Cambodia

Cambodia's data rules are scattered across separate industry rules rather than one law. The Law on Electronic Commerce (adopted late 2019) applies to electronic transactions and puts a security duty on service providers. Financial firms are caught through the National Bank of Cambodia's supervisory guidelines. Those apply to the licensed firm wherever its technology sits. The Ministry of Commerce, the Ministry of Post and Telecommunications and the Ministry of Interior each handle data questions inside their own area. None of them is a general data protection authority.

Sector by sector, checked on 18 August 2026. Banking, lending and payments. The central bank's Technology and Cyber Risk Management Guidelines, issued January 2026, require at least one primary data centre inside Cambodia. A data centre outside Cambodia needs central bank approval. It may only be a secondary or disaster-recovery site, and you need a written plan for moving back. Separately, moving or hosting customer personal data abroad needs a risk assessment of the destination and prior approval from the central bank. This is a mirror rule. Telecoms. We found no rule in force about where data is stored. The National Internet Gateway sub-decree of February 2021 would concentrate all international traffic through a state-controlled gateway, but it has never been put into operation. Open today, with a switch the government could still flip. Government and public sector. We found no binding rule requiring data to stay in Cambodia. The government's own Digital Government Policy admits that only about 30 percent of ministries use local data centres. The rest rely on overseas cloud. It sets building national data centres as a goal, not a duty. Open. Insurance and securities. The insurance regulator and the securities regulator publish laws, sub-decrees and prakas. Their document libraries load dynamically and we could not read them. We found no rule about where data must be kept. Treat that as unconfirmed rather than as an absence. Health, education, gaming, mapping and defence. We found no Cambodian government source imposing a rule about storing or sending data. Again, treat that as not found rather than absent.

Cambodia has no rules on sending data abroad. So there is no concept of an approved country, no standard contract clauses, and no binding corporate rules. The controls that actually apply to Cambodian operations come from contracts imposed by overseas customers and parent companies, not from Cambodian law. Finance is different. Paragraph 9.0.3 of the central bank's 2026 guidelines requires a full risk assessment of the location. It also requires prior approval from the National Bank of Cambodia. Paragraph 3.13.5 requires separate approval for a data centre abroad. Paragraph 6.1.6 covers cloud contracts. They must spell out where data is stored and handled, what crosses borders, how long logs are kept, and how long data is kept.

Our rating of dormant is about privacy enforcement specifically. It is not about the Cambodian state generally. Here is what the sector regulators actually do. The National Bank of Cambodia runs a Technology Risk and Innovation Supervision Department. It publishes prakas and guidelines, and its own guidelines say that 'compliance requirements' are requirements that will be assessed for compliance. The Telecommunication Regulator of Cambodia published a public notification against Viettel (Cambodia) on 15 June 2026 over identity checks on SIM sales. It ran a public consultation on equipment standards, with the deadline extended to 25 June 2026. It issued guidelines on mobile text-message notifications in May 2026. Today, complaints about misuse of personal data go to whichever ministry supervises the business: commerce, telecommunications or interior. None of them publishes its decisions.

How long you must keep data. The General Department of Taxation names two laws that set record-keeping duties. They are the Law on Taxation (16 May 2023) and the Law on Accounting and Auditing (11 April 2016). We could not read the exact number of years. The official copies published on the tax authority's site are scanned images of Khmer text that machines cannot read. So we record the period as unconfirmed rather than guess it. For financial firms, the central bank's 2026 guidelines require an inventory of assets recording how long each data set is kept. They require old-system archives to keep the same periods when data is moved. And they require cloud contracts to specify how long logs and data are kept. How long you may keep data. Paragraph 9.0.7 of the same guidelines is the only duty to delete that we found. Which one wins. We found no Cambodian rule saying which wins. So treat the record-keeping minimum in tax and accounting law as the stronger of the two.

This is unusual and worth saying plainly. Most countries in the region have at least one deadline measured in hours. Cambodia currently has none that we could verify. Financial firms must still build the machinery. The central bank's 2026 guidelines require an incident management policy. They require a tested incident response plan, reviewed at least once a year. They require an incident response team and severity classification. And they require procedures to tell affected individuals and relevant regulators 'in compliance with applicable laws and regulations'. That points to laws that do not yet exist. The draft Cybersecurity Law was still being negotiated with the Ministry of Justice in July 2026. That draft, and the draft Personal Data Protection Law, are the two that will bring in reporting duties.

On encryption, the operative text is not available on a Cambodian government site. The claim rests on a law firm's summary of the Law on Electronic Commerce. We record it at medium confidence and list it under unconfirmed. On the banking data centre, the requirement is a plain sentence in the central bank's January 2026 guidelines. It comes with a duty to write a plan for moving a foreign data centre back to Cambodia. On SIM identity, look at the telecoms regulator's June 2026 notification. It described an operator's records showing a SIM sold in Phnom Penh to a person who was in another province that day. It said penalties were imposed under applicable law. A sixth point is worth knowing. There are no rules setting out when you are allowed to use personal data. So there is no legal certainty for anyone handling data here. The absence of rules is not the same as permission. And the draft law may apply to data you have already collected.

Powers the government already holds. These matter more than the drafts. One. The National Internet Gateway sub-decree of February 2021 was adopted. It was never brought into operation, and never cancelled. Independent monitoring reported that the government was still developing plans to put it in place as recently as 2025. The Ministry of Post and Telecommunications and Cambodia Telecom are named as responsible. It can be revived by an administrative act. Two. The central bank can change the rules for financial firms by issuing a prakas or a new guideline, with no public consultation. It did exactly that in January 2026, when the Technology and Cyber Risk Management Guidelines replaced the 2019 version. Three. The coming Data Governance Policy is the most likely route for a general rule requiring data to stay in Cambodia. The 2022 Digital Government Policy already lists where data is stored, and cross-border data flows, as things that policy must settle.