Art. 51 of the Law on Customs stipulates that all individuals or entities engaged in the import or export of goods must maintain accurate documentation, including books, records, and other information, in both digital and traditional formats. These records must be retained for a minimum of 10 years at the business premises in Cambodia. This obligation extends to importers, exporters, customs brokers, operators of customs temporary storage facilities and customs bonded warehouses, transportation operators, and other relevant parties.

Art. 6 of Sub-Decree No. 287 stipulates that ministries and governmental institutions intending to utilise the national domain name designated for such entities must store their data within the Kingdom of Cambodia. The Ministry of Post and Telecommunications is responsible for hosting and storing the data of all ministries and governmental institutions using national domain names, either in the national data centre or in a government-operated data centre.

Cambodia has not joined any agreement with binding commitments to open transfers of data across borders. Art. 12.15 of the Regional Comprehensive Economic Partnership (RCEP) recognises that each party may maintain its own regulatory requirements governing cross‑border transfers of information by electronic means and stipulates that such transfers shall not be restricted when undertaken for the conduct of business by a covered person; however, the article simultaneously allows parties to adopt or maintain any measures they themselves deem necessary to achieve a legitimate public policy objective, as well as any measures necessary to protect essential security interests, with the parties expressly affirming that the determination of such necessity lies solely with the implementing party and that such measures shall not be subject to dispute. It is reported that this formulation enables the parties to preserve their domestic data‑control regime under the rubric of national security without risking inter‑state disputes, and that the relative weakness of Chapter 12 renders its provisions largely ineffectual in facilitating the liberalisation of cross‑border data flows, particularly because the clause entrusting necessity assessments to the implementing party effectively permits any measure to be characterised as legitimate at that party’s discretion.

There is currently no comprehensive data protection regime in Cambodia. However, certain general privacy provisions exist in the 2010 Constitution of the Kingdom of Cambodia (Art. 40), the 2007 Civil Code (Art. 10), the 2009 Penal Code (Arts. 301, 302, 314, 318, and 427), and the Telecommunications Law (Art. 56). In addition, the Law on Electronic Commerce includes some measures to protect consumer data collected through electronic communication; notably, Art. 32 prohibits interference with, or unauthorised access to, data held by others. Sub-Decree No. 252 on the Management, Use, and Protection of Personally Identifiable Data further applies to data in the custody of the Ministry of Interior (MOI). It is reported that the Ministry of Posts and Telecommunications (MPTC) has already circulated a draft Personal Data Protection Law to selected companies for comment and held a consultative workshop on the draft in December 2024. However, as of 2025, this law has not yet been enacted.

Art. 14 of Sub-Decree No. 23 imposes an obligation on National Internet Gateway (NIG) operators to retain traffic data for a year. The National Internet Gateway is the gateway through which all Internet services must be connected, both nationally and internationally. Traffic refers to the amount of data that passes through a network in one second (Annex 1). NIG operators shall maintain technical records, IP address allocation table, and route identification of traffic transiting through NIG for the last 12 months. It is reported that Art. 14 means the operator(s) of the NIG can track the activities of all internet users in Cambodia, including a user’s browser history and unencrypted search history for up to 12 months. Art. 13 imposes an obligation on NIG operators to report and monitor traffic data and submit monthly, quarterly, semi-annual, third-quarterly, and annual traffic reports within seven days after the end of each month, quarter, semester, third-quarter and year to both the Telecommunication Regulator of Cambodia (TRC) and the Ministry of Posts and Telecommunications (MPTC). It is reported that, although the law is in force, it has not yet been implemented in practice.

Art. 6 of the Law on Telecommunications requires that all telecommunications operators and persons involved with the telecommunications sector shall provide "telecommunications information and communication technology service data" to the Ministry of Post and Telecommunications. In practice, this gives the Ministry unfettered rights to demand that all telecommunications service providers provide data on their service users. This could serve as an obligation for companies to surrender data without the requirement of a judicial warrant or other safeguards protecting privacy rights.
Art. 97 of the law permits the secret surveillance of any telecommunications where it is conducted with the approval of a “legitimate authority.” There is no definition of what constitutes a “legitimate authority”. This appears to create a power to secretly eavesdrop without any public accountability or safeguards to protect individuals’ right to privacy.

It is reported that some articles of Sub-Decree No. 23 may require the government to have direct access to personal data collected. Art. 14 establishes that the Ministry of Post and Telecommunications (MPTC) and Telecommunication Regulator of Cambodia (TRC) can monitor the infrastructure, connections, and equipment of the National Internet Gateway (NIG). NIG refers to the gateway through which all Internet services must be connected, both nationally and internationally (Annex 1). NIG operators shall:
- Prepare and maintain technical records, IP Address allocation table, and route identification of traffic transiting through NIG;
- Compile and maintain reports and relevant documents concerning the connections and all Internet traffic;
- Provide other information as required by the MPTC and TRC.
It is reported that, although the law is in force, it has not yet been implemented in practice.

