You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

November 14, 2019

Cambodia Enacts a New E-commerce Law and a Consumer Protection Law

In support of Cambodia’s rapidly growing economy, the Cambodian government enacted the Law on Electronic Commerce (E-commerce Law) and the Law on Consumer Protection (Consumer Protection Law) on November 2, 2019. Both of these new laws change the legal landscape in important ways for businesses under their purview. 

E-commerce Law

The E-commerce Law regulates domestic and cross-border e-commerce activities in Cambodia, establishes legal certainty for electronic transactions, and enacts a number of important protections for consumers.  

The E-commerce Law broadly applies to all commercial and civil acts, documents, and transactions executed via an electronic system, except those that are related to powers of attorney, wills and successions, and real estate. The E-commerce Law grants the Cambodian government the authority to issue further regulations to limit the law’s scope; thus it will be necessary to monitor whether other types of transactions are later excluded from the scope of the law. 

The E-commerce Law has 12 chapters, 67 articles, and one annex. 

  • The first chapter contains general provisions on the aim, purpose, and scope of the law, as briefly described above, and refers to the annex, which contains a glossary of 38 key terms used throughout the law.  
  • The second and third chapters deal with the validity and process of electronic communications, including clarifying the regulatory requirements for recognizing electronic agreements and e-signatures. These chapters also discuss certain technical matters, such as when and where electronic communications are considered sent and received. 
  • The fourth chapter addresses the security of electronic records and e-signatures, and specifically prohibits identity theft. 
  • The fifth chapter is material to electronic-commerce service providers and intermediaries. This chapter covers potential liabilities for third-party content on platforms and content takedown requests. Furthermore, service providers and intermediaries, possibly including foreign entities making their platforms accessible in Cambodia, may be subject to a licensing regime and codes of conduct in Cambodia.
  • The sixth chapter contains legal provisions on consumer protection on e-commerce platforms, including matters on adequate information requirements, scams, malicious codes, and data protection. Interestingly, this chapter specifically requires both domestic and foreign e-commerce businesses, regardless of their places of business, to comply with the legal obligations regarding unsolicited emails. 
  • The seventh chapter governs electronic acts and transactions by the Cambodian government, which may facilitate governmental agencies using online application forms in the future. 
  • The eighth chapter gives legal recognition to the use of evidence in an electronic form in Cambodian legal proceedings.
  • The ninth chapter further regulates electronic fund transfers and payments. Banking and financial institutions should be aware of this chapter as it imposes certain obligations and liabilities on them concerning electronic fund transfers and payments. For instance, when a banking and financial institution has received a customer’s notification that his or her electronic payment instrument has been lost or stolen, banking and financial institutions are now liable for any transactions occurring after the notification.
  • The tenth chapter designates the Ministry of Commerce and the Ministry of Posts and Telecommunications as the competent authorities who may issue warnings and disciplinary sanction decisions on e-commerce matters.
  • The eleventh chapter outlines a number of penalties, such as fines and imprisonments, on persons violating provisions of the E-commerce Law. 
  • The last chapter notes that the E-commerce Law will not be implemented until May 2, 2020, which leaves time for government agencies to prepare any necessary implementing regulations required under the law, and for private companies to prepare for compliance. 

As businesses have almost six months to prepare for the implementation of the E-commerce Law, we recommend that they familiarize themselves with the new requirements of the law and watch out for additional implementing regulations that are likely to be released before the full implementation of the law on May 2, 2020. 

Consumer Protection Law

The Consumer Protection Law establishes rules to guarantee the rights of consumers and to ensure that businesses conduct commercial competition in Cambodia fairly. The Consumer Protection Law applies to any person who conducts any trading activities with consumers in Cambodia, regardless of whether the trading activities are for profit. The law applies to the sale of goods, services, and real rights over immovable property.

The Consumer Protection Law has 11 chapters and 51 articles.

