According to Art. 26.1 of the E-Commerce Law, e-commerce service providers and intermediaries must obtain e-commerce permits or licenses from the Ministry of Commerce (MOC) in addition to the general business registration. According to Art 26.2, the licensing regime has two categories: (1) an e-commerce permit (for individual persons and sole proprietorships) and (2) an e-commerce license (for legal persons and branches of foreign companies). In August 2020, Cambodia issued Sub-Decree No. 134, an implementing regulation of the E-Commerce Law, clarifying that a license is required for legal persons and branches of foreign companies carrying out the following activities: e-commerce web services, e-commerce platform services, online market services, online auction website services, and other similar services provided through software or smart devices for the promotion of e-commerce (Art. 7).
In addition, pursuant to Art. Art. 6 of the Decree, an E-Commerce permit is required for natural persons and sole proprietors that operate a business via electronic system in Cambodia (including those who conduct business via social media and electronic systems to supply or sell/purchase goods and services). Furthermore, according to Art. 7.1, legal entities or foreign branches that are intermediaries of electronic-commerce service providers must apply for a license at the MOC and meet the following conditions: (i) Business registration and tax registration with registered business activities relating to e-commerce; (ii) It must have obtained an Online Service Certificate and domain name from the Ministry of Posts and Telecommunications; (iii) It must use an electronic application or means for operating e-commerce; (iv) The electronic system used by it must be accurate; (v) It must specify the payment method; (vi) It must have a business model and consumer protection form. If it is a legal entity or foreign branch acting as an intermediary, it must enter into a contract with the business service providers. Moreover, in October 2020, the MOC issued Prakas No. 290 regulation setting the required documents to apply for e-commerce licenses and permits, as well as detailed procedures and time frames for the MOC to review the applications. The regulation also stipulates the timelines and procedures to renew the permits and licenses, among other things (Arts. 3–8.).

According to Art. 5 of the Law on Foreign Exchange, foreign exchange operations shall be undertaken solely through authorized intermediaries. These operations include purchases and sales of foreign exchange on the foreign exchange market, transfers, all kinds of international settlements, and capital flows in foreign or domestic currency, between Cambodia and the rest of the world or between residents and non-residents. As a result, only banks permanently established in the Kingdom of Cambodia rae considered as authorised intermediaries for international settlements.

It is required that several products sold in Cambodia obtain national certification, although this certification is often based on international standards. Foreign manufacturers need to sign an agreement with the Institute of Standards of Cambodia (ISC) to obtain local certification. Any entity can apply for a license that would allow it to use the ISC Certification Mark. The license has a validity of three years, which can be extended for three years at a time, subject to satisfactory operation of the license.
According to Art. 48 of the Law on Standards of Cambodia states that no person or organization can announce that they have received a standard-conformity certificate, although they have been certified by a local or foreign certification body unless they have been registered and received approval from the ISC.

It has been reported that Cambodia's Customs and Excise Department engages in practices that are non-transparent and that appear arbitrary. Importers frequently cite problems with undue processing delays, burdensome paperwork, and unnecessary formalities.

The Cambodia Custom and Excise General Department announced in March 2012 the ban of importation of old computers and spare parts for occupational purposes, except, for self-consumption and/or charity in a minor amount.

Art. 27.2 of Law on Consumer Protection mandates that any advertising shall be in Khmer language. Furthermore, Art. 9 of Sub-Decree No. 232 requires all commercial advertising of products and services—by any channel—to use Khmer as the primary language. If foreign-language text is used in advertisements, it must comply with the sub-decree rules on placement and font size to ensure the Khmer text retains its prominence. It is reported that the Khmer language requirement can be an onerous obligation for some businesses.

Art. 15 of the Law on Telecommunications provides that a license from the Telecommunication Regulator of Cambodia (TRC) and the Ministry of Posts and Telecommunications (MPTC) is required for the provision of VOIP and Internet café services.

Art. 99 of the Law on Telecommunications introduces sentences of six months to two years imprisonment and heavy financial penalties for “any act of producing, installing or distributing software or hidden audio recorders for recording dialogue” without approval from the authorities. It is reported that this unclear provision, which seems to require government approval for any software that can record sound, could potentially criminalize the basic use, sharing, or development of software such as smartphone apps. Additionally, the range of sound-recording hardware concerned with this provision is unclear as well.

