The collection of information is defined under the Instructions on the Implementation of the Law on Electronic Data Protection as “the compiling of information in a database...for the convenience of access, monitoring, and use...”.

The Law on Electronic Data Protection speaks literally of “administration” of data. Administration of electronic data refers to the management and arrangement of data, which includes the collection, copying, submission, receipt, maintenance, and destruction of electronic data. This administration of data is carried out by the Data Administrator, which is defined as an “individual, legal entity, or organization which has the duty to administrate electronic data, such as: a Ministry, an Internet Data Center, a Telecommunications Service Provider, an Internet Service Provider, or a Bank.” Apart from this definition, and the examples provided in the law, the Lao regulatory framework does not provide official guidance on who may or may not fall under the definition of Data Administrator.

By law, all data, general or sensitive, requires consent from the Information Owner to be collected. However, there is no information on how this consent may be collected.

Information Owner is defined as the individual, legal entity, or organization who / which is the owner of the electronic data. In this regard, the law does not necessarily identify the Information Owner as an individual only, or an individual who may be identified according to personal data that relates to him / her. The law only provides that the Information Owner is the entity that “owns” the information.

Sensitive data is more regulated as it requires the approval from the Information Owner for the access, use, and disclosure of sensitive data. At the time of the collection, the Information Owner must be informed of:

• the identity of the Data Administrator;
• the purpose of the collection of the information;
• the type of information that will be collected;
• the rights of the Information Owner, which include:
  • the right to amend the information provided;
  • the right to stop the sending or transfer of information to third parties;
  • the right to delete the information collected per request, or at the time that the purpose of the collection of the information expires.

Also, the Data Administrator and the Information Owner have the duty to ensure that the information provided is correct — it does not contravene local regulations, and does not affect the country’s socio-economic development, national stability, or social order.