Art. 6 of Sub-Decree No. 287 stipulates that ministries and governmental institutions intending to utilise the national domain name designated for such entities must store their data within the Kingdom of Cambodia. The Ministry of Post and Telecommunications is responsible for hosting and storing the data of all ministries and governmental institutions using national domain names, either in the national data centre or in a government-operated data centre.

Cambodia has not joined any agreement with binding commitments to open transfers of data across borders. Art. 12.15 of the Regional Comprehensive Economic Partnership (RCEP) recognises that each party may maintain its own regulatory requirements governing cross‑border transfers of information by electronic means and stipulates that such transfers shall not be restricted when undertaken for the conduct of business by a covered person; however, the article simultaneously allows parties to adopt or maintain any measures they themselves deem necessary to achieve a legitimate public policy objective, as well as any measures necessary to protect essential security interests, with the parties expressly affirming that the determination of such necessity lies solely with the implementing party and that such measures shall not be subject to dispute. It is reported that this formulation enables the parties to preserve their domestic data‑control regime under the rubric of national security without risking inter‑state disputes, and that the relative weakness of Chapter 12 renders its provisions largely ineffectual in facilitating the liberalisation of cross‑border data flows, particularly because the clause entrusting necessity assessments to the implementing party effectively permits any measure to be characterised as legitimate at that party’s discretion.

There is currently no comprehensive data protection regime in Cambodia. However, certain general privacy provisions exist in the 2010 Constitution of the Kingdom of Cambodia (Art. 40), the 2007 Civil Code (Art. 10), the 2009 Penal Code (Arts. 301, 302, 314, 318, and 427), and the Telecommunications Law (Art. 56). In addition, the Law on Electronic Commerce includes some measures to protect consumer data collected through electronic communication; notably, Art. 32 prohibits interference with, or unauthorised access to, data held by others. Sub-Decree No. 252 on the Management, Use, and Protection of Personally Identifiable Data further applies to data in the custody of the Ministry of Interior (MOI). It is reported that the Ministry of Posts and Telecommunications (MPTC) has already circulated a draft Personal Data Protection Law to selected companies for comment and held a consultative workshop on the draft in December 2024. However, as of 2025, this law has not yet been enacted.

Art. 14 of Sub-Decree No. 23 imposes an obligation on National Internet Gateway (NIG) operators to retain traffic data for a year. The National Internet Gateway is the gateway through which all Internet services must be connected, both nationally and internationally. Traffic refers to the amount of data that passes through a network in one second (Annex 1). NIG operators shall maintain technical records, IP address allocation table, and route identification of traffic transiting through NIG for the last 12 months. It is reported that Art. 14 means the operator(s) of the NIG can track the activities of all internet users in Cambodia, including a user’s browser history and unencrypted search history for up to 12 months. Art. 13 imposes an obligation on NIG operators to report and monitor traffic data and submit monthly, quarterly, semi-annual, third-quarterly, and annual traffic reports within seven days after the end of each month, quarter, semester, third-quarter and year to both the Telecommunication Regulator of Cambodia (TRC) and the Ministry of Posts and Telecommunications (MPTC). It is reported that, although the law is in force, it has not yet been implemented in practice.

Art. 6 of the Law on Telecommunications requires that all telecommunications operators and persons involved with the telecommunications sector shall provide "telecommunications information and communication technology service data" to the Ministry of Post and Telecommunications. In practice, this gives the Ministry unfettered rights to demand that all telecommunications service providers provide data on their service users. This could serve as an obligation for companies to surrender data without the requirement of a judicial warrant or other safeguards protecting privacy rights.
Art. 97 of the law permits the secret surveillance of any telecommunications where it is conducted with the approval of a “legitimate authority.” There is no definition of what constitutes a “legitimate authority”. This appears to create a power to secretly eavesdrop without any public accountability or safeguards to protect individuals’ right to privacy.

