As Cambodia has not enacted any dedicated or comprehensive data protection laws, there are no laws or regulations in Cambodia that explicitly and specifically discuss the concept of collection and processing of data. Under current practice, matters pertaining to data protection and privacy generally fall under the right to privacy that is protected in broad terms under Cambodia’s Constitution, specific legal provisions under the Civil Code, the Criminal Code, and other specific laws such as the Banking Law and the E-Commerce Law. However, none of the legislations mention a consent requirement.

Under the Draft Law on Personal Data Protection, which is subject to further revisions, the term “data controller” is defined as a natural person, private legal entity, public establishment of administrative character, or public entry that determines the purpose and means of collecting, using, or disclosing personal data. On the other hand, a “data processor” is defined as a natural person, private legal entity, public establishment of administrative character, or public entry that processes personal data on behalf of a data controller or public authority.

The Draft Law on Personal Data Protection contains provisions on consent requirement for collecting, using, or disclosing personal data and further stipulates that the principles of personal data protection include:

• lawfulness, fairness, and transparency;
• purpose limitation;
• accuracy of personal data;
• retention limitation;
• security safeguards; and
• accountability.