--- title: "Myanmar Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/myanmar/ source_html: /jurisdictions/myanmar/index.html description: "Myanmar data protection and privacy regulation: 10 categories, 21 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 905af5a7e2d408892bbd49bfc9ea5663281ddcd241629f8e9ab6836c99fdbfea generator: "fe-fleet/md-twin@1.0" --- # Myanmar Data Protection & Privacy Regulation | Data Protection Monitor Based mainly on secondary sources. Only 1 of the sources retrieved for this jurisdiction is official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved. # Myanmar Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/myanmar/), [World Payments](https://payments.gi/jurisdictions/myanmar/), artificial-intelligence, [Crypto](https://cryptoassets.gi/jurisdictions/myanmar/) Last updated 2026-10-25 · 10 categories · 21 claims · 10 sources in the cumulative register Download report (PDF) Expand all Myanmar's 2017 Law Protecting the Privacy and Security of Citizens is the jurisdiction's principal privacy statute. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: Lawful Processing & Special Data, Data Subject Rights, Cross-Border & Adequacy, AdTech & Commercial Privacy, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework (9 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=MYANMAR)[Build Report](/reports/?j=MYANMAR)[Compare](/compare/?j=MYANMAR) Framework posture Unregulated gap 5 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Ministry of Transport and Communications Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 5 / 10 modules assessed 0 Confirmed · 4 Probable · 1 Uncertain · 5 Not yet assessed 10 Categories 4 Red categories 57 Sub-modules 21 Claims 0 Tier-1 sources Traffic-light mix 4 red 5 n/a 1 amber (sums to 10 rendered categories; click to filter) 4 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 1,211 Full executive summary 1,015 ###### Latest update · 25 October 2026 #### Lead Signal Myanmar's 2017 Law Protecting the Privacy and Security of Citizens is the jurisdiction's principal privacy statute. Its core protections in Sections 5, 7 and 8, covering warrantless search, arrest and communications surveillance, were suspended by a February 2021 NDSC/SAC amendment, and this suspension was formally reinstated in August 2025. The correction was surfaced through the challenger fold process rather than the original baseline research. #### Other Developments Myanmar is understood to lack a general, omnibus data protection authority. Its personal-data scope appears to be delineated through sector-specific statutes, including the Telecommunications Law of 2013 and the Financial Institutions Law of 2016, rather than a unitary omnibus definition. The Telecommunications Law is understood to address confidentiality of personal information handled by telecommunications service providers. The Financial Institutions Law is understood to mandate that regulated financial institutions protect customer information, reported as the only concrete general security-of-processing duty identified for the jurisdiction. Myanmar is understood to impose no general-purpose DPIA, DPO-appointment, ROPA, or breach-notification obligations on controllers outside that sectoral duty. The jurisdiction is also understood to lack a general controller-registration or filing regime. The amended Electronic Transactions Law is understood to have introduced provisions on the protection of personal data, effective 15 February 2021. A Cybersecurity Law is reported to have entered into force on 30 July 2025, introducing a licensing regime for cybersecurity-service providers and digital-platform operators alongside a requirement for Ministry approval before VPN use. That licensing regime is reported to apply to platforms and services exceeding 100,000 users, with licences valid for three to ten years. Non-compliance, including unlicensed operation or unauthorized VPN use, is reported to carry criminal penalties under the same law. Separately, violations of Sections 7 or 8 of the Privacy Law are reported to carry imprisonment of six months to three years and a fine of MMK 300,000 to 1.5 million, with liability narrowed by a 2020 amendment to apply only to 'competent authorities.' That 2020 amendment is reported to have narrowed Section 8's prohibitions on government interference to apply only to competent authorities acting without presidential or Union Government order, permission or warrant. The same amendment is reported to have narrowed Section 10 criminal liability on the same basis. No material development in Myanmar's data-protection or cybersecurity regulation is reported within the 180 days preceding, with the most recent substantive development remaining the Cybersecurity Law's 30 July 2025 entry into force. Confidence across nearly all of these findings is capped at a qualified register, since most rest on secondary compilations without independent corroboration. #### Cross-Monitor Connections The Financial Institutions Law's customer-information duty is flagged for the financial-integrity monitor's illicit-finance and AML-CFT risk assessment of Myanmar, and for the world-payments monitor as a payments-adjacent sectoral duty. The Cybersecurity Law's VPN-approval and platform-licensing regime is flagged for the crypto monitor as a control that may affect exchanges or platforms serving Myanmar users. It is also flagged