Cambodia's Draft Law on Personal Data Protection, rights of data subjects

Draft Law on Personal Data Protection, articles 26-36 (rights of data subjects)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Proposed: draft date not recorded.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Cambodia's Draft Law on Personal Data Protection has not been enacted and creates no binding duty as of the date shown; the Ministry of Post and Telecommunications confirmed on 5 August 2026 that the draft remained at a pre-legislative validation-workshop stage.
If enacted as drafted, a data controller would have to give a data subject the information article 27 lists before processing their personal data, and act on a request to access, rectify, erase, restrict, receive in a portable form, or object to the processing of their personal data, generally within one month of the request.
If enacted as drafted, a data subject would have the absolute right to object to the processing of their personal data where it is used entirely for direct marketing purposes.
If enacted as drafted, a data subject would have the right to request human involvement where an automated decision, including profiling, produces a legal effect or similarly affects them, unless the decision is necessary to perform a contract, is authorized by specific legal provisions, or rests on the data subject's own explicit consent.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Chapter 6 would carry the rights of data subjects: article 27 a right to information before processing, article 28 a right to access, article 29 a right to rectification, article 30 a right to erasure, article 31 a right to restriction, article 32 a right to portability, and article 33 a right to object, with an absolute right to object where processing is used entirely for direct marketing.

Article 26 would require a data controller to act on a data subject's request without undue delay and generally within one month. Article 34 would give a data subject the right to request human involvement where an automated decision, including profiling, produces a legal effect or similarly affects them, subject to exceptions for a contract's performance, a specific legal authorization, or the data subject's own explicit consent.

The draft's own final page carries an unsigned, undated National Assembly signature block. The Ministry of Post and Telecommunications' own website confirmed on 5 August 2026 that the draft remained at a pre-legislative validation-workshop stage, so nothing in this row binds anyone today.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

official draft text, Ministry of Post and Telecommunications (published via Open Development Cambodia), Internet Archive capture

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived December 5, 2025. Publisher's page: https://data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc8-42d5-80a6-8db777f61d1c/downl…

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app