It is reported that some articles of Sub-Decree No. 23 may require the government to have direct access to personal data collected. Art. 14 establishes that the Ministry of Post and Telecommunications (MPTC) and Telecommunication Regulator of Cambodia (TRC) can monitor the infrastructure, connections, and equipment of the National Internet Gateway (NIG). NIG refers to the gateway through which all Internet services must be connected, both nationally and internationally (Annex 1). NIG operators shall:
- Prepare and maintain technical records, IP Address allocation table, and route identification of traffic transiting through NIG;
- Compile and maintain reports and relevant documents concerning the connections and all Internet traffic;
- Provide other information as required by the MPTC and TRC.
It is reported that, although the law is in force, it has not yet been implemented in practice.

The E-commerce Law establishes a safe harbour regime for intermediaries for copyright infringements. According to Art. 24 of the law, internet intermediaries are not liable for unlawful third-party content on their online platforms. However, they must comply with mandatory content-removal procedures upon becoming aware of such content (Art. 25). Additionally, pursuant to Art. 27, intermediaries are obligated to comply with an e-commerce code of conduct.

Cambodia’s Law on Telecommunications establishes a legal obligation for passive infrastructure sharing among licensed operators. According to Art. 32, telecommunications operators must provide access to their supporting infrastructure, including the physical assets used to provide services, upon request by other operators. This access must be granted in accordance with the principles of non-discrimination, technical compatibility, transparency, and affordability, as outlined in Art. 31.

According to Art. 3 of the Law on Public Enterprises, the Cambodian government must directly or indirectly hold more than 51% of the capital or voting rights in state-owned enterprises. As Telecom Cambodia—the country's principal telecom company—is fully state-owned, certain restrictions apply to this entity.

Government procurement in Cambodia is reported to lack transparency, with tenders often announced with short response times and published only on the Ministry of Economy and Finance (MEF) website. Irregularities in the procurement process are common, despite legal requirements for audits and inspections. Although there have been allegations of misconduct in several ministries, the government has taken little action to investigate. It is reported that while the 2023 Law on Public Procurement introduced additional provisions aimed at strengthening the regulation and management of public procurement, stakeholders have not observed any significant improvements in practice.

Telecom Cambodia, the principal telecommunications company in the country, is a fully state-owned enterprise established under Sub-Decree No. 01. As provided in Art. 1 of the Decree, Telecom Cambodia is a public enterprise that operates under the technical supervision of the Ministry of Posts and Telecommunications and the financial oversight of the Ministry of Economy and Finance.

It is reported that the government has included domestic preferences for SMEs in public procurement procedures; however, this practice is not specified in legislation.

It is reported that Cambodia does not mandate functional or accounting separation for operators with significant market power (SMP) in the telecommunications sector. However, the Ministry of Posts and Telecommunications (MPTC) is reportedly drafting a Prakas on competition, which is expected to define the criteria for classifying SMP operators and assessing dominance in the sector.

Cambodia is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA) nor does it have observer status.

The Law on Telecommunications grants the Telecommunication Regulator of Cambodia (TRC) autonomy in administrative and regulatory matters for the telecommunications sector, while the Ministry of Posts and Telecommunications (MPTC) is responsible for networks and infrastructure supporting the telecommunications sector. It is reported that the TRC and the MPTC enjoy vast discretionary powers to grant licenses and set terms and conditions, which vary on a case-by-case basis. Art. 17 of the Law on Telecommunications regulates unified (multi-service) licenses. A license is required for the provision of: mobile telecommunications services; fixed-line telecommunications services; VoIP services; Internet service provider (ISP) services; telecommunications-type approval; national numbering plan; access code; public switched telephone network (PSTN); and Internet cafés.
Some customary licensing terms and steps include: (i) license terms of between 10 to 30 years onward (with some renewability); (ii) license fees based on a combination of a percentage of gross revenue (the percentage usually increases throughout the license) plus a percentage of dividend sharing; and (iii) there may be inter-connection fees, an annual frequency charge fee, microwave license fees, etc., applicable on a case-by-case basis. The percentage of revenue and dividends to be shared increases incrementally, reaching around 10% over 10 years. It is reported that the exact percentages of revenue and dividends to be shared by operators with the TRC/MPTC vary on a case-by-case basis and are determined by the terms and conditions negotiated between the TRC/MPTC and the operator. Moreover, it is reported that older licensees sometimes have to pay a higher revenue share. Licensees with some fixed-network capability or carrying international traffic may also be required to share up to 50% of their gross revenue with the MPTC or TRC.