Asia. National jurisdiction.

Cambodia KH

Primary authority: Ministry of Post and Telecommunications (MPTC)

Part I

Domestic law

Comprehensive data protection1

Historic & pending (1)

Draft PDP Law (Cambodia)Draft Law on Personal Data ProtectionBill/proposed
Draft comprehensive law circulated by the MPTC with GDPR-style principles, controller/processor definitions and expected breach notification. Not yet adopted.
Synopsis
Draft comprehensive law circulated by the MPTC with GDPR-style principles, controller/processor definitions and expected breach notification. Not yet adopted.
Key themes
- consent
- principles
- controller/processor
- breach notification
Unique features
Cambodia currently relies on the Constitution, Civil/Criminal Codes and the E-Commerce Law.
SaaS relevance
No general law yet; E-Commerce Law security duties apply to online service providers.
Key dates
- MPTC announced 2021; latest consultation July 2025
Text
No authoritative text located.
Authority
Ministry of Post and Telecommunications (MPTC)
Verification
Medium confidence.
Partly verified
Medium confidence. Included despite not passing a chamber, because formally circulated by government; treat as watchlist. [Link: draft – no official text]
Record
Full record for Draft PDP Law (Cambodia)
Partly verified
Medium confidence. Included despite not passing a chamber, because formally circulated by government; treat as watchlist. [Link: draft – no official text]

Sectoral privacy1

E-Commerce Law (Cambodia)Law on Electronic Commerce (2019)In force
In force from May 2020Requires those storing consumers' private information electronically to take reasonable security measures, and limits disclosure without consent. Also sets opt-out rules for electronic marketing.
Synopsis
Requires those storing consumers' private information electronically to take reasonable security measures, and limits disclosure without consent. Also sets opt-out rules for electronic marketing.
Key themes
- security of e-records
- disclosure limits
- electronic marketing opt-out
Unique features
Prohibits encrypting data that may serve as evidence of an offence.
SaaS relevance
Main privacy-related obligation for SaaS serving Cambodian consumers pending a PDP law.
Key dates
- Adopted 2 November 2019
- In force May 2020
Text
No authoritative text located.
Authority
Ministry of Commerce; MPTC
Verification
Low confidence.
Partly verified
Low confidence. Dates from general knowledge. [Link: not found (MoC site under maintenance; search budget exhausted)]
Record
Full record for E-Commerce Law (Cambodia)
Partly verified
Low confidence. Dates from general knowledge. [Link: not found (MoC site under maintenance; search budget exhausted)]

Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 7 instruments from 2 bodies.

Association of Southeast Asian Nations (ASEAN)

ASEAN DMF / MCCsASEAN Digital Data Governance Framework, ASEAN Data Management Framework and ASEAN Model Contractual Clauses for Cross Border Data FlowsIn force
In force from 22 January 2021The DMF is a voluntary guide for businesses on data governance across the data lifecycle. The MCCs are voluntary template contract terms for controller-to-controller and controller-to-processor transfers between ASEAN member states, setting baseline protections.
Synopsis
The DMF is a voluntary guide for businesses on data governance across the data lifecycle. The MCCs are voluntary template contract terms for controller-to-controller and controller-to-processor transfers between ASEAN member states, setting baseline protections.
Key themes
- model contractual clauses
- cross-border flows
- data governance
- processor terms
Unique features
They are designed as a regional baseline. A joint EU–ASEAN guide maps the MCCs against the EU SCCs.
SaaS relevance
A SaaS provider can use the ASEAN MCCs as a transfer and processor contract template for intra-ASEAN data flows.
Breach notification
MCCs: processor notifies controller of breaches
DPO
No
Cross-border transfers
Voluntary model clauses
Maximum penalty
None
Key dates
- Adopted 22 January 2021
- In force 22 January 2021
- Framework on Digital Data Governance 2018; DMF and MCCs endorsed by the 1st ASEAN Digital Ministers' Meeting on 2021-01-22; joint EU–ASEAN guide on MCCs/SCCs in 2023
Text
- Authoritative text asean.org
Authority
ASEAN Digital Ministers (ADGMIN)
Sources consulted
- pdpc.gov.sg
- asean.org
Verification
High confidence.
The 2018 DDG Framework date and the 2023 EU–ASEAN guide come from memory.
Record
Full record for ASEAN DMF / MCCs
ASEAN PDP FrameworkASEAN Framework on Personal Data ProtectionIn force
In force from 25 November 2016A statement of intent by ASEAN members to cooperate on personal data protection. It sets out principles: consent, notification and purpose; accuracy; security; access and correction; transfers to other countries; retention; and accountability. It creates no legal obligations.
Synopsis
A statement of intent by ASEAN members to cooperate on personal data protection. It sets out principles: consent, notification and purpose; accuracy; security; access and correction; transfers to other countries; retention; and accountability. It creates no legal obligations.
Key themes
- principles
- consent
- transfers
- accountability
- regional cooperation
Unique features
Expressly non-binding and leaves room for domestic law; it is the basis of ASEAN cross-border data instruments.
SaaS relevance
Background only; national ASEAN laws apply.
Breach notification
None
DPO
No
Cross-border transfers
Consent or reasonable steps to protect data abroad
Maximum penalty
None
Key dates
- Adopted 25 November 2016
- In force 25 November 2016
- Adopted at the 16th ASEAN Telecommunications and IT Ministers Meeting (TELMIN), November 2016
Text
- Authoritative text asean.org
Authority
ASEAN Digital Ministers (ADGMIN) / ASEAN Digital Senior Officials
Sources consulted
- pdpc.gov.sg
Verification
Medium confidence.
Partly verified
Medium confidence. I did not re-verify the exact adoption date or the asean.org PDF URL.
Record
Full record for ASEAN PDP Framework
Partly verified
Medium confidence. I did not re-verify the exact adoption date or the asean.org PDF URL.

