Myanmar Data Protection & Privacy Regulation

Other Developments

Myanmar is understood to lack a general, omnibus data protection authority. Its personal-data scope appears to be delineated through sector-specific statutes, including the Telecommunications Law of 2013 and the Financial Institutions Law of 2016, rather than a unitary omnibus definition. The Telecommunications Law is understood to address confidentiality of personal information handled by telecommunications service providers. The Financial Institutions Law is understood to mandate that regulated financial institutions protect customer information, reported as the only concrete general security-of-processing duty identified for the jurisdiction. Myanmar is understood to impose no general-purpose DPIA, DPO-appointment, ROPA, or breach-notification obligations on controllers outside that sectoral duty. The jurisdiction is also understood to lack a general controller-registration or filing regime.

The amended Electronic Transactions Law is understood to have introduced provisions on the protection of personal data, effective 15 February 2021. A Cybersecurity Law is reported to have entered into force on 30 July 2025, introducing a licensing regime for cybersecurity-service providers and digital-platform operators alongside a requirement for Ministry approval before VPN use. That licensing regime is reported to apply to platforms and services exceeding 100,000 users, with licences valid for three to ten years. Non-compliance, including unlicensed operation or unauthorized VPN use, is reported to carry criminal penalties under the same law.

Separately, violations of Sections 7 or 8 of the Privacy Law are reported to carry imprisonment of six months to three years and a fine of MMK 300,000 to 1.5 million, with liability narrowed by a 2020 amendment to apply only to 'competent authorities.' That 2020 amendment is reported to have narrowed Section 8's prohibitions on government interference to apply only to competent authorities acting without presidential or Union Government order, permission or warrant. The same amendment is reported to have narrowed Section 10 criminal liability on the same basis. No material development in Myanmar's data-protection or cybersecurity regulation is reported within the 180 days preceding, with the most recent substantive development remaining the Cybersecurity Law's 30 July 2025 entry into force.

Confidence across nearly all of these findings is capped at a qualified register, since most rest on secondary compilations without independent corroboration.

Cross-Monitor Connections

The Financial Institutions Law's customer-information duty is flagged for the financial-integrity monitor's illicit-finance and AML-CFT risk assessment of Myanmar, and for the world-payments monitor as a payments-adjacent sectoral duty. The Cybersecurity Law's VPN-approval and platform-licensing regime is flagged for the crypto monitor as a control that may affect exchanges or platforms serving Myanmar users. It is also flagged for the artificial-intelligence monitor, given the absence of any AI-specific risk-assessment or automated-decision-making transparency regime in Myanmar, against a backdrop of broader regional ASEAN AI-governance developments tracked elsewhere.

Outlook

Myanmar's regulatory trajectory is assessed as tightening, driven by the reinstated suspension of core Privacy Law protections and the newly-in-force Cybersecurity Law licensing regime. Both developments point toward an operating environment of expanding state control over communications and platform access, layered onto a jurisdiction that still lacks a general data protection statute or authority. The baseline rests entirely on secondary-compilation and challenger-supplied sources rather than official Burmese-language primary text, a gap the monitor flags for verification in future cycles.

Standing brief · as of 25 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Myanmar's 2017 Law Protecting the Privacy and Security of Citizens is the jurisdiction's principal privacy statute. Its core protections in Sections 5, 7 and 8, covering warrantless search, arrest and communications surveillance, were suspended by a February 2021 NDSC/SAC amendment, and this suspension was formally reinstated in August 2025. The correction was surfaced through this cycle's challenger fold process rather than the original baseline research.

Other Developments

Separately, violations of Sections 7 or 8 of the Privacy Law are reported to carry imprisonment of six months to three years and a fine of MMK 300,000 to 1.5 million, with liability narrowed by a 2020 amendment to apply only to 'competent authorities.' That 2020 amendment is reported to have narrowed Section 8's prohibitions on government interference to apply only to competent authorities acting without presidential or Union Government order, permission or warrant. The same amendment is reported to have narrowed Section 10 criminal liability on the same basis. No material development in Myanmar's data-protection or cybersecurity regulation is reported within the 180 days preceding this cycle, with the most recent substantive development remaining the Cybersecurity Law's 30 July 2025 entry into force.

Confidence across nearly all of these findings is capped at a qualified register, since most rest on single-source secondary compilations without independent corroboration.

Cross-Monitor Connections

Outlook

Outlook

Myanmar's overall regulatory risk posture is assessed as high and tightening, driven by the reinstated suspension of core Privacy Law protections and the newly-in-force Cybersecurity Law licensing and VPN-approval regime, against a backdrop of no dedicated data protection authority or omnibus statute. This baseline is sourced entirely from secondary-compilation and challenger-supplied sources, with no official Burmese-language gazette or regulator-portal primary text independently retrieved; military-regime jurisdictions with non-English-primary-source legal texts are flagged as a systematic under-indexing risk for this monitor.

Standing brief · as of 25 August 2026

Regulatory Status

The 2017 Law Protecting the Privacy and Security of Citizens nominally remains the principal statutory basis for privacy and communications-security protection, but its core provisions in Sections 5, 7 and 8 were suspended by a February 2021 NDSC/SAC amendment, and that suspension was formally reinstated in August 2025. Myanmar is understood to lack a general, omnibus data protection authority. Its personal-data scope appears to be delineated through sector-specific statutes, including the Telecommunications Law of 2013 and the Financial Institutions Law of 2016, rather than a unitary omnibus definition. The jurisdiction is also understood to lack a general controller-registration or filing regime. The Financial Institutions Law is understood to mandate that regulated financial institutions protect customer information, reported as the only concrete general security-of-processing duty identified for the jurisdiction. Myanmar is understood to impose no general-purpose DPIA, DPO-appointment, ROPA, or breach-notification obligations on controllers outside that sectoral duty. The Telecommunications Law is understood to address confidentiality of personal information handled by telecommunications service providers. The amended Electronic Transactions Law is understood to have introduced provisions on the protection of personal data, effective 15 February 2021. A Cybersecurity Law is reported to have entered into force on 30 July 2025, introducing a licensing regime for cybersecurity-service providers and digital-platform operators alongside a requirement for Ministry approval before VPN use. The 2025 Cybersecurity Law is reported to impose Ministry-approval licensing requirements on VPN use and on cybersecurity-service and digital-platform operators exceeding 100,000 users, with licences valid for three to ten years, and criminal penalties for non-compliance. A 2020 amendment to the Privacy Law is reported to have narrowed Section 8's prohibitions on government interference to apply only to competent authorities acting without presidential or Union Government order, permission or warrant. The same amendment is reported to have narrowed Section 10 criminal liability to apply only to competent authorities committing offences under Sections 7 or 8. Violations of Sections 7 or 8 of the Privacy Law are reported to carry imprisonment of six months to three years and a fine of MMK 300,000 to 1.5 million, with liability narrowed by a 2020 amendment to apply only to 'competent authorities.' The 2025 Cybersecurity Law is reported to provide criminal penalties for operating unlicensed cybersecurity services or digital platforms and for unauthorized VPN use. No material development in Myanmar's data-protection or cybersecurity regulation is reported within the 180 days preceding this cycle, with the most recent substantive development remaining the Cybersecurity Law's 30 July 2025 entry into force.

Outlook