Cambodia has not joined any agreement with binding commitments to open transfers of data across borders.

There is no comprehensive data protection regime in Cambodia, although there are some general provisions on privacy in the 2010 Constitution of the Kingdom of Cambodia (Art. 40), the 2007 Civil Code (Art. 10), the 2009 Penal Code (Arts. 301, 302, 314, 318 and 427) and the Telecommunications Law (Art. 56). Also, the Law on Electronic Commerce provides for some measures to protect consumer data collected in electronic communication. Art. 32 of the law prohibits the interference, access, retrieval, copying, extraction, filtering, deletion, or modification of data in the custody of another person without permission or in a malicious manner. Moreover, Sub-Decree No. 252 on the Management, Use, and Protection of Personally Identifiable Data applies to personally identifiable data belonging to the Ministry of Interior (MOI).

Art. 14 of Sub-Decree No. 23 imposes an obligation on National Internet Gateway (NIG) operators to retain traffic data for a year. National Internet Gateway refers to the gateway where all Internet services must be connected nationally and internationally, and traffic refers to the amount of data that passes through a network within one second of a certain time (Annex 1). NIG operators shall maintain technical records, IP address allocation table, and route identification of traffic transiting through NIG for the last 12 months. It is reported that Art. 14 means the operator(s) of the NIG can track the activities of all internet users in Cambodia, including a user’s browser as well as unencrypted search history for up to 12 months. Art. 13 imposes an obligation on NIG operators to report and monitor traffic data and submit monthly, quarterly, semesterly, third-quarterly, and annual traffic reports within seven days after the end of each month, quarter, semester, third-quarter and year to both Telecommunication Regulator of Cambodia (TRC) and the Ministry of Posts and Telecommunications (MPTC).

Art. 6 of the Law on Telecommunications requires that all telecommunications operators and persons involved with the telecommunications sector shall provide "telecommunications information and communication technology service data" to the Ministry of Post and Telecommunications. In practice, this gives the Ministry unfettered rights to demand that all telecommunications service providers provide data on their service users. This could operate as an obligation for companies to surrender data without the requirement of a judicial warrant or other safeguards protecting the right to privacy.
Art. 97 of the law permits the secret surveillance of any and all telecommunications where it is conducted with the approval of a “legitimate authority.” There is no definition of what constitutes a “legitimate authority”. This appears to create a power to secretly eavesdrop without any public accountability or safeguards to protect individuals’ right to privacy.

It is reported that some articles of Sub-Decree No. 23 could imply the requirement to provide the government with direct access to personal data collected. Art. 14 establishes that the Ministry of Post and Telecommunications (MPTC) and Telecommunication Regulator of Cambodia (TRC) can monitor the infrastructure, connections, and equipment of the National Internet Gateway (NIG). NIG refers to the gateway where all Internet services must be connected nationally and internationally (Annex 1). NIG operators shall:
- Prepare and maintain technical records, IP Address allocation table, and route identification of traffic transiting through NIG;
- Compile and maintain reports and relevant documents concerning the connections and all Internet traffic;
- Provide other information as required by the MPTC and TRC.

The E-commerce Law establishes a safe harbour regime for intermediaries for copyright infringements. According to Art. 24 of the law, internet intermediaries are not liable for unlawful third-party content on their online platforms. However, they must comply with certain mandatory content removal procedures upon becoming aware of such content (Art. 25). Additionally, pursuant to Art. 27, intermediaries are obligated to comply with an e-commerce code of conduct.

The E-commerce Law establishes a safe harbour regime for intermediaries beyond copyright infringements. According to Art. 24 of the law, internet intermediaries are not liable for unlawful third-party content on their online platforms. However, they must comply with certain mandatory content removal procedures upon becoming aware of such content (Art. 25). Additionally, pursuant to Art. 27, intermediaries are obligated to comply with an e-commerce code of conduct.

It is reported that Cambodia imposes an identity requirement for SIM registration. Anyone wanting to purchase a SIM card has to provide their national ID card or a passport in case of foreigners to activate a new prepaid SIM card.

Sub-Decree No. 111 ANK/BK stipulates that Cambodia permits full foreign ownership in the telecommunication sector. However, Art. 3 of Law on Public Enterprise states that the Cambodian government must directly or indirectly hold more than 51% of the capital or the right to vote in state-owned enterprises. Given that Telecom Cambodia, the principal telecom company in Cambodia, is fully state-owned, some restrictions apply in this sector.

