In B2B Cambodia's 'Legal Update' we delve into the latest legal changes and developments in Cambodia's laws and regulations with key experts in the field.
In Episode 7, Chandavya Ing, Senior Associate at Tilleke & Gibbins, covers the laws and regulations concerning data protection in Cambodia. While the country still lacks a specific law that addresses personal data protection, a draft law is currently in the process of finalisation and businesses are still urged to take steps to ensure compliance with international standards.
B2B Cambodia: Could you begin by explaining the concept of personal data?
Chandavya Ing: “Currently there is no definition of the term ‘personal data’ under any regulation or law [in Cambodia]. There is, of course, the definition of the term ‘data’ under the E-Commerce Law; the term ‘personal identification data’ and ‘personal private information’ under the Sub-Decree on the Management, Use and Protection of Personal Identification Data, but still there is no definition of the term ‘personal data’. However, based on the literal meaning of this term, I think it could refer to any type of information that could identify a person.
B2B Cambodia: Can you further elaborate on which laws and regulations apply to personal data in Cambodia?
Chandavya Ing: “Well, currently there is no comprehensive data protection law. The Ministry of Post and Telecommunication (MPTC) is still drafting this legislation, and from what we understand from a recent press release is that they held a consultation workshop on this draft law at the end of 2024.”
B2B Cambodia: Since there is no specific law yet on personal data protection, what are the implications of the current regulations on data protection and privacy in Cambodia?
Chandavya Ing: “Currently, matters pertaining to data protection and privacy broadly fall under the scope of the Right to Privacy as well as some of the Obligations of Professional Secrecy, which are mentioned under the Cambodian Constitution; certain provisions under the Civil Code and Criminal Code; as well as some sectoral laws like the E-Commerce Law, as well as the Law on Banking and Finance Institutions. This law generally provides protection to the Right to Privacy and the Obligation of Professional Secrecy, that could potentially cover, as well as protect, personal data to some extent.”
B2B Cambodia: In terms of industry-specific laws, such as the Law on Banking and Finance Institutions, what are the implications on data retention, protection and storage?
Chandavya Ing: “For data retention I think it would depend on which sector we are in, because there is no law that sets a general data retention period, and not all sectoral laws mention something about a data retention period. For example, if we are talking about credit reporting, there is a regulation that mentions that all customer data has to be retained for at least five years after an account has been closed. And If you talk about tax, accounting records and tax invoices should be retained for at least 10 years.
“So it depends on the sector that you are in. In terms of protection, as I mentioned, mostly data protection is based on the Right to Privacy and the Obligation of Professional Secrecy. So, for example, if we look into the Law on Banking, we can see that there is a prohibition of people in certain professions providing confidential information relating to accounting statements. And if you look at the Telecom Law, for example, it mentions that they generally recognise the privacy of subscribers in telecom services.”
B2B Cambodia: Can you explain the consent requirements on the collection and processing of personal data here in Cambodia?
Chandavya Ing: “Because there is no comprehensive law, I could say that there are no consent requirements that have been regulated yet. When I'm talking about consent requirements here, I'm referring to notification requirements, like how and when one should notify the data subject of their data being processed, as well as whether the data subject has the right to withdraw and how they can do that.
“Of course, while there's no regulation that sets those kinds of requirements, in practice, most companies prefer to obtain consent from the data subject, be it through a written form or electronic form, before they process the personal data. And as you may have seen, whenever we have to click on ‘agree’ in order to access certain services, it will usually link to terms and conditions that contain a clause on personal data.”
B2B Cambodia: Today we live in a very tech-driven time, with many companies shifting to cloud-usage and AI adoption, for example. What this means is that many tech companies, but also other businesses in general, are now having to store and process a lot more data than before. So legally speaking, can personal data be collected in Cambodia, and can it be transferred or stored abroad?
Chandavya Ing: “There is no regulation that restricts the transfer and storage of data abroad, except for in the banking and financial sector. For that sector, the licensed banks and financial institutions are required under the Technology Risk Management Guidelines to notify the National Bank of Cambodia (NBC) when there is an extensive sharing of data across geographic locations, and when data is stored or processed abroad. But if you ask to what extent the term ‘extensive’ applies, the guideline does not address this issue.”
B2B Cambodia: Have there been any new updates in the development of domestic data storage facilities?
Chandavya Ing: “Actually, according to a recent press release, the Ministry of Post and Telecommunications has just begun the construction of the National Data Centre, which will be classified as ‘Tier 4’—the highest classification for data centres—so I think we are moving toward an exciting era of digital development in Cambodia.”