13.5 requires separate approval for a data centre abroad, and paragraph 6.1.6 requires cloud contracts to spell out the geographic locations of storage and processing, cross-border data flows, log retention and data retention.

Rating dormant is about privacy enforcement specifically, not about the Cambodian state generally. Observable evidence for the sector regulators: the National Bank of Cambodia runs a Technology Risk and Innovation Supervision Department, publishes prakas and guidelines, and states in its own guidelines that 'compliance requirements' are requirements that will be assessed for compliance. The Telecommunication Regulator of Cambodia published a public notification against Viettel (Cambodia) on 15 June 2026 over identity checks on SIM sales, ran a public consultation on equipment standards with a deadline extended to 25 June 2026, and issued guidelines on mobile text-message notifications in May 2026. Complaints about misuse of personal data today go to whichever ministry supervises the business - commerce, telecommunications or interior - and there is no published decision practice.

Floor: the General Department of Taxation lists the Law on Taxation (16 May 2023) and the Law on Accounting and Auditing (11 April 2016) as the instruments setting record-keeping duties. We could not read the exact number of years, because the official copies published on the tax authority's site are scanned images of Khmer text that machine reading cannot extract; the period is therefore recorded as unconfirmed rather than guessed. For financial firms, the central bank's 2026 guidelines require an asset inventory recording retention for each data set, require old-system archives to keep retention periods aligned when data is migrated, and require cloud contracts to specify log retention and data retention. Ceiling: paragraph 9.0.7 of the same guidelines is the only 'delete it' duty found. Conflict between floor and ceiling: no Cambodian rule found that says which wins, so in practice the statutory record-keeping floor should be treated as the stronger of the two.

This is unusual and worth stating plainly: most countries in the region have at least one deadline measured in hours, and Cambodia currently has none that we could verify. Financial firms must still build the machinery: the central bank's 2026 guidelines require an incident management policy, a tested incident response plan reviewed at least annually, an incident response team, severity classification, and procedures to notify affected individuals and relevant regulators 'in compliance with applicable laws and regulations' - a cross-reference to laws that do not yet exist. The draft Cybersecurity Law, still being negotiated with the Ministry of Justice in July 2026, and the draft Personal Data Protection Law are the two instruments that will introduce reporting duties.

On the encryption point, the operative text is not available on a Cambodian government site and the claim rests on a law-firm summary of the Law on Electronic Commerce; it is recorded at medium confidence and listed under unconfirmed. On the banking data centre, the requirement is a plain sentence in the central bank's January 2026 guidelines and it is paired with a duty to write an exit plan to move a foreign data centre back to Cambodia. On SIM identity, the telecoms regulator's June 2026 notification described an operator's records showing a SIM sold in Phnom Penh to a person who was in another province that day, and said penalties were imposed under applicable law. A sixth point worth knowing: because there is no lawful-basis framework, there is also no legal certainty for anyone processing data here - the absence of rules is not the same as permission, and the draft law may apply to data you have already collected.

Dormant switches, which matter more than the drafts. One: the National Internet Gateway sub-decree of February 2021 was adopted, never brought into operation, and never cancelled; independent monitoring reported that the government was still developing plans to implement it as recently as 2025, with the Ministry of Post and Telecommunications and Cambodia Telecom named as responsible. It can be revived administratively. Two: the central bank can change the rules for financial firms by issuing a prakas or a new guideline with no public consultation, as it did in January 2026 when the Technology and Cyber Risk Management Guidelines replaced the 2019 version. Three: the forthcoming Data Governance Policy is the vehicle through which a general localisation rule would most naturally arrive, because the 2022 Digital Government Policy already lists 'localization ... and cross-border data flows' as something that policy must settle.