You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

November 14, 2019

Cambodia Enacts a New E-commerce Law and a Consumer Protection Law

In support of Cambodia’s rapidly growing economy, the Cambodian government enacted the Law on Electronic Commerce (E-commerce Law) and the Law on Consumer Protection (Consumer Protection Law) on November 2, 2019. Both of these new laws change the legal landscape in important ways for businesses under their purview. 

E-commerce Law

The E-commerce Law regulates domestic and cross-border e-commerce activities in Cambodia, establishes legal certainty for electronic transactions, and enacts a number of important protections for consumers.  

The E-commerce Law broadly applies to all commercial and civil acts, documents, and transactions executed via an electronic system, except those that are related to powers of attorney, wills and successions, and real estate. The E-commerce Law grants the Cambodian government the authority to issue further regulations to limit the law’s scope; thus it will be necessary to monitor whether other types of transactions are later excluded from the scope of the law. 

The E-commerce Law has 12 chapters, 67 articles, and one annex. 

  • The first chapter contains general provisions on the aim, purpose, and scope of the law, as briefly described above, and refers to the annex, which contains a glossary of 38 key terms used throughout the law.  
  • The second and third chapters deal with the validity and process of electronic communications, including clarifying the regulatory requirements for recognizing electronic agreements and e-signatures. These chapters also discuss certain technical matters, such as when and where electronic communications are considered sent and received. 
  • The fourth chapter addresses the security of electronic records and e-signatures, and specifically prohibits identity theft. 
  • The fifth chapter is material to electronic-commerce service providers and intermediaries. This chapter covers potential liabilities for third-party content on platforms and content takedown requests. Furthermore, service providers and intermediaries, possibly including foreign entities making their platforms accessible in Cambodia, may be subject to a licensing regime and codes of conduct in Cambodia.
  • The sixth chapter contains legal provisions on consumer protection on e-commerce platforms, including matters on adequate information requirements, scams, malicious codes, and data protection. Interestingly, this chapter specifically requires both domestic and foreign e-commerce businesses, regardless of their places of business, to comply with the legal obligations regarding unsolicited emails. 
  • The seventh chapter governs electronic acts and transactions by the Cambodian government, which may facilitate governmental agencies using online application forms in the future. 
  • The eighth chapter gives legal recognition to the use of evidence in an electronic form in Cambodian legal proceedings.
  • The ninth chapter further regulates electronic fund transfers and payments. Banking and financial institutions should be aware of this chapter as it imposes certain obligations and liabilities on them concerning electronic fund transfers and payments. For instance, when a banking and financial institution has received a customer’s notification that his or her electronic payment instrument has been lost or stolen, banking and financial institutions are now liable for any transactions occurring after the notification.
  • The tenth chapter designates the Ministry of Commerce and the Ministry of Posts and Telecommunications as the competent authorities who may issue warnings and disciplinary sanction decisions on e-commerce matters.
  • The eleventh chapter outlines a number of penalties, such as fines and imprisonments, on persons violating provisions of the E-commerce Law. 
  • The last chapter notes that the E-commerce Law will not be implemented until May 2, 2020, which leaves time for government agencies to prepare any necessary implementing regulations required under the law, and for private companies to prepare for compliance. 

As businesses have almost six months to prepare for the implementation of the E-commerce Law, we recommend that they familiarize themselves with the new requirements of the law and watch out for additional implementing regulations that are likely to be released before the full implementation of the law on May 2, 2020. 

Consumer Protection Law

The Consumer Protection Law establishes rules to guarantee the rights of consumers and to ensure that businesses conduct commercial competition in Cambodia fairly. The Consumer Protection Law applies to any person who conducts any trading activities with consumers in Cambodia, regardless of whether the trading activities are for profit. The law applies to the sale of goods, services, and real rights over immovable property.

The Consumer Protection Law has 11 chapters and 51 articles.

  • The first three chapters touch on introductory and general provisions, and explain the aims and purposes of the law and key definitions. Importantly, these chapters establish the National Committee on Consumer Protection (NCCP) as Cambodia’s competent authority for consumer protection and empower consumers in each industry to form an association to protect their interests.
  • The fourth and fifth chapters regulate unfair trading activities and unfair practices. These deal, for example, with false, misleading, or deceptive advertisements, and business models equivalent to pyramid schemes.
  • The sixth chapter sets out minimum information standards that businesses must meet in connection with consumers, such as labeling requirements. These minimum information standards will be more specifically set by the relevant industry regulators. One notable element of the standards is that all information must be provided in the Khmer language.
  • The seventh to the ninth chapters establish the procedures for the NCCP to receive consumer complaints, carry out investigations, and issue decisions, and the rules for appealing the NCCP’s decisions. 
  • The tenth and eleventh chapters present a number of penalties for non-compliance with the Consumer Protection Law, including disciplinary sanctions, fines, and imprisonment. 

The Consumer Protection Law became effective upon promulgation on November 2, 2019, and prudent businesses should therefore immediately review the law to understand their compliance requirements and prepare accordingly.

For more information, please contact our Phnom Penh office on [email protected] or at +855 23 964 210.

