Myanmar

Myanmar has no omnibus data protection statute and no dedicated general data protection authority. Privacy-related obligations instead arise from a patchwork of the 2008 Constitution, the Law Protecting the Privacy and Security of Citizens (2017, amended 2020), the amended Electronic Transactions Law (2021), and the newly enacted Cybersecurity Law (2025, effective 30 July 2025), overlaid with sectoral statutes (Telecommunications Law 2013, Financial Institutions Law 2016). A January 2023 draft cybersecurity bill previously circulated by the Ministry of Transport and Communications appears to have culminated in the 2025 Cybersecurity Law, though independent confirmation of textual continuity between the draft and the enacted law was not obtained.

No enumerated lawful-basis framework, consent-standard regime, special/sensitive-category classification, or statutory pseudonymisation/anonymisation safe-harbour was identified for Myanmar. This module is emitted as a gap module consistent with the absence of an omnibus statute.

No general subject-access, rectification/erasure, restriction/objection, portability, or statutory response-deadline framework was identified for data subjects in Myanmar outside the narrow privacy/communications-security protections of the 2017/2020 Privacy Law.

Outside a sector-specific customer-information-protection duty under the Financial Institutions Law 2016, Myanmar has no general accountability principle, DPIA trigger, DPO-appointment threshold, ROPA requirement, joint-controller framework, breach-notification regime, or statutory retention/disposal duty.

No adequacy decisions have been received from or granted to other regimes, no SCC/BCR framework is codified, no transfer-impact-assessment obligation exists, and no explicit data-localisation mandate was identified for Myanmar. The 2025 Cybersecurity Law's VPN-approval and platform-licensing requirements function as digital-sovereignty-adjacent controls but do not constitute a formal data-transfer or localisation regime.

Sectoral overlays are the primary source of enforceable data-protection-adjacent duties in Myanmar: the Financial Institutions Law 2016 for banking customer information, the Telecommunications Law 2013 for subscriber confidentiality, and the 2025 Cybersecurity Law for digital-platform/VPN licensing. No dedicated health, employment, credit-scoring, education, or insurance data rules were identified.

No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, cross-context-advertising regime, or direct-marketing consent/suppression framework was identified for Myanmar.

No profiling restriction, ADM-transparency right, AI-specific risk-assessment regime, biometric-data regime, or genetic-data regime was identified. State-surveillance carve-outs are, however, evidenced: the 2020 amendment to the Privacy Law narrowed the scope of protection against government interference by confining Section 8 obligations and Section 10 criminal liability to 'competent authorities' acting under presidential/Union Government order, permission, or warrant, and the National Defence and Security Council (NDSC) separately issued an amendment law expanding authority to restrict constitutional rights during martial law.

No age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adults protection was identified for Myanmar in any reviewed source.

Enforcement is criminal/administrative and sector-specific rather than centralised in a data protection authority. The Privacy Law imposes imprisonment and fines for violations of its confidentiality/interference provisions (as narrowed to 'competent authorities' by the 2020 amendment), and the 2025 Cybersecurity Law imposes criminal penalties for unlicensed cybersecurity-service/digital-platform operation and unauthorized VPN use. No enforcement-activity index, dedicated regulator funding/capacity data, collective-redress mechanism, or private right of action was identified. No material Myanmar DP/cybersecurity development was confirmed within the 180 days preceding this run (February-August 2026); the most recent substantive development remains the 30 July 2025 entry into force of the Cybersecurity Law.