Legal Analysis: Cambodia’s Draft Law on Cybersecurity

How can cybersecurity regulation protect essential services while safeguarding privacy and freedom of expression? This legal analysis by Access Now and the International Commission of Jurists examines Cambodia’s Draft Law on Cybersecurity, specifically the version dated 2 September 2022. The organizations recognize the importance of strengthening cybersecurity but raise concerns about the draft’s definitions, institutional powers, licensing requirements, compliance obligations and proposed sanctions. Their analysis considers how these provisions could affect individuals, businesses, media organizations and civil society. Key issues discussed include access to computer systems and data, the designation of critical information infrastructure, licensing for cybersecurity services and the availability of independent oversight and effective remedies. The authors also question whether the proposed obligations and penalties adequately account for the capacity of smaller organizations. The report recommends withdrawing or substantially amending the examined draft to address these concerns and align cybersecurity measures with international human rights standards. For business owners, digital professionals, educators and students, the document offers a reference for considering the relationship between cybersecurity, regulatory clarity, organizational responsibilities and digital rights. Its findings and recommendations represent the assessment of the two authoring organizations. Read the full English-language analysis to explore their reasoning. This document examines a specific historical draft; it should not be used as confirmation of Cambodia’s current cybersecurity legislation or present compliance requirements.