Domestic law and policy
In addition to the National Strategic Plan of Identification 2017-2026, the 2023 Law on CRVSID and the Sub-Decree No. 47, the Cambodian government laid out the Cambodia Digital Government Policy 2022-2035 with an aim to build and strengthen digital identity infrastructure from 2022 to 2030.[31]
According to Sub-Decree No. 47, digital identity refers to data that identifies an individual in the digital world, which is linked to the individual’s identity in the real world.[32] In the Cambodia Digital Government Policy 2022-2035, digital identity is defined as ‘information in the digital form for the identification of individuals or objects that may be natural persons, legal entities, programs, or devices.’[33] The policy also states that ‘[t]he Digital Identity allows for the automation of user identification and verification of user identities of the user who interacts with digital systems without the need for direct verification by humans’.[34] Under the Cambodia Digital Government Policy 2022-2035, the government also aims to digitally transform governance and public services by establishing an online complaint management system.[35] The policy outlines general complaint management mechanisms for public service delivery but does not establish a specific grievance redress mechanism for digital identity systems.[36]
Data Protection
Apart from establishing an integrated identity ecosystem, the 2023 Law on CRVSID also aims to strengthen privacy protections for personal data.[37] Article 159 of the Law on CRVSID provides that the confidentiality of private information of individuals recorded and stored in various registers including the Khmer nationality identity card register and other personal identity registers shall be protected.[38] The list of names of individuals included in such registers shall not be published or displayed without authorization by the law.[39] Article 156 allows the competent authorities of public institutions to use data in the population register to perform public functions including for administrative, tax, educational, health and security. There is a stipulation that the data shared for the performance of public functions shall be limited to the what is necessary and proportionate to the specific objectives of use.[40]
In July 2025, Cambodia publicly released a draft comprehensive Law on Personal Data Protection, establishing GDPR-inspired principles (lawfulness, fairness, transparency, purpose limitation, data minimization, storage limitation, integrity and confidentiality).[41] The draft law includes the following key features: (1) recognizes data-subject rights imposing controller/processor obligations; (2) regulate processing of sensitive personal data, including biometric data, which is central to any digital ID system; (3) impose restrictions and conditions on cross-border data transfers and data breaches.[42] The draft contemplates a two-year implementation period after promulgation. Even though these provisions are not yet binding until the law is enacted and comes into force, they signal that Cambodia recognizes its digital ID implementation will need to comply with modern data-protection standards.[43]
International Commitments
Cambodia is not a party to the 1954 Convention relating to the Status of Stateless Persons or the 1961 Convention on the Reduction of Statelessness. Cambodia has ratified ICCPR, ICESCR, CEDAW, CRC, CERD, and CAT.[44] As a party to the CRC, it should be noted that the Committee on the Rights of the Child, in its General Comment No. 25 states that digital systems should be created such that they enable all children to safely access essential digital public services and educational services without discrimination.[45] In addition, the CEDAW (2019), CERD (2020), CRC (2022) and Human Rights Committee (CCPR) have raised concerns and made recommendations about the right to a nationality, birth registration, statelessness and protection of minority groups in Cambodia, particularly ethnic Vietnamese and Khmer Krom.[46] Obstacles to universal birth registration and late registration, undermine children’s rights under the CRC and equality guarantees under ICCPR and CERD.[47]
The ASEAN Framework on Personal Data Protection and Framework on Digital Data Governance set out non-binding principles that encourage member states to adopt national data protection laws and support mutual recognition. However, they do not impose binding commitments or specific mandates on digital ID systems or make provisions for the protection of stateless persons.[48] In 2025, Cambodia also pledged to the Ministerial Declaration on a Decade of Action for Inclusive and Resilient Civil Registration and Vital Statistics in Asia and the Pacific, in which countries pledged to ensure that every birth is registered by 2030 and to close registration gaps among marginalized populations.[49] The Declarations highlight the barriers faced by stateless persons in accessing civil registration services and pledge to ‘develop and implement measures to avoid the potential exclusion of digitally marginalized or vulnerable populations from statistical data and facilitate their access to services and entitlements’.[50]
