Cambodia's first comprehensive privacy law is still in draft, but its direction is clear. Health data is sensitive, foreign platforms are in scope, and organisations will have two years to get ready once it is promulgated.
Health data in Cambodia moves further than many people realise. A patient books a teleconsultation on a regional app, sees a doctor at a private clinic, has blood taken at a laboratory, and claims through an insurer whose systems may sit in another country. Each step creates records, and each organisation holds a piece of the picture.
Until now, Cambodia has had no dedicated law governing how that personal data is handled.1 That is changing. In July 2025, the Ministry of Post and Telecommunications released a draft Law on Personal Data Protection at a consultative workshop, drawing much of its structure from Europe's General Data Protection Regulation (GDPR).2 3 In August 2026, civil society analysis was still addressing it as a draft,4 so the final text may change. That analysis appears to review a later version of the draft, so some details, particularly criminal penalties and powers over transfers abroad, may differ from the June 2025 text that most public summaries rely on.4 Its direction, however, is clear enough to plan around.
This article works through eight questions that matter most for health data. It is written for two groups of readers.
It sits alongside our earlier Cambodia pieces, Cambodia's Digital Health Reset, NSSF Claims Go Digital and One Patient, Many Records.
Figure 1. From draft to obligations. The two-year implementation period starts at promulgation.
Very likely, if you handle personal data about people in Cambodia. The draft covers data controllers and processors located in Cambodia, and also foreign organisations that offer goods or services to people living in Cambodia or monitor their behaviour.2 That brings regional telehealth platforms, insurers and health apps into scope, even if they have no office in the country. The draft exempts individuals acting in a personal capacity, and public authorities performing functions within their jurisdiction.2
Yes. The draft defines sensitive personal data to include health status, biometric data and genetic data, along with racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and data about a person's sex life or sexual orientation.2 Its definition of genetic data is broader than the GDPR's, covering any genetic data that relates to a person's identity or characteristics.2 For health organisations, almost everything clinical you hold falls into this higher-risk category.
The draft recognises legal bases broadly similar to the GDPR's, including consent, performance of a contract, legal obligation and legitimate interests.2 The draft prohibits processing sensitive data unless there is both a legal basis and an additional condition, such as explicit consent, employment or social security obligations, or legal claims.5 In practice, health organisations often rely on different bases for different purposes: providing care, processing a claim, running analytics or training an AI model are not the same thing.
Under the draft, yes, and this is one of its most demanding features. Every controller and processor would need a certified data protection officer, whatever its size or risk profile, which is stricter than the GDPR.2 The appointment must be notified to the Ministry of Post and Telecommunications within 30 working days, and changes within 15 working days. The certification requirements have not yet been set.2 The draft names the Ministry of Post and Telecommunications as the regulator and allows it to seek the creation of a dedicated Personal Data Protection Unit.5
The draft requires a data protection impact assessment for high-risk processing.2 The detailed triggers are not yet clear, but health organisations should expect large-scale processing of sensitive data, new uses of AI, biometric identification and data sharing across organisations to be treated as high risk.
This question matters most for regional platforms and insurers. An earlier version of the draft would have required personal data to be stored in Cambodia. The revised draft removed that blanket requirement and allows transfers outside the country where defined conditions are met.3 The detailed mechanisms will matter, so organisations should confirm them against the final text before relying on any one route.
Figure 2. One patient journey, several organisations, and the obligations that follow the data.
The draft gives individuals a broad set of rights: to be informed, to access their data, to correct it, to have it erased, to restrict or object to processing, to data portability, to a remedy, and to human intervention in automated decisions.2 For health organisations, portability and access are where data quality shows. If a patient asks for their records in a usable form, an organisation holding scanned PDFs and duplicate files will struggle, while one holding structured, standardised records can respond quickly and accurately.
The draft provides for administrative fines of up to 600 million riel (about US$150,000) or 10% of annual turnover for organisations, fines of up to 60 million riel (about US$15,000) for individuals involved, and criminal liability in some cases.2 Controllers would also need to notify the regulator and affected individuals of qualifying data breaches.2 The law is drafted to take effect after a two-year implementation period from promulgation,2 which gives organisations a real window to prepare, provided they start before the clock begins.
Each of the eight questions comes back to the same starting point. You cannot choose a legal basis, run an impact assessment, answer a portability request or control a cross-border transfer for data you have not mapped. In our work with health organisations across the region, the hardest part of privacy readiness is rarely the policy. It is finding out what data actually exists, where it sits, what format it is in, and who can see it.
Health data makes this harder than most. It arrives as structured records and as scanned PDFs, photographs and free-text notes, often in more than one language. The same patient may appear several times. Sensitive details sit inside documents that were never designed to be searched. Organisations that bring this data into a structured, standardised form find that privacy obligations become far more manageable: minimisation, pseudonymisation, access control and portability all depend on knowing what each field contains.
AI can help map and structure large volumes of records, and we use it extensively ourselves. But in a regime that treats health data as sensitive, how that AI is used matters too, including where data is processed, who reviews the output and how decisions are logged.
Not yet in force. The Ministry of Post and Telecommunications released a draft Law on Personal Data Protection in July 2025. As of August 2026 it was still being analysed as a draft. Once promulgated, the draft provides a two-year implementation period.
Yes. The draft defines sensitive personal data to include health status, together with biometric and genetic data and other categories.
Yes. The draft applies to foreign organisations that offer goods or services to people in Cambodia or monitor their behaviour, as well as to organisations based in Cambodia.
Under the draft, every data controller and processor would need a certified data protection officer, with the appointment notified to the Ministry of Post and Telecommunications within 30 working days. Certification requirements are still to be set.
The revised draft removed a blanket requirement to store all personal data inside Cambodia and allows transfers abroad under defined conditions. Organisations should confirm the conditions in the final text.
The draft provides for administrative fines of up to 600 million riel (about US$150,000) or 10% of annual turnover for organisations, fines of up to 60 million riel (about US$15,000) for individuals, and criminal liability in some cases.
Privacy readiness is easier when it starts with a clear picture of your data. There are two ways we can support you, working alongside your legal advisers.
This article is for general information and is not legal advice. It is based on a draft law that may change before it is enacted. Organisations should take legal advice on their own obligations.
Suhina Singh is a physician, the Founder and CEO of Jonda Health, and a health data strategist working at the intersection of artificial intelligence and clinical information systems.
