Getting Consent Right: Key Requirements Under Cambodia's Draft Personal Data Protection Law

I. Background

Cambodia is set to join the growing number of jurisdictions with comprehensive personal data protection legislation. The draft Law on Personal Data Protection (PDPL), finalized in June 2025, establishes robust frameworks for protecting data subject's rights while enabling business operations in the digital economy. Among the law's most critical provisions are the consent requirements under Article 8, which will fundamentally reshape how organizations collect and process personal data of Cambodian residents.

Understanding these consent obligations is essential for any business processing personal data in Cambodia, whether located domestically or operating from overseas. The PDPL applies broadly to data controller and processor offering goods or services to Cambodian data subjects, making compliance a priority for regional and international businesses alike.

II. Key Consent Requirements

III. Practical Implementation Requirements

1. Withdrawal Mechanisms

The PDPL emphasizes that consent must be as easy to withdraw as it is to give. Data controller must:

• Enable simple withdrawal procedures accessible to all data subjects
• Provide consequence notifications explaining the impact of withdrawal
• Cease processing immediately upon receiving withdrawal notices
• Respect the non-retroactive nature of withdrawal—previous processing remains lawful.

2. Documentation and Accountability

Data Controller bears the burden of demonstrating valid consent throughout the processing lifecycle. This requires:

• Robust record-keeping systems documenting when, how, and for what purposes consent was obtained
• Audit trails showing consent verification processes
• Regular compliance reviews ensuring consent mechanisms remain effective
• Technology implementations supporting automated consent management where appropriate.

IV. Business Implications

1. Immediate Compliance Actions

Organizations processing personal data of Cambodian residents should begin preparing now:

2. Risk Mitigation Strategies

The PDPL includes significant penalties for non-compliance, with administrative fines reaching up to 600 million Riels (approximately $150,000 USD) or 10% of annual turnover for legal entities. Organizations should consider:

• Alternative legal bases where appropriate, reducing reliance on consent for essential processing
• Granular consent mechanisms allowing specific purpose selection rather than blanket agreements
• Regular consent refresh procedures ensuring ongoing validity
• Cross-border compliance strategies for organizations operating across multiple ASEAN jurisdictions.

V. Looking Ahead

1. Implementation Timeline

The PDPL includes a two-year implementation period from promulgation, providing organizations time to develop compliant systems and processes. However, early preparation offers competitive advantages:

• Market readiness for expanded operations in Cambodia
• Trust building with Cambodian customers through transparent practices
• Regulatory relationship development with the Ministry of Post and Telecommunications
• Scalable frameworks supporting regional expansion.

2. Enforcement Expectations

The Ministry of Post and Telecommunications will have broad authority to investigate compliance, impose penalties, and mediate disputes. Organizations should expect:

• Proactive enforcement focusing on high-risk sectors and large-scale processing
• Guidance development through Common Guidelines on Personal Data Protection
• International cooperation with regional data protection authorities
• Industry-specific requirements through Supplementary Guidelines for Sectoral Personal Data Protection.

Conclusion

Cambodia's draft on PDPL establishes sophisticated consent requirements that balance data subject's rights with business operational needs. Success in this new regulatory environment requires proactive preparation, technology investment, and ongoing compliance commitment.

Organizations that begin implementing robust consent mechanisms now will be well-positioned to capitalize on Cambodia's growing digital economy while maintaining the trust and confidence of data subjects. The key is viewing these requirements not as compliance burdens but as foundations for sustainable, trustworthy business operations in the digital age.

As the PDPL moves toward final implementation, businesses should monitor regulatory developments, engage with industry associations, and consider professional guidance to ensure full compliance with these important new protections for personal data in Cambodia.