  • The first three chapters touch on introductory and general provisions, and explain the aims and purposes of the law and key definitions. Importantly, these chapters establish the National Committee on Consumer Protection (NCCP) as Cambodia’s competent authority for consumer protection and empower consumers in each industry to form an association to protect their interests.
  • The fourth and fifth chapters regulate unfair trading activities and unfair practices. These deal, for example, with false, misleading, or deceptive advertisements, and business models equivalent to pyramid schemes.
  • The sixth chapter sets out minimum information standards that businesses must meet in connection with consumers, such as labeling requirements. These minimum information standards will be more specifically set by the relevant industry regulators. One notable element of the standards is that all information must be provided in the Khmer language.
  • The seventh to the ninth chapters establish the procedures for the NCCP to receive consumer complaints, carry out investigations, and issue decisions, and the rules for appealing the NCCP’s decisions. 
  • The tenth and eleventh chapters present a number of penalties for non-compliance with the Consumer Protection Law, including disciplinary sanctions, fines, and imprisonment. 

The Consumer Protection Law became effective upon promulgation on November 2, 2019, and prudent businesses should therefore immediately review the law to understand their compliance requirements and prepare accordingly.

For more information, please contact our Phnom Penh office on [email protected] or at +855 23 964 210.

RELATED INSIGHTS​ 

March 20, 2026
Thailand’s Board of Investment (BOI) now requires data center projects to demonstrate measurable benefits for local workforce development, R&D, SME capability, and domestic supply chains to qualify for corporate income tax (CIT) exemptions. BOI Notification No. Por. 3/2569, issued on February 6, 2026, updates the requirements for projects seeking promotion under BOI category 8.2.1 (data centers). All data center projects must now submit and implement plans covering development of Thai human resources and domestic supply chain support before benefiting from any CIT exemption. Human Resources Development Plan The BOI seeks to promote local talent development beyond basic training. Plans must include the following elements: Training for data center design, construction, and operations targeting vocational students, engineering and ICT undergraduates and postgraduates, and energy and building personnel in Thailand. Joint curricula with Thai universities and technical institutes. Collaborative R&D with Thai nationals or institutions in areas including AI, resource allocation, high-performance computing, and data center hardware and systems. Thai SME upskilling in electrical and energy systems and IT services. Domestic Supply Chain Support Plan Plans must demonstrate knowledge transfer in design, construction, cooling, security, and power and water management. Projects must also include usage or installation of domestically manufactured equipment or engage specialist domestic entities. Criteria for BOI Evaluation The BOI will assess data center operators’ eligibility for CIT incentives based on two criteria: Scale requirement: Training and joint-curriculum initiatives must reach a total participants equal to at least 10 times the project headcount and run for the duration of the CIT incentive. If this threshold is not met, the applicant must also implement continuous R&D or SME skills-development plans throughout the incentive period. Substantiality test: Supply-chain plans must be substantive, meet industry standards, and show measurable development of the domestic digital and data center supply base. To ensure compliance,
March 19, 2026
Thailand’s Electronic Transactions Development Agency (ETDA), which describes itself as a “co-creation regulator” working collaboratively with industry rather than imposing top-down rules, has unveiled its regulatory roadmap for digital platform businesses under the Royal Decree on Digital Platform Service Businesses B.E. 2565 (2022). The 2026 regulatory approach is guided by three core principles—“practicable, verifiable, shared responsibility”—aimed at elevating digital services to be safe, transparent, and fair. These principles inform ETDA’s 2026 priorities, which focus on three key dimensions: product and service standards on platforms, fair competition and fee transparency, and online fraud prevention. Product and Service Standards ETDA’s 2026 agenda addresses product and service standards across several platform categories: Online marketplace platforms. The Notification on Additional Measures for Online Marketplace Platforms under Section 18(2) came into force on December 31, 2025, designating 21 marketplace platforms that must verify products and merchants. Among other obligations, covered platforms must remove or suspend substandard products under the “notice and take down” principle. The ETDA has collaborated with the Food and Drug Administration and the Thai Industrial Standards Institute to develop inspection manuals and coordinate compliance