for the artificial-intelligence monitor, given the absence of any AI-specific risk-assessment or automated-decision-making transparency regime in Myanmar, against a backdrop of broader regional ASEAN AI-governance developments tracked elsewhere. #### Outlook Myanmar's regulatory trajectory is assessed as tightening, driven by the reinstated suspension of core Privacy Law protections and the newly-in-force Cybersecurity Law licensing regime. Both developments point toward an operating environment of expanding state control over communications and platform access, layered onto a jurisdiction that still lacks a general data protection statute or authority. The baseline rests entirely on secondary-compilation and challenger-supplied sources rather than official Burmese-language primary text, a gap the monitor flags for verification in future cycles. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Myanmar's 2017 Law Protecting the Privacy and Security of Citizens is the jurisdiction's principal privacy statute. Its core protections in Sections 5, 7 and 8, covering warrantless search, arrest and communications surveillance, were suspended by a February 2021 NDSC/SAC amendment, and this suspension was formally reinstated in August 2025. The correction was surfaced through this cycle's challenger fold process rather than the original baseline research. #### Other Developments Separately, violations of Sections 7 or 8 of the Privacy Law are reported to carry imprisonment of six months to three years and a fine of MMK 300,000 to 1.5 million, with liability narrowed by a 2020 amendment to apply only to 'competent authorities.' That 2020 amendment is reported to have narrowed Section 8's prohibitions on government interference to apply only to competent authorities acting without presidential or Union Government order, permission or warrant. The same amendment is reported to have narrowed Section 10 criminal liability on the same basis. No material development in Myanmar's data-protection or cybersecurity regulation is reported within the 180 days preceding this cycle, with the most recent substantive development remaining the Cybersecurity Law's 30 July 2025 entry into force. Confidence across nearly all of these findings is capped at a qualified register, since most rest on single-source secondary compilations without independent corroboration. #### Cross-Monitor Connections #### Outlook Read full brief · 1211 words ###### Latest update · 25 October 2026 #### Regulatory Status The 2017 Law Protecting the Privacy and Security of Citizens nominally remains the principal statutory basis for privacy and communications-security protection, but its core provisions in Sections 5, 7 and 8 were suspended by a February 2021 NDSC/SAC amendment, and that suspension was formally reinstated in August 2025. Myanmar is understood to lack a general, omnibus data protection authority. Its personal-data scope appears to be delineated through sector-specific statutes, including the Telecommunications Law of 2013 and the Financial Institutions Law of 2016, rather than a unitary omnibus definition. The jurisdiction is also understood to lack a general controller-registration or filing regime. The Financial Institutions Law is understood to mandate that regulated financial institutions protect customer information, reported as the only concrete general security-of-processing duty identified for the jurisdiction. Myanmar is understood to impose no general-purpose DPIA, DPO-appointment, ROPA, or breach-notification obligations on controllers outside that sectoral duty. The Telecommunications Law is understood to address confidentiality of personal information handled by telecommunications service providers. The amended Electronic Transactions Law is understood to have introduced provisions on the protection of personal data, effective 15 February 2021. A Cybersecurity Law is reported to have entered into force on 30 July 2025, introducing a licensing regime for cybersecurity-service providers and digital-platform operators alongside a requirement for Ministry approval before VPN use. The 2025 Cybersecurity Law is reported to impose Ministry-approval licensing requirements on VPN use and on cybersecurity-service and digital-platform operators exceeding 100,000 users, with licences valid for three to ten years, and criminal penalties for non-compliance. A 2020 amendment to the Privacy Law is reported to have narrowed Section 8's prohibitions on government interference to apply only to competent authorities acting without presidential or Union Government order, permission or warrant. The same amendment is reported to have narrowed Section 10 criminal liability to apply only to competent authorities committing offences under Sections 7 or 8. Violations of Sections 7 or 8 of the Privacy Law are reported to carry imprisonment of six months to three years and a fine of MMK 300,000 to 1.5 million, with liability narrowed by a 2020 amendment to apply only to 'competent authorities.' The 2025 Cybersecurity Law is reported to provide criminal penalties for operating unlicensed cybersecurity services or digital platforms and for unauthorized VPN use. No material development in Myanmar's data-protection or cybersecurity regulation is reported within the 180 days preceding, with the most recent substantive development remaining the Cybersecurity Law's 30 July 2025 entry into