XcellHost|Cambodia Go-To-Market Strategy

For most sectors, yes under today's law: DLA Piper reports no general localisation rule or transfer restriction outside the National Bank of Cambodia's rules, as of February 2026. Banks and financial institutions are different, because NBC rules restrict international transfers. The draft PDP law allows transfers abroad, but its conditions were not described in our sources, and it could change the picture once adopted. So bank data goes to a Phnom Penh partner DC, and other workloads are designed to move in-country if needed.

Not yet. MPTC released a draft on 23 July 2025, reviewed it again in April 2026 and held a validation workshop on 5 August 2026. As drafted, it requires a certified DPO for every controller and processor, breach notice, a local representative for foreign companies targeting Cambodia, and fines up to KHR 600 million or 10% of turnover, with a two-year transition after promulgation. No adoption date has been announced.

The Technology and Cyber Risk Management Guidelines replace the 2019 framework for all licensed banks and financial institutions. A vendor brief lists controls such as an inventory of cloud-hosted systems, MFA for cloud administrators, HSM key control kept in a higher control environment, data segregation at outsourcers and data destruction at exit. We would lead with a gap assessment and in-country BFSI Cloud, SOC and HSM services. The exact effective date was not re-verified.

We found no AI law. The draft National AI Strategy 2025–2030 is a policy with six priorities, starting with human resource development, and OECD.AI listed it as proposed in June 2026. Customers still need responsible-AI practice and staff skills, which is where AI literacy cohorts and governance advisory fit.

Cambodian payers withhold a final 14% on payments to non-residents, including service and technical fees. We found no India–Cambodia tax treaty in Cambodia's treaty list, so there is no treaty rate to claim. Business customers reverse-charge 10% VAT on digital services bought from non-residents; B2C sales require VAT registration. A local company pays 20% corporate income tax and may qualify for QIP incentives. Get advice for each contract structure.

Cambodia is a small economy with few published IT market studies. Mordor sizes the whole ICT market at US$2.34 billion for 2025. Cloud estimates come from two sources with different years: US$197.3 million in 2023 (Astute) and US$371 million by 2027 (cited by Cambodia Investment Review). We found no Cambodia-only cyber security size, and Statista's figures are paywalled. We show what we found with sources and do not average them.

No. The 18-month goals and the revenue model use assumptions for target accounts, win rates and contract values, chosen to start a discussion. Change them in the revenue model. Only the market-size, legal and macro figures come from cited third parties.