Telecom Cambodia, the principal telecom company in Cambodia, is fully state-owned.

It is reported that Cambodia does not mandate functional or accounting separation for operators with significant market power (SMP) in the telecom market.

The Law on Telecommunications sets the Telecommunication Regulator of Cambodia (TRC) to have autonomy in administrative and regulatory matters for the telecommunications sector, while the Ministry of Posts and Telecommunications (MPTC) is responsible for networks and infrastructure supporting the telecommunications sector. It is reported that the TRC and the MPTC enjoy vast discretionary powers over granting licenses and setting the terms and conditions, which vary on a case-by-case basis. Art. 17 of the Law on Telecommunications regulates unified (multi-service) licenses. A license is required for the provision of: mobile telecommunications services, fixed-line telecommunications services, VOIP services, Internet service provider (ISP), telecommunications-type approval form, national numbering plan, access code, public switched telephone network (PSTN), and Internet cafés.
Some customary licensing terms and steps include: (i) license terms of between 10 to 30 years onward (with some renewability); (ii) license fees based on a combination of a percentage of gross revenue (the percentage usually increases throughout the license) plus a percentage of dividend sharing; and (iii) there may be inter-connection fees, an annual frequency charge fee, microwave license fees, etc., applicable on a case-by-case basis. The percentage of revenue and dividends to be shared increases incrementally and reaches around 10% over ten years. It is reported that the exact percentages of revenue and dividends to be shared by operators with the TRC/MPTC vary on a case-by-case basis and are determined by the terms and conditions negotiated between the TRC/MPTC and the operator. Moreover, it is reported that older licensees sometimes have to pay a higher revenue share. Licensees with some fixed-network capability or carrying international traffic may also be required to share up to 50% of their gross revenue with the MPTC or TRC.

Cambodia has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

It is reported that although the Telecommunication Regulator of Cambodia (TRC), the executive authority for the supervision and administration of services in the telecommunications sector, proclaims itself to be an autonomous public entity independent from the government in the decision-making process, the Telecommunications Law significantly undermined its independence by granting the Ministry of Posts and Telecommunications (MPTC) ultimate authority over the regulator. The TRC’s lack of independence was reportedly demonstrated in 2017 when it followed the MPTC’s order to block access to the Cambodia Daily and other news sites in the run-up to the general election in July 2018.

According to Art. 26.1 of the E-Commerce Law, e-commerce service providers and intermediaries must obtain e-commerce permits or licenses from the Ministry of Commerce (MOC) in addition to the general business registration. According to Art 26.2, the licensing regime has two categories: (1) an e-commerce permit (for individual persons and sole proprietorships) and (2) an e-commerce license (for legal persons and branches of foreign companies). In August 2020, Cambodia issued Sub-Decree No. 134, an implementing regulation of the E-Commerce Law, clarifying that a license is required for legal persons and branches of foreign companies carrying out the following activities: e-commerce web services, e-commerce platform services, online market services, online auction website services, and other similar services provided through software or smart devices for the promotion of e-commerce (Art. 5.1). In addition, pursuant to Art. 5.2 of the Sub-Decree, an E-Commerce permit is required for natural persons and sole proprietors that operate a business via electronic system in Cambodia (including those who conduct business via social media and electronic systems to supply or sell/purchase goods and services).
According to Arts. 6 and 7 of Sub-Decree No. 134, for issuance of an e-commerce license or permit, business and tax registration is required. Art. 29 of the e-Commerce Law also requires the provision of the name, registered address, and contact number/email address of the business entity in Cambodia. Moreover, Art. 7 of the Sub-Decree also states that, in cases where the intermediary is a legal entity or foreign branch, it must enter into a contract with the service providers regarding the requirement to provide minimum information.
The E-Commerce Law broadly defines e-commerce service providers and intermediaries (Annex). An e-commerce service provider is defined as a "person who uses electronic means to supply goods and/or services except for insurance establishments". On the other hand, intermediary "refers to a person who provides the services of sending, receiving, transmitting or storing services of the electronic communication, either on a temporary or permanent basis, or provides other services relating to the electronic communication, including the following persons: a person representing the sender, receiver, transmitter, or the custodian; telecommunication service providers; network service providers; internet service providers; search engines providers; online payment service providers; online auction service providers; online marketplaces service providers and internet commerce service provider".