force. #### Outlook Myanmar's overall regulatory risk posture is assessed as high and tightening, driven by the reinstated suspension of core Privacy Law protections and the newly-in-force Cybersecurity Law licensing and VPN-approval regime, against a backdrop of no dedicated data protection authority or omnibus statute. This baseline is sourced entirely from secondary-compilation and challenger-supplied sources, with no official Burmese-language gazette or regulator-portal primary text independently retrieved; military-regime jurisdictions with non-English-primary-source legal texts are flagged as a systematic under-indexing risk for this monitor. ###### Standing brief · as of 25 August 2026 #### Regulatory Status The 2017 Law Protecting the Privacy and Security of Citizens nominally remains the principal statutory basis for privacy and communications-security protection, but its core provisions in Sections 5, 7 and 8 were suspended by a February 2021 NDSC/SAC amendment, and that suspension was formally reinstated in August 2025. Myanmar is understood to lack a general, omnibus data protection authority. Its personal-data scope appears to be delineated through sector-specific statutes, including the Telecommunications Law of 2013 and the Financial Institutions Law of 2016, rather than a unitary omnibus definition. The jurisdiction is also understood to lack a general controller-registration or filing regime. The Financial Institutions Law is understood to mandate that regulated financial institutions protect customer information, reported as the only concrete general security-of-processing duty identified for the jurisdiction. Myanmar is understood to impose no general-purpose DPIA, DPO-appointment, ROPA, or breach-notification obligations on controllers outside that sectoral duty. The Telecommunications Law is understood to address confidentiality of personal information handled by telecommunications service providers. The amended Electronic Transactions Law is understood to have introduced provisions on the protection of personal data, effective 15 February 2021. A Cybersecurity Law is reported to have entered into force on 30 July 2025, introducing a licensing regime for cybersecurity-service providers and digital-platform operators alongside a requirement for Ministry approval before VPN use. The 2025 Cybersecurity Law is reported to impose Ministry-approval licensing requirements on VPN use and on cybersecurity-service and digital-platform operators exceeding 100,000 users, with licences valid for three to ten years, and criminal penalties for non-compliance. A 2020 amendment to the Privacy Law is reported to have narrowed Section 8's prohibitions on government interference to apply only to competent authorities acting without presidential or Union Government order, permission or warrant. The same amendment is reported to have narrowed Section 10 criminal liability to apply only to competent authorities committing offences under Sections 7 or 8. Violations of Sections 7 or 8 of the Privacy Law are reported to carry imprisonment of six months to three years and a fine of MMK 300,000 to 1.5 million, with liability narrowed by a 2020 amendment to apply only to 'competent authorities.' The 2025 Cybersecurity Law is reported to provide criminal penalties for operating unlicensed cybersecurity services or digital platforms and for unauthorized VPN use. No material development in Myanmar's data-protection or cybersecurity regulation is reported within the 180 days preceding this cycle, with the most recent substantive development remaining the Cybersecurity Law's 30 July 2025 entry into force. #### Outlook Read full brief · 1015 words Key regulatory facts for Myanmar Regulatory Dimension Myanmar Standing Position Jurisdiction Myanmar (MM) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 21 sourced findings) Regulator & Framework No comprehensive DP statute and no general supervisory authority exist; regulatory coverage is fragmented and sector-driven. Lawful Processing & Special Data No lawful-bases, consent, special-category, or anonymisation regime found across searched sources. Data Subject Rights No omnibus data-subject-rights regime exists; the Privacy Law addresses communications privacy but not GDPR-style subject rights. Controller/Processor Duties Only a narrow sectoral security duty exists; no general controller/processor accountability framework is in force. Primary Instruments Cited OneTrust DataGuidance, IAPP, Myanmar Official Instrument (dlapiperdataprotection.com guide-pdf-c-MM), DLA Piper, OneTrust DataGuidance Last Confirmed / Updated 2026-10-25 (10 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Myanmar: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ No comprehensive DP statute and no general supervisory authority exist; regulatory coverage is fragmented and sector-driven. Primary framework No omnibus data protection statute; operative instruments are the Law Protecting the Privacy and Security of Citizens (Union Parliament Law 5/2017, amended 2020), the amended Electronic Transactions Law (SAC Law 7/2021), and the Cybersecurity Law (2025). Traffic-light rationale — Red No comprehensive DP statute and no general supervisory authority exist; regulatory coverage is fragmented and sector-driven. #### Sub-modules (5) #### Regulator And AuthorityRed There is no general data protection authority in Myanmar; oversight