Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134)

Cambodia

v2022

5 domains

20 controls

Cambodia's Sub‑Decree No. 134 on the Management of Personal Data in the Digital Sector, issued on 30 May 2022 under the Law on E‑Commerce (Law No. 6/2020) and effective from 1 January 2023, establishes the country's first comprehensive data‑protection framework. It sets out principles for personal data processing, consent requirements, data‑subject rights, obligations of data controllers and processors, cross‑border data transfer rules, and enforcement mechanisms. The decree maps to 11 privacy domains and 53 specific controls.

Unverified

Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134) is a compliance framework from Cambodia with 5 domains and 20 controls that map to 7 other frameworks. The largest domains are Privacy (9 controls), Governance (6 controls), Security (3 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (5)

Governance

6 controls

Controls in the Governance domain of Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134) — 6 controls
Code	Title	Description
SD134-1	Scope and Application	Service providers operating in Cambodia must protect personal data of subscribers and users under MPTC oversight.
SD134-16	Complaint Handling	Provide a channel for subscribers to lodge personal data complaints and respond within reasonable time.
SD134-18	Training and Awareness	Train staff handling personal data on protection obligations and procedures.
SD134-19	MPTC Reporting	Submit reports to MPTC on personal data practices when requested.
SD134-2	Definitions of Personal Data	Personal data means information identifying or relating to an identifiable natural person held by service providers.
SD134-20	Penalties and Enforcement	Non-compliance may result in administrative sanctions, fines or licence action by MPTC.

Incident Response

1 controls

Controls in the Incident Response domain of Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134) — 1 controls
Code	Title	Description
SD134-17	Incident Notification	Notify MPTC and affected subscribers of incidents impacting personal data.

Privacy

9 controls

Controls in the Privacy domain of Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134) — 9 controls
Code	Title	Description
SD134-10	Retention Limitation	Retain personal data only as long as necessary for the service purpose or as required by law.
SD134-12	Third-Party Disclosure	Do not disclose personal data to third parties without consent except under lawful authority.
SD134-13	Cross-Border Transfer	Cross-border transfers must maintain equivalent protection and subscriber awareness.
SD134-15	Subscriber Rights	Subscribers have rights to access and correct their personal data held by providers.
SD134-3	Lawful Collection	Collect personal data only for legitimate, specified service purposes with appropriate notice to data subjects.
SD134-4	Consent Requirements	Obtain subscriber consent before collecting or using personal data beyond service provision needs.
SD134-5	Purpose Limitation	Use personal data only for the purpose stated at collection unless additional consent obtained.
SD134-6	Data Minimisation	Collect only personal data necessary for the declared service purpose.
SD134-7	Accuracy and Quality	Maintain accuracy of personal data and provide subscribers means to correct inaccuracies.

Security

3 controls

Controls in the Security domain of Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134) — 3 controls
Code	Title	Description
SD134-11	Secure Disposal	Destroy personal data securely when retention period ends.
SD134-8	Security Safeguards	Implement technical and organisational measures to protect personal data from unauthorised access, loss or disclosure.
SD134-9	Access Control	Restrict access to personal data to authorised personnel based on role and necessity.

Third-Party

1 controls

Controls in the Third-Party domain of Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134) — 1 controls
Code	Title	Description
SD134-14	Processor Oversight	Service providers remain accountable for personal data processed by contractors and vendors.

Your Compliance Coverage

If you comply with Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134), you already cover:

GDPR

65%

13 controls mapped

Compare →

ISO 27018:2019

10%

2 controls mapped

Compare →

ISO 27002:2022

1 controls mapped

Compare →

+ 4 more: ISO 27001:2022 (5%), ISO 27701:2019 (5%)

See all 7 mapped frameworks ↓

Maps to 7 other frameworks

20 total controls

GDPR

13 source controls mapped|9 target controls covered

65%

ISO 27018:2019

2 source controls mapped|2 target controls covered

10%

ISO 27002:2022