The Royal Government of Cambodia (RGC) has taken significant steps toward its vision of digital transformation across government, the economy, and society through two key strategic initiatives: the Cambodia Digital Economy and Society Policy Framework (2021–2035) and the Cambodia Digital Government Policy (2022–2035). These forward-looking strategies provide a clear roadmap for enhancing digital infrastructure, strengthening governance, and promoting digital inclusion to build a modern and connected digital economy. However, the successful implementation of these policies requires the establishment of a robust legal and regulatory framework. Despite the comprehensive vision laid out in these plans, critical gaps remain—particularly in areas such as data protection, cybersecurity, and privacy. As Cambodia advances its digital agenda, the absence of adequate legal safeguards leaves citizens, businesses, and institutions exposed to risks including cyberattacks, data breaches, and the misuse of personal information. Developing and enforcing strong legal protections is essential to ensure a secure and trustworthy digital environment.

To support the implementation of these two strategic frameworks, AFD is developing a project to support the GRC in its transition to digital government. In particular, this will involve supporting investment in basic public infrastructure (networks, data, software, etc.) necessary to develop digital government and improve the functioning of public services and user services. One of the components of this project (and a prerequisite for the deployment of these infrastructures and digital services) is the establishment of a strategic and regulatory framework for data (protection of personal data and individual freedoms, governance, data circulation and sharing, interoperability, data accessibility – open data, etc.) to support the development of a digital government while ensuring the protection of users.

Overall objective 

The activities implemented by Expertise France will contribute to the establishment and structuring of a legal framework for the development of a human-centred and sustainable digital government and the digital economy in Cambodia. This will draw on French and European experience in the field of personal data protection, as well as the topics covered by the Information and Communication Technologies Law (ICT Law) and e-government. It will also be adapted to the Cambodian ecosystem.
This will contribute to the establishment and structuring of a legal framework for the development of human-centric digital government and the digital economy in Cambodia.
Expertise France will coordinate the operational cooperation mechanism, bringing together various French public and private experts.
This support will enable the following laws to be developed or finalized:
1.    Finalization and implementation of the data protection law
As well as adapting the text to cover public sector processing not currently included, the main activities will focus on the regulatory impact assessment (RIA) and the operational implementation of the law. This will include supporting the drafting of the RIA for the personal data protection law, as well as developing an action plan and educational and practical guidelines to facilitate its application.
This will be achieved through peer-to-peer knowledge sharing with DINUM and private sector experts who have extensive experience in methodology, analysis and control. This will ensure the implementation of this new framework is scaled up through acculturation and raising awareness among all stakeholders (supervisory authority officials, personal data protection officers and companies), as well as the development of tools such as processing register templates and privacy and individual freedoms impact assessments. Awareness-raising activities targeting various public and private stakeholders will be included, as well as the organization of training sessions for the private sector.
2.    Drafting of the Information and Communication Technologies Act (ICT Law)
While the text clearly identifies the topics to be covered, the drafting work has yet to be finalized. According to a scope that has yet to be defined, its adoption will require many more months of work, making it unfeasible before 2026.
While the topics that the ICT law aims to cover could, in principle, be addressed in a single text, the broad scope of the field and diversity of topics make it difficult to adopt such a bill quickly. The French framework for relations between the public and the government is a good example of centralized law and clear legal frameworks related to public digital technology.
The possibility of dealing with the various areas in a modular way (e.g. cybersecurity), with each topic covered by a specific text while maintaining an overall vision, is being considered. This approach is an approach similar to the EU's Digital Single Market Strategy and European digital regulations (e.g. the Digital Service Act, the Digital Market Act, the Cybersecurity Act, the Data Act) is envisaged as a coherent set of multiple texts designed to stimulate economic growth through employment, competition, investment and innovation. The protection of personal data, individual freedoms, and Cambodia's digital sovereignty are also key considerations.
This approach, presented during the November 2024 mission, met with keen interest from the MPTC and will enable the work to be adapted and the expected priorities managed. The planned activities will consist of supporting the MPTC in implementing this approach and providing targeted support tailored to its needs.
In addition, given the extensive work carried out as part of the Japanese contribution to the Cybersecurity Resilience Project (May 2023–October 2026), which includes capacity-building activities and technical support for the cybersecurity bill currently awaiting approval, close coordination with JICA is planned. In this context, initial discussions have been initiated with their experts. Furthermore, the CKH1276 project's feasibility study includes an evaluation of the aforementioned bill and the cybersecurity measures to be implemented to safeguard the infrastructure and services that will be deployed as part of this project.
3.    Development of the legal and strategic framework specific to the digital government law
Alongside the ongoing development of the draft Digital Government Law, supported by Korean experts, efforts will focus on assisting the Cambodian side in building a legal framework within the scope defined by the MPTC. This framework will underpin the creation of a comprehensive policy and strategy on personal data management and its applications, supported by appropriate governance mechanisms. The overarching objectives are to simplify and improve the lives of citizens and businesses, enhance government performance and decision-making, and foster innovation and wealth creation. At this stage, the MPTC has identified three priority areas: data governance, interoperability, and cloud computing. Furthermore, it is essential to move beyond pilot initiatives and institutionalize digital inclusion as a fundamental element of public policy.
Specific objectives

In collaboration with the private sector, the structures (MPTC and MEF or other ministries) will adopt and take ownership of implementing the data protection regulatory framework, accelerate the adoption of ICT legislation thanks to a drafting methodology based on the experience of France and Europe, and strengthen the legal and strategic framework for digital government development.
Project Components/Outputs
Three components/products will be developed:
1.    Component 1: Finalization and implementation of the data protection law based on French experience (DINUM); 
2.    Component 2: Drafting of the project, decrees, specific texts and studies on the law on information and communication technologies (ICT Law);
3.    Component 3: Elaboration and Operationalization of the legal and strategic framework specific to the development of a human-centred and sustainable digital government.
Project beneficiaries

Direct target beneficiaries
-    MPTC, The Digital Government Committee (DGC), MEF, and private actors.

Indirect beneficiaries 
-    All public officials who will benefit from training on these laws;