functions are dispersed across the Ministry of Transport and Communications (cybersecurity/telecoms), the Central Bank of Myanmar (financial-sector customer data), and general law-enforcement/judicial bodies for privacy-law offences. Claims (2): - Myanmar has no general/omnibus data protection authority; regulatory oversight of personal data is fragmented across sectoral ministries and regulators. - Ministry of Transport and Communications (MOTC) — There is no general data protection law in Myanmar and no independent supervisory authority; adjacent competence sits with MOTC. #### Act And InstrumentsAmber The principal instruments are the 2017/2020 Privacy Law, the 2021-amended Electronic Transactions Law, and the 2025 Cybersecurity Law. Claims (4): - The Constitution of the Republic of the Union of Myanmar 2008 and the Law Protecting the Privacy and Security of Citizens (Union Parliament Law 5/2017), as amended in 2020, provide the principal non-comprehensive statutory basis for privacy and communications-security protection in Myanmar. - The amended Electronic Transactions Law (State Administration Council Law 7/2021), effective 15 February 2021, introduced provisions on the protection of personal data. - Myanmar's Cybersecurity Law, enacted in 2025, entered into force on 30 July 2025 and introduces a licensing regime for cybersecurity-service providers and digital-platform operators, together with mandatory Ministry approval for VPN use. - Myanmar sectoral legal patchwork — Data protection obligations derive from sectoral laws: Financial Institutions Law (2016), Telecommunications Law (2013), Competition Law (2015), Law Protecting the Privacy and Security of Citizens (2017), Law Relating to Private Health Care Services (2007), Electronic Transactions Law (2004, amended 2021), Cybersecurity Law (2025). #### Material ScopeAmber Material scope of personal-data protection is defined sector-by-sector rather than through a unitary definition. Claims (1): - In the absence of a unitary omnibus definition, the material scope of personal-data protection in Myanmar is delineated through sector-specific statutes, including the Telecommunications Law 2013 and the Financial Institutions Law 2016. #### Territorial ScopeRed No explicit extraterritorial/territorial-scope provision applicable to non-established controllers has been identified in currently available secondary sources. #### Regulator Registration And FilingRed No general controller registration or filing regime exists absent an omnibus statute or general regulator. Claims (1): - No general controller-registration or filing regime exists in Myanmar in the absence of an omnibus data protection law or general regulator. Myanmar has no omnibus data protection statute and no dedicated general data protection authority. Privacy-related obligations instead arise from a patchwork of the 2008 Constitution, the Law Protecting the Privacy and Security of Citizens (2017, amended 2020), the amended Electronic Transactions Law (2021), and the newly enacted Cybersecurity Law (2025, effective 30 July 2025), overlaid with sectoral statutes (Telecommunications Law 2013, Financial Institutions Law 2016). A January 2023 draft cybersecurity bill previously circulated by the Ministry of Transport and Communications appears to have culminated in the 2025 Cybersecurity Law, though independent confirmation of textual continuity between the draft and the enacted law was not obtained. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (8) - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/myanmar?article_type=news_post) — Myanmar has no general/omnibus data protection authority; regulatory oversight of personal data is fragmented across sectoral ministries and regulators. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/myanmar?article_type=news_post) — The Constitution of the Republic of the Union of Myanmar 2008 and the Law Protecting the Privacy and Security of Citizens (Union Parliament Law 5/2017), as amended in 2020, provide the principal non-comprehensive statutory basis for privacy and communications-security protection in Myanmar. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/myanmar?article_type=news_post) — The amended Electronic Transactions Law (State Administration Council Law 7/2021), effective 15 February 2021, introduced provisions on the protection of personal data. - [IAPP](https://iapp.org/news/a/notes-from-the-asia-pacific-region-check-up-reveals-new-prescriptions-for-compliance) — Myanmar's Cybersecurity Law, enacted in 2025, entered into force on 30 July 2025 and introduces a licensing regime for cybersecurity-service providers and digital-platform operators, together with mandatory Ministry approval for VPN use. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/myanmar?article_type=news_post) — In the absence of a unitary omnibus definition, the material scope of personal-data protection in Myanmar is delineated through sector-specific statutes, including the Telecommunications Law 2013 and the Financial Institutions Law 2016. