Cambodia’s path to a Personal Data Protection Law: Highlights from Cambodia’s first National Conference on Personal Data Protection 2025

The conference comes at the right moment: Cambodia is drafting its own Personal Data Protection Law, planned to be finished by late 2025 or early 2026. The mood was very collaborative, and people discussed how to use global best practices in ways that fit Cambodia.

The discussions at the conference build on an ongoing consultation process. Earlier this year, on July 23, 2025, the MPTC held the “Consultative Workshop on Draft Law on Personal Data Protection” with around 200 people from government, the private sector, civil society, and academia. The discussion highlighted that Cambodia, along with Myanmar and Laos, has yet to enact personal data protection legislation and emphasized that the draft law aims for completion by late 2025 or early 2026. The law is being aligned with international frameworks and national regulations to ensure legal harmonization and effective implementation. The workshop sought to gather stakeholder input to identify gaps, overlaps, and potential impacts, promoting transparency, trust, and inclusive participation. Mr. Thy Try, Executive Director of ODC, provided input and comments during the discussions to help refine the draft law.

This discussion also connects to earlier work. On November 30, 2023, the 22nd KAS Law Talk focused on “Cybersecurity and Data Protection in Cambodia and Beyond,” with around 60 legal scholars and practitioners taking part. Under this program, KAS, the National University of Management (NUM), and the Royal University of Law and Economics (RULE) produced a publication with chapters on related topics. Mr. Thy Try also participated in that Law Talk and shared input and comments on the data protection law.

The theme of the first National Personal Data Protection Conference 2025 was “Laying the Foundations for Personal Data Protection in Cambodia: Learning from Global and Regional Experiences.” Experts from ASEAN shared valuable insights, highlighting several key principles for developing a robust data protection framework. Businesses were advised not to wait for the law to be passed; instead, they should begin adopting international best practices now, such as implementing strong internal policies, conducting staff training, and appointing data protection officers to oversee compliance. Experts emphasized that when data moves across borders, businesses should rely on legal contracts to ensure their international partners uphold strong data protection standards. It’s also important to remember that data protection is about the rights of the individual, the data subject. Personal data protection laws aim to protect individuals’ personal data while still allowing for the legitimate use of that data, which is essential for economic growth.

The conference agenda covered a wide range of sectors, from banking and telecommunications to child protection and employee data rights, underscoring the comprehensive approach required for effective data governance. This event was an important step toward establishing a culture of shared responsibility for data protection in Cambodia. As the new law takes shape, ODC will continue to monitor its progress and advocate for a data protection framework that builds trust, protects citizens, and supports sustainable digital growth.

We would like to thank MPTC for the opportunity to participate in this important conference. We eagerly anticipate the next conference and look forward to seeing the continued development of a comprehensive Personal Data Protection Law for Cambodia.