RELATED INSIGHTS​ 

July 6, 2026
Tilleke & Gibbins has contributed the Vietnam chapter to Data Protection & Privacy 2027, a global guide published by Lexology Panoramic that provides comparative insights into data protection and privacy regimes across multiple jurisdictions. The Vietnam chapter offers a comprehensive overview of the country’s data protection framework, addressing both regulatory structure and practical compliance considerations for businesses operating in or engaging with Vietnam. Topics covered include: Law and the regulatory authority: Legislative framework; data protection authority; cooperation with other data protection authorities; breaches of data protection law; judicial review of data protection authority orders Scope: Exempt sectors and institutions; interception of communications and surveillance laws; other laws; personal information formats; extraterritoriality; covered uses of personal information Legitimate processing of personal information: Lawful bases for processing; grounds for legitimate processing; types of personal information Data handling responsibilities of owners of personal information: Transparency; exemptions from transparency obligations; data accuracy; data minimization; data retention; purpose limitation; automated decision-making Security: Security obligations; notification of data breaches; internal controls Accountability: Data protection officer requirements; record-keeping; risk assessment; design of personal information processing systems Registration and notification: Registration requirements; other transparency duties Sharing and cross-border transfers of personal information: Sharing with processors and service providers; restrictions on third-party disclosures; cross-border transfers; further transfers; localization requirements Rights of individuals: Right of access; other statutory rights; compensation Enforcement: Enforcement mechanisms; exemptions, derogations, and restrictions; further exemptions and restrictions Specific data processing: Cookies and similar technologies; electronic communications marketing; targeted advertising; sensitive personal information; profiling; cloud services The chapter concludes with an update on key legal and regulatory developments over the past year and emerging trends in Vietnam’s data protection landscape. The full Vietnam chapter is available as a PDF through the button below. Readers can also gain 30 days of complementary access to the full Data
July 2, 2026
Thailand’s Electronic Transactions Development Agency (ETDA) released a new version of the draft Act on Artificial Intelligence on July 2, 2026, for a public hearing period expected to be approximately 30 days. The draft act adopts a risk-based regulatory approach modeled in part on international frameworks—particularly the EU’s AI Act—while incorporating provisions tailored to Thailand’s regulatory landscape and digital economy objectives. If enacted in its current form, the law would introduce extraterritorial obligations, a tiered risk classification system, strict liability for AI-related damages, and new transparency requirements for AI-generated content. Scope and Extraterritorial Application The draft act applies to AI development, deployment, or any other action affecting people in Thailand, even if the action occurs outside the country. Of note: This extraterritorial reach creates compliance obligations for global AI companies whose systems impact Thai residents or consumers, even if the provider has no physical presence in Thailand. Foreign AI providers serving Thai deployers or users must appoint a local coordinator or authorized representative. Depending on the type of AI system, the representative may need full authority to act on behalf of the provider without any limitation of liability. Certain activities are exempt from the draft act’s oversight, including AI used by natural persons solely for personal or household activities, AI for educational research conducted by higher education institutions with ethics committee approval, research and development activities conducted prior to distribution or service provision, and other AI systems prescribed by royal decree. Risk-Based Classification Framework The draft act establishes a tiered risk classification system with three main categories: Prohibited AI. The act outright prohibits AI systems employing cognitive-behavioral manipulation using subliminal techniques, AI systems causing unfair broad-scale discrimination from processing irrelevant data, and other categories of serious risk as determined by announcement of a forthcoming committee that will be responsible
July 1, 2026
Obtaining marketing authorization is a fundamental requirement for bringing pharmaceutical products to the Thai market. Companies must navigate the Thai Food and Drug Administration’s registration procedures while also complying with post-approval pharmacovigilance obligations, licensing requirements for manufacturing and importation, data protection rules, and other regulatory requirements. This guide provides an overview of Thailand’s regulatory framework for pharmaceutical marketing authorization, including available registration pathways, review timelines, application fees, postmarketing surveillance obligations, licensing requirements, exemptions, data exclusivity, freedom of information, and parallel import considerations. It is intended as a practical reference for pharmaceutical companies, regulatory affairs professionals, and others involved in bringing medicinal products to the Thai market. Download the guide below for a concise overview of the current requirements and procedures governing pharmaceutical marketing authorization in Thailand.
June 25, 2026
On June 18, 2026, Thailand’s Office of the Personal Data Protection Committee (PDPC) published two notifications in the Government Gazette establishing Thailand’s first formal certification framework for personal data protection standards under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). The notifications, which took immediate effect, introduce a voluntary certification framework aimed at promoting accountability, strengthening organizational data protection governance, and aligning Thailand more closely with international frameworks that recognize certification as a key compliance tool. Certification Criteria The first notification sets out the assessment criteria for organizations seeking certification. Applicants must undergo an evaluation against a framework comprising four assessment categories, 10 focus areas, and 128 assessment criteria covering key elements of a privacy management program. These include: Organizational oversight and internal policies and procedures. Human resource development, including staff training and awareness programs. Clearly defined operational processes and procedures covering data subject rights, transparency obligations, records of processing activities, and lawful basis management, as well as contractual safeguards such as data-processing and data-sharing agreements and risk assessments, including Data Protection Impact Assessments. Technical measures encompassing data security controls and breach response capabilities Based on the assessment results, organizations may be awarded either a PDPA Compliance Certificate or a higher-level PDPA Certificate accompanied by a certification mark. Application and Assessment Process The second notification establishes the application and assessment process for obtaining certification. Eligible applicants include government agencies and private-sector entities that demonstrate sufficient privacy governance maturity and meet the prescribed eligibility requirements. Applicants must submit their applications along with supporting documentation for review. Upon receiving an application, the Office of the PDPC will conduct a detailed evaluation, which may include both documentary review and on-site inspections. Incomplete applications may be rejected, though applicants are typically given a limited period to correct deficiencies before a final decision