United Nations

UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Synopsis
The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Key themes
- cybercrime offences
- e-evidence
- production orders
- data preservation
- mutual legal assistance
- human rights safeguards
Unique features
It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.
SaaS relevance
Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
Cooperation channels for electronic evidence
Maximum penalty
Set by national law
Key dates
- Adopted 24 December 2024
- Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
Text
- Authoritative text unodc.org
Authority
UNODC (secretariat); Conference of the States Parties once in force
Sources consulted
- en.wikipedia.org
- unodc.org
Verification
Medium confidence.
Partly verified
Medium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Record
Full record for UN Cybercrime Convention
Partly verified
Medium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
In force from 18 December 2013This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Synopsis
This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Key themes
- surveillance
- interception
- AI and privacy
- encryption
- business responsibility
- remedies
Unique features
The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.
SaaS relevance
These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
- Adopted 18 December 2013
- In force 18 December 2013
- First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
Text
- Authoritative text documents.un.org
Authority
Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
Sources consulted
- documents.un.org
- digitallibrary.un.org
Verification
Medium confidence.
Partly verified
Medium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
Record
Full record for Right to privacy in the digital age
Partly verified
Medium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
In force from 23 March 1976This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Synopsis
This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Key themes
- right to privacy
- state obligations
- legality
- arbitrariness
- individual communications
Unique features
It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.
SaaS relevance
It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None (treaty-body views; no fines)
Key dates
- Adopted 16 December 1966
- In force 23 March 1976
- Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
Text
- Authoritative text ohchr.org
Authority
UN Human Rights Committee (treaty body)
Sources consulted
- ohchr.org
- ohchr.org
Verification
High confidence.
The party count is approximate and was not re-checked against the UN Treaty Collection.
Record
Full record for ICCPR Art 17
UDHR Art 12Universal Declaration of Human Rights, Article 12In force
In force from 10 December 1948Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Synopsis
Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Key themes
- right to privacy
- correspondence
- reputation
- protection of the law
Unique features
Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.
SaaS relevance
Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
- Adopted 10 December 1948
- In force 10 December 1948
- Proclaimed by the UN General Assembly in Paris on 10 December 1948
Text
- Authoritative text un.org
Authority
None designated
Sources consulted
- un.org
- ohchr.org
Verification
High confidence.
The CIPP/E project holds a copy (1948UDHR.pdf).
Record
Full record for UDHR Art 12
UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
In force from 14 December 1990Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Synopsis
Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Key themes
- fair information principles
- sensitive data
- access
- security
- supervisory authority
- transborder flows
Unique features
Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.
SaaS relevance
Gives no direct obligations; it is historical background to UN-system data protection policies.
Breach notification
None
DPO
No
Cross-border transfers
Free flow to states with comparable safeguards
Maximum penalty
None
Key dates
- Adopted 14 December 1990
- In force 14 December 1990
Text
- Authoritative text refworld.org
Authority
None designated
Sources consulted
- refworld.org
- digitallibrary.un.org
Verification
Medium confidence.
Partly verified
Medium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.
Record
Full record for UN Guidelines 1990
Partly verified
Medium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.