The E-commerce Law establishes a safe harbour regime for intermediaries for copyright infringements. According to Art. 24 of the law, internet intermediaries are not liable for unlawful third-party content on their online platforms. However, they must comply with mandatory content-removal procedures upon becoming aware of such content (Art. 25). Additionally, pursuant to Art. 27, intermediaries are obligated to comply with an e-commerce code of conduct.

The E-commerce Law establishes a safe harbour regime for intermediaries beyond copyright infringements. According to Art. 24 of the law, internet intermediaries are not liable for unlawful third-party content on their online platforms. However, they must comply with mandatory content-removal procedures upon becoming aware of such content (Art. 25). Additionally, pursuant to Art. 27, intermediaries are obligated to comply with an e-commerce code of conduct.

It is reported that Cambodia requires identity verification for SIM card registration. Individuals seeking to purchase a SIM card must present a national identity card or, for foreign nationals, a passport to activate a new prepaid SIM. This requirement has reportedly existed since 2012, although its implementation remained incomplete for several years.
In August 2022, the authorities issued a final warning directing all telecommunications operators to ensure full SIM registration by 2023. This framework was subsequently formalised through Sub-Decree No. 41 on Equipment Identity Registration, issued in February 2023, which established a SIM identification registration system and a national database to support regulatory compliance.

Clause 7 of the Inter-ministerial Prakas No. 170 requires all Internet Service Providers (ISPs) operating in Cambodia to install software programs and equip themselves with Internet surveillance tools to easily filter and block any social media accounts or pages that run their business activities and/or publicise illegal activities. In addition, Clause 6 establishes that the Ministry of Information should manage information published through electronic systems, including all news content, written messages, audio, photos, videos, and/or other means, on websites and social media using the internet in the Kingdom of Cambodia.

According to Section 7 of Inter-ministerial Prakas No. 170, the Ministry of Posts and Telecommunications (MPTC) may block or close websites and social media pages that disseminate content deemed illegal, including that which incites unrest or threatens national security, public interest, or social order. However, these grounds are not clearly defined. Similarly, Art. 7 of the Law on Telecommunications authorises the MPTC or other ministries to instruct telecom operators to take unspecified necessary measures in cases of "force majeure", without defining such circumstances or actions. Both provisions have been criticised for their broad scope and potential for misuse, including the restriction of internet-based services.
Moreover, news and other websites have reportedly been blocked by the Cambodian government. In April 2020, two websites owned by TVFB were reportedly blocked by the Cambodian Telecommunication Regulator (TRC) and remain inactive. In February 2023, the TRC instructed internet service providers to block access to VOD’s news sites in both English and Khmer, following the revocation of its parent organisation’s licence. In the lead-up to the July 2023 general election, access to independent outlets such as Radio Free Asia (RFA), the Cambodia Daily, and Kamnotra was also blocked, with restrictions remaining in place until the end of 2024.

Art. 27.2 of the Law on Consumer Protection mandates that any advertising must be in Khmer. Furthermore, Art. 9 of Sub-Decree No. 232 requires all commercial advertising of products and services, by any channel, to use Khmer as the primary language. If foreign-language text is used in advertisements, it must comply with the Sub-Decree rules on placement and font size to ensure the Khmer text retains its prominence. It is reported that the Khmer language requirement can be an onerous obligation for some businesses.

Art. 15 of the Law on Telecommunications provides that a license from the Telecommunication Regulator of Cambodia (TRC) and the Ministry of Posts and Telecommunications (MPTC) is required for the provision of VoIP and Internet café services.

Under Arts. 10–12 of Cambodia’s Law on Investment, any person seeking to implement a Qualified Investment Project (QIP), Expanded Qualified Investment Project (EQIP), or Guaranteed Investment Project (GIP) must submit a written Investment Project Application to the Council for the Development of Cambodia (CDC). The CDC assesses the application through its One-Stop Service mechanism, which operates through seconded representatives of relevant ministries and institutions acting under delegated decision-making authority. Where the proposed investment is not included in the Negative List (to be specified by Sub-Decree), the CDC must issue a Registration Certificate within 20 working days.
In addition, Art. 11 of Sub-Decree No. 60 (2016) requires the CDC to refer specified categories of projects to the Council of Ministers for approval, including projects with investment capital of USD 50 million or more, projects involving politically sensitive issues, projects relating to the exploration or exploitation of mineral and natural resources, projects that may have negative environmental impacts, projects characterised as long-term strategic, and projects involving infrastructure concessions.