Laos — Not Licensed, and the Data Law Is the Constraint

Asia-Pacific Private Investigation Registry · AI9OS

The finding: Laos licenses guarding, and the constraint on investigation is a data law

Laos has the same shape as Thailand and Indonesia on licensing. One decree licenses a security trade; investigation is not part of it; and no other instrument creates a private investigator licence. What makes Laos different is where the risk actually sits. In Thailand and Indonesia the absence of a licence leaves a comparatively open field. In Laos, a 2017 data statute closes much of it.

Decree 138/GoL is unambiguous about what a licensed security enterprise sells. Article 42 lists the field of service, and it is guarding, cash in transit, traffic order and event cover. The mandatory training syllabus in Article 33 confirms it from the other direction: batons, handcuffs, patrol routes, traffic signals, first aid, and for the advanced course, firearms and tear gas. A regime that intended to license investigators would train them to investigate. This one trains them to stand at a gate.

The prohibitions say the same. Article 50 bans hiring a security force for intimidation, coercion or extortion, and bans operating in the form of a security enterprise without Ministry of Public Security permission. Articles 52 and 53 bind the enterprise and the individual guard: no unlicensed operation, no lending the licence, no colluding with a client's unlawful acts, no guard on duty without a licence. Not one of the prohibitions mentions investigation, surveillance, tracing or the handling of information about a person.

Why the guarding licence is not a route to investigative work

Article 52(3) prohibits a licensed security enterprise from operating outside the objectives stated in its licence, and Article 70(3) prices that at 5,000,000 to 10,000,000 kip. Since Article 42 fixes those objectives as guarding, a Lao security company that took on an investigation engagement would be outside its own licence. The guarding licence is not a broader permission that happens to include investigation; it is a narrower one that excludes it.

That is a sharper result than Thailand's. There, the guarding statute is silent on investigation and the silence leaves the question open. Here the decree states the permitted field and then penalises departure from it.

Where the exposure actually is: the Law on Electronic Data Protection

This is the part that changes how a cross-border engagement should be scoped. Law No. 25/NA divides electronic data into two classes and treats them very differently.

• Article 9, general data (ຂໍ້ມູນທົ່ວໄປ) may be accessed, used and disclosed, but the source it was obtained from must be correctly stated. A statutory provenance obligation, and one that maps almost exactly onto how a defensible OSINT report should be built anyway.
• Article 10, specific data (ຂໍ້ມູນສະເພາະ) may not be accessed, used or disclosed without permission from the data owner or the relevant organisation. Specific data comprises official state data and personal data (ຂໍ້ມູນສ່ວນບຸກຄົນ, defined at Article 3(12) as electronic data of an individual, legal entity or organisation).

Three further provisions matter to anyone conducting or commissioning an investigation that touches Laos.

• Article 12 (collection). A person collecting data must tell the data owner the purpose, the details of what is being collected, who will control it and what rights the owner has. Collection requires the owner's permission, and must not use deceit or any method that causes the data owner to misunderstand the purpose or the details. Pretexting is named and prohibited, not merely implied.
• Article 17 (transfer). Sending or transferring personal data requires the owner's permission and assurance that the recipient can protect it, and personal data and official data may not be sent out of the Lao PDR without the data owner's consent or express legal authority. A report delivered to a client outside Laos is a transfer.
• Article 33(3). Collecting, using or disclosing data relating to race, ethnicity, political opinion, religious belief, criminal record or health record is prohibited. Criminal-record checking, a routine limb of due diligence elsewhere, is a named prohibited category.

Article 31 carries the general prohibitions, binding on everyone rather than only on data controllers: no accessing, collecting, using, disclosing, intercepting, altering, forging or supplying confidential electronic data without permission; no transferring data without the owner's permission; and no exploiting a weakness or vulnerability in a data system to access or collect data. Article 52 fines breaches of Articles 31, 32 and 33 at 15,000,000 kip where they fall short of a criminal offence, and Article 54 sends criminal conduct to the Penal Code.

The practical reading: in Laos you do not need a licence to investigate, and you may not lawfully gather a person's electronic personal data without their permission, obtain it by deception, or export it. The licensing question is the easy one. The data question decides whether the engagement can be run at all.

Why Laos is “neither” and Vietnam is “activity”

The distinction is worth stating because the two look similar and are not. Vietnam licenses the activity: from 1 July 2026 data analysis, aggregation and personal data processing are conditional business lines, so a firm doing that work needs a permit and can be refused one. Laos does not license the activity. It prohibits particular handling of personal data and fines it. There is no permit to apply for, which means there is also no permit that makes the conduct lawful. Consent from the data subject, or express legal authority, is the only gate.

What the register search proves, and what it does not

This is why the page does not claim that investigation appears nowhere in Lao law. The searches for ນັກສືບ, “detective”, and for investigation services do return zero, and that is worth recording, but on its own it would be a nil result from an instrument that cannot see inside the documents that matter. What supports the finding above is not the search. It is that Decree 138/GoL and Law 25/NA were both retrieved and read in full from rendered images.

The same limit caught an error of ours. An earlier working note recorded that the Lao framing is “electronic data, not personal data”, because ຂໍ້ມູນສ່ວນບຸກຄົນ returned zero on the register. The term is in fact a defined term of the statute, at Article 3(12), and a whole class of protection is built on it. The register returned zero because it cannot read the scan. A nil result is not a finding until you have proved you could have found something.

What is still open

How this compares

Primary sources

• Lao Official Gazette — the register carries a genuine status field distinguishing instruments in force from superseded ones, which is why Laos could be resolved when Cambodia and Myanmar could not
• Decree on Security Enterprises No. 138/GoL, 2 March 2020, gazetted 6 May 2020, Ministry of Public Security. 30 pages, scanned, read in full
• Law on Electronic Data Protection No. 25/NA, 12 May 2017, with National Assembly Resolution No. 012/NA of the same date. 15 pages, scanned, read in full
• Decree approving the list of controlled business types, No. 68/PM, 28 April 2008 — enacting decree read in full; attachment ka, which is the list itself, not published with it and not located
• Law on Investment Promotion, revised 28 June 2024, gazetted 16 December 2024 — in force. Note the supersession trap: the 2016 revision and the 2009 original are both marked superseded on the register, and the 2016 is the version English-language guidance still cites
• Instruction on the implementation of enterprise registration, Ministry of Industry and Commerce, 22 December 2023 — the only Lao instrument found in this pass with a machine-readable text layer

Related

• Singapore — Private Investigation Licensing
• Malaysia — Private Investigation Licensing
• Philippines — Private Investigation Licensing
• Thailand — Private Investigation Is Not Licensed
• Indonesia — Private Investigation Is Not Licensed
• Vietnam — The Activity Is Licensed, Not the Profession
• Hong Kong · Investigation Is Not Licensed
• Japan · Notification, and the Internet Exclusion
• South Korea · Not Licensed, and the Data Law Is the Constraint
• Asia-Pacific Private Investigation Registry

General information for practitioners, not legal advice. Engage Lao counsel before relying on this reading for a live matter. The English on this page is our own translation from the Lao text; the Lao governs. Absence of a licensing regime is not absence of legal risk, and in Laos the data statute is the more demanding of the two.