It is reported that news and other websites are periodically blocked in Cambodia. In the wake of the COVID-19 pandemic, the Cambodian government has reportedly blocked access to news sites. In March 2020, Monoroom.info, a Khmer-language news website based in France, was blocked after it published numerous articles on the impact of the coronavirus in Cambodia. The site was accessible as of April 2021. Also, the Telecommunication Regulator Cambodia (TRC) blocked two websites owned by news outlet TVFB in April 2020. The websites still appeared to be inactive in 2022.
Lastly, in July 2018, a number of independent news websites, including Radio Free Asia (RFA) and Voice of America (VOA), were blocked. The blocks were implemented two days before the general elections. Other blocked websites included Cnrp7.org, Khmer Political.com, Khmersharingnews.com, Camnews.com, Stubes.info, Pinterest.de, Vithyu.com, Freecambodia.org, Apkpure.com, and Imnsj.org.

Art. 7 of the Law on Telecommunications provides that in the event of “force majeure”, the Ministry of Post and Telecommunications or other relevant ministries may order private telecommunications operators to “take necessary measures.” The Law does not specify the force majeure circumstances compelling discretionary government powers to direct the operation of private companies, or what “necessary measures” may entail. It is reported that this provision is vulnerable to abuses, including shutting down social networks and other internet-based services.

It is reported that Cambodia imposes an identity requirement for SIM registration. Anyone wanting to purchase a SIM card has to provide their national ID card, or a passport in case of foreigners, to activate a new prepaid SIM card.

Clause 7 of the Inter-ministerial Prakas No. 170 requires that all Internet Service Providers who operate in Cambodia have to install software programs and equip themselves with internet surveillance tools to easily filter and block any social media accounts or pages that run their business activities and/or publicize illegally. In addition, Clause 6 establishes that the Ministry of Information should manage information published through electronic system including all news contents or written messages, audios, photos, videos, and/or other means on website and social media by using internet in the Kingdom of Cambodia.

According to Clause 7 of the Inter-ministerial Prakas No. 170, the Ministry of Posts and Telecommunication can “block or close the websites and/or social media page which (...) publicize illegally which considered as incitement, breaking solidarity, discrimination, create turmoil by will, leading to undermine national security, and public interests and social order”. It is reported that some of the grounds, notably on "national economy", “public interest” and “national security” are not specifically defined and thus could be interpreted broadly, including to discriminate foreign websites and content providers. It is reported that such strict surveillance of social media and the internet has caused online users to stop posting and sharing content.

Some articles of Sub-Decree No. 23 could imply the requirement to provide the government with direct access to personal data collected. Art. 14 establishes that the Ministry of Post and Telecommunications (MPTC) and Telecommunication Regulator of Cambodia (TRC) can monitor the infrastructure, connections, and equipment of the National Internet Gateway (NIG). NIG refers to the gateway where all Internet services must be connected nationally and internationally (Annex 1). NIG operators shall:
- Prepare and maintain technical records, IP Address allocation table, and route identification of traffic transiting through NIG;
- Compile and maintain reports and relevant documents concerning the connections and all Internet traffic;
- Provide other information as required by the MPTC and TRC.

NIG operators shall maintain technical records, IP address allocation table, and route identification of traffic transiting through NIG for the last 12 months. Traffic refers to the amount of data that passes through a network in one second of a certain time (Annex 1). It is reported that Art. 14 means the operator(s) of the NIG can track the activities of all internet users in Cambodia, including a user’s browser as well as unencrypted search history for up to 12 months. On the other hand, Art. 13 imposes an obligation on NIG operators to report and monitor traffic data and submit monthly, quarterly, semesterly, third-quarterly, and annual traffic report within seven days after the end of each month, quarter, semester, third-quarter and year to both MPTC and TRC. It is reported that the Sub-Decree poses risks to data protection and data privacy, requiring gateway operators to retain and share metadata.

The E-commerce Law establishes a safe harbour regime for intermediaries for copyright infringements. According to Art. 24 of the law, internet intermediaries are not liable for unlawful third-party content on their online platforms. However, they must comply with certain mandatory content removal procedures upon becoming aware of such content (Art. 25). Additionally, pursuant Art. 27 intermediaries are obligated to comply with an e-commerce code of conduct.