The E-commerce Law establishes a safe harbour regime for intermediaries beyond copyright infringements. According to Art. 24 of the law, internet intermediaries are not liable for unlawful third-party content on their online platforms. However, they must comply with certain mandatory content removal procedures upon becoming aware of such content (Art. 25). Additionally, pursuant Art. 27 intermediaries are obligated to comply with an e-commerce code of conduct.

Art. 6 of the Law on Telecommunications requires that all telecommunications operators and persons involved with the telecommunications sector shall provide "telecommunications information and communication technology service data" to the Ministry of Post and Telecommunications. In practice, this gives the Ministry unfettered rights to demand that all telecommunications service providers provide data on their service users. This could operate as an obligation for companies to surrender data without the requirement of a judicial warrant or other safeguards protecting the right to privacy.
Art. 97 of the law permits the secret surveillance of any and all telecommunications where it is conducted with the approval of a “legitimate authority.” There is no definition of what constitutes a “legitimate authority”. This appears to create a power to secretly eavesdrop without any public accountability or safeguards to protect individuals’ right to privacy.

There is no comprehensive data protection regime in Cambodia, although there are some general provisions on privacy in the 2010 Constitution of the Kingdom of Cambodia (Art. 40), the 2007 Civil Code (Art. 10), the 2009 Penal Code (Arts. 301, 302, 314, 318 and 427) and the Telecommunications Law (Art. 56). Also, the Law on Electronic Commerce provides for some measures to protect consumer data collected in electronic communication. Art. 32 of the law prohibits the interference, access, retrieval, copying, extraction, filtering, deletion, or modification of data in the custody of another person without permission or in a malicious manner. Moreover, Sub-Decree No. 252 on the Management, Use, and Protection of Personally Identifiable Data applies to personally identifiable data belonging to the Ministry of Interior (MOI).

Art. 14 of Sub-Decree No. 23 imposes an obligation on National Internet Gateway (NIG) operators to retain traffic data for a year. National Internet Gateway refers to the gateway where all Internet services must be connected nationally and internationally, and traffic refers to the amount of data that passes through a network in one second of a certain time (Annex 1). NIG operators shall maintain technical records, IP Address allocation table, and route identification of traffic transiting through NIG for the last 12 months. It is reported that Art. 14 means the operator(s) of the NIG can track the activities of all internet users in Cambodia, including a user’s browser as well as unencrypted search history for up to 12 months. Art. 13 imposes an obligation on NIG operators to report and monitor traffic data and submit monthly, quarterly, semesterly, third-quarterly, and annual traffic report within seven days after the end of each month, quarter, semester, third-quarter and year to both MPTC and TRC.

Cambodia has not joined any agreement with binding commitments to open transfers of data across borders.

It is reported that, although the Telecommunication Regulator of Cambodia (TRC), the executive authority for the supervision and administration of services in the telecommunications sector, proclaims itself to be an autonomous public entity independent from the government in the decision-making process, the telecommunications law significantly undermined its independence by granting the Ministry of Posts and Telecommunications (MPTC) ultimate authority over the regulator. The TRC’s lack of independence was reportedly demonstrated in 2017 when it followed the MPTC’s order to block access to the Cambodia Daily and other news sites in the run-up to the general election in July 2018.

It is reported that Cambodia does not mandate functional or accounting separation for operators with significant market power (SMP) in the telecom market.

It is reported that there is a legal limitation on the number of licenses (for certain licenses) and that other licensing criteria exist.

The Law on Telecommunications sets the Telecommunication Regulator of Cambodia (TRC) to have autonomy in administrative and regulatory matters for the telecommunications sector and are in charge of licences to engage in telecommunications operator services. The Ministry of Posts and Telecommunications (MPTC) is responsible for networks and infrastructure supporting the telecommunication sector. It is reported that the TRC/MPTC enjoy vast discretionary powers over the granting of licenses and setting the terms and conditions thereof which vary on a case-by-case basis. Art. 17 of the Law on Telecommunications regulates a unified (multi-service) licenses. A license is required for the provision of: mobile telecommunications services, fixed-line telecommunications services, VOIP services, Internet service provider (ISP), telecommunications-type approval form, national numbering plan, access code, public switched telephone network (PSTN), and Internet cafés.
Some customary licensing terms and steps including: (i) license terms of between 10 to 30 years onward (with some renewability); (ii) license fees based on a combination of a percentage of gross revenue (the percentage usually increases throughout the license) plus a percentage of dividend sharing; and (iii) there may be inter-connection fees, an annual frequency charge fee, microwave license fees, etc., applicable on a case-by-case basis. The percentage of revenue and dividends to be shared increases incrementally and reaches around 10% over 10 years. It is reported that the exact percentages of revenue and dividends to be shared by operators with the TRC/MPTC vary on a case-by-case basis and are determined by the terms and conditions negotiated between the TRC/MPTC and the operator. Moreover, it is reported that older licensees sometimes have to pay a higher revenue share. Licensees that have some fixed-network capability or carry international traffic may also be required to share up to 50% of their gross revenue with the MPTC or TRC.

Cambodia has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

It is reported that there is an obligation for passive infrastructure sharing in Cambodia to deliver telecom services to end users, and it is practiced in the mobile sector and in the fixed sector based on commercial agreements.

Sub Decree No.111 ANK/BK stipulates that Cambodia permits full foreign ownership in the telecommunication sector. However, Art. 3 of Law on Public Enterprise states that the Cambodian government must directly or indirectly hold more than 51% of the capital or the right to vote in state-owned enterprises. Given that Telecom Cambodia, the principal telecom company in Cambodia, is fully state-owned, some restrictions apply in this sector.

Telecom Cambodia, the principal telecom company in Cambodia, is fully state-owned.

Cambodia does not have a comprehensive framework in place that provides effective protection of trade secrets, but there are limited measures addressing some issues related to them. According to the Contract Law of 1998, to maintain information in employment or other contractual relationships, a non-disclosure agreement may be used and enforced. In addition, the Ministry of Commerce is currently in the process of preparing a Law on Trade Secrets and Undisclosed Information.

Although Cambodia is a member of the World Trade Organization’s Trade-Related Aspects of Intellectual Property Rights (TRIPS), which requires members to comply with the Berne Convention for the Protection of Literary and Artistic Works, the country was granted a limited exemption as a least-developed country from compliance with TRIPS obligations until July 2021, which was recently extended to January 2034. As a result, until the Berne Convention came into force in March 2022, foreign copyrighted works were not automatically protected in the country. Due to the principle of ‘national treatment’ principle in the Convention, the country is expected to shift from the exclusive automatic protection of ‘national works’ to including the automatic protection of ‘foreign works’. Although the country has completed its accession to the Convention, copyright protection has not yet been extended to foreigners. The copyright regime, which is currently governed solely by the Law on Copyright and Related Rights enacted in 2003, has not been amended yet and in order to be granted protection, a work is first published abroad and then brought to be published in Cambodia within 30 days of its first public communication (Art. 3.1). Regulations, official guidelines and details on which provisions Cambodia may adopt is anticipated to follow in the near future.