procedures. Social commerce. The ETDA is preparing a new notification under Section 18(2) specifically targeting social commerce platforms with sales support functions, aiming to align regulation with evolving digital market conditions. Ride sharing. Since the postponement of the deadline to comply with the ETDA’s notification on ride-sharing platforms to March 31, 2026, the ETDA has supported drivers in registering with the Department of Land Transport through the Driver Verify registration system, which has already issued certifications to approximately 27,900 riders. The ETDA is also examining structural issues relating to appropriate insurance packages, motorcycle engine capacity expansion, and fair leasing fees and contract transfer costs in coordination with the Department of Land Transport, the Office of Insurance Commission,
March 19, 2026
Thailand’s Personal Data Protection Committee (PDPC) has launched a public consultation period to gather input for a forthcoming set of guidelines under the country’s Personal Data Protection Act (PDPA). This initiative follows the PDPC’s issuance of guidelines on consent and notification requirements in September 2022. The main consultation period, using an online questionnaire to gather feedback, runs until March 23, 2026. In addition, an interview-style online session for private-sector participants was held on March 17, and a two-day in-person event will be held on April 1–2—this is already fully booked and  walk-ins will not be accepted, but the session will be livestreamed on the PDPC’s Facebook page. The PDPC will use the public feedback to design draft guidelines that accurately reflect the operational realities of both public and private organizations, after which the guidelines will be shared with the public. Consultation Scope The PDPC has identified six priority areas for which upcoming guidance may be issued: Legal bases for processing: The online questionnaire assesses respondents’ understanding of consent requirements and seeks views on priority issues, such as explanations of the legal bases and considerations for selecting an appropriate legal basis depending on the nature of the processing activity. Security measures and data breach notification: The questionnaire examines respondents’ understanding of data breach reporting and security measure obligations. Topics proposed for inclusion in the guidelines include data breach prevention measures, incident response plans, risk assessment methods, and reporting procedures. Data protection officers: Respondents are invited to share their expectations regarding the DPO’s role and their experiences in contacting a DPO. The survey also asks respondents to identify priority issues, such as response timeframes for data subject requests and complaint procedures. Marketing and direct marketing: The online questionnaire seeks input on preferred topics for guidance, including individuals’ rights to refuse marketing
March 16, 2026
Thailand’s Securities and Exchange Commission (SEC) has broadened the definition of institutional investors, expanded the types of qualifying investments, and updated financial qualification thresholds for various investor categories through a revised notification on the definitions of institutional investors, ultra-high net worth investors, and high net worth investors. The amended framework, which came into force on March 1, 2026, adds digital asset business operators, investment planners, and investment consultants to the roster of entities recognized as institutional investors, and broadens the definition of investment to account for digital tokens. Expanded Definition of Institutional Investors Under the SEC’s revised notification, the category of institutional investors now expressly includes digital asset business operators licensed under the Royal Decree on Digital Asset Businesses B.E. 2561 (2018). This addition recognizes the growing role of digital asset platforms and service providers in Thailand’s investment ecosystem and aligns the regulatory treatment of digital markets with that of traditional markets. The definition of institutional investors now also encompasses investment planners and investment consultants approved by the SEC. Previously, only SEC-approved investment analysts held this status; the expansion covers a broader scope of professionals who possess comparable expertise and experience in evaluating investment opportunities. Broadened Investment Definition The revised framework now defines investment to mean direct or indirect investment in a wider range of assets beyond deposits. Specifically, the definition covers: Securities under the Securities and Exchange Act Derivatives under the Derivatives Act Investment tokens offered to the public Government-issued digital tokens (G-tokens) as specified in a separate SEC notification This expansion ensures that financial status assessments reflect the full spectrum of an investor’s holdings, including emerging digital assets. Updated Financial Qualification Thresholds The amended SEC notification also provides updated qualification thresholds for angel investors, ultra-high net worth investors, and high net worth investors. While the core criteria