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/myanmar?article_type=news_post) — No general controller-registration or filing regime exists in Myanmar in the absence of an omnibus data protection law or general regulator. - [https://www.dlapiperdataprotection.com/guide.pdf?c=MM](https://www.dlapiperdataprotection.com/guide.pdf?c=MM) — Ministry of Transport and Communications (MOTC) — There is no general data protection law in Myanmar and no independent supervisory authority; adjacent competence sits with MOTC. - [https://www.dlapiperdataprotection.com/guide.pdf?c=MM](https://www.dlapiperdataprotection.com/guide.pdf?c=MM) — Myanmar sectoral legal patchwork — Data protection obligations derive from sectoral laws: Financial Institutions Law (2016), Telecommunications Law (2013), Competition Law (2015), Law Protecting the Privacy and Security of Citizens (2017), Law Relating to Private Health Care Services (2007), Electronic Transactions Law (2004, amended 2021), Cybersecurity Law (2025). ### Myanmar: D2 Lawful Processing & Special Data 4 sub-modules Not assessed ▾ No lawful-bases, consent, special-category, or anonymisation regime found across searched sources. Traffic-light rationale — Not assessed No lawful-bases, consent, special-category, or anonymisation regime found across searched sources. #### Sub-modules (4) #### Lawful BasesRed No enumerated lawful bases regime identified. #### Consent ThresholdsRed No statutory consent-standard definition identified. #### Special CategoriesRed No special/sensitive-category data regime identified. #### Pseudonymisation And AnonymisationRed No pseudonymisation/anonymisation definitions or safe-harbours identified. No enumerated lawful-basis framework, consent-standard regime, special/sensitive-category classification, or statutory pseudonymisation/anonymisation safe-harbour was identified for Myanmar. This module is emitted as a gap module consistent with the absence of an omnibus statute. ### Myanmar: D3 Data Subject Rights 5 sub-modules Not assessed ▾ No omnibus data-subject-rights regime exists; the Privacy Law addresses communications privacy but not GDPR-style subject rights. Traffic-light rationale — Not assessed No omnibus data-subject-rights regime exists; the Privacy Law addresses communications privacy but not GDPR-style subject rights. #### Sub-modules (5) #### Access RightRed No general right of access to personal data identified. #### Rectification And ErasureRed No general rectification/erasure right identified. #### Restriction And ObjectionRed No restriction/objection right (including profiling opt-out) identified. #### Data PortabilityRed No portability right identified. #### Deadlines And Response WindowsRed No statutory controller-response deadlines identified. No general subject-access, rectification/erasure, restriction/objection, portability, or statutory response-deadline framework was identified for data subjects in Myanmar outside the narrow privacy/communications-security protections of the 2017/2020 Privacy Law. ### Myanmar: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only a narrow sectoral security duty exists; no general controller/processor accountability framework is in force. Primary framework Financial Institutions Law 2016 (sectoral security-of-customer-information duty only). Traffic-light rationale — Red Only a narrow sectoral security duty exists; no general controller/processor accountability framework is in force. D4 · Controller & Processor — Full Module Record 7 sub-modules · 31 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Myanmar: D5 Cross-Border & Adequacy 6 sub-modules Not assessed ▾ No cross-border transfer mechanism, adequacy arrangement, or localisation statute identified. Traffic-light rationale — Not assessed No cross-border transfer mechanism, adequacy arrangement, or localisation statute identified. #### Sub-modules (6) #### Transfer MechanismsRed No codified transfer mechanism (adequacy, SCCs, BCRs, derogations) identified. #### Adequacy ReceivedRed No adequacy decision received from another regime identified. #### Adequacy GrantedRed No adequacy decision granted to another regime identified. #### Sccs And BcrsRed No SCC or BCR uptake/forms identified. #### Transfer Impact AssessmentRed No TIA requirement identified. #### Data LocalisationRed No absolute or partial data-localisation mandate identified beyond VPN/platform-licensing controls under the 2025 Cybersecurity Law. No adequacy decisions have been received from or granted to other regimes, no SCC/BCR framework is codified, no transfer-impact-assessment obligation exists, and no explicit data-localisation mandate was identified for Myanmar. The 2025 Cybersecurity Law's VPN-approval and platform-licensing requirements function as digital-sovereignty-adjacent controls but do not constitute a formal data-transfer or localisation regime. ### Myanmar: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Meaningful sectoral coverage exists for financial and telecoms/cyber, but health, employment, credit-scoring, education, and insurance sub-modules are unpopulated. Primary framework Telecommunications Law 2013; Financial Institutions Law 2016; Cybersecurity Law 2025. Supervisory authority Ministry of Transport and Communications Traffic-light rationale — Amber Meaningful sectoral coverage exists for financial and telecoms/cyber, but health, employment, credit-scoring, education, and insurance sub-modules are unpopulated. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 48 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Myanmar: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ No adtech/commercial-privacy regulation identified in any searched source. Traffic-light rationale — Not assessed No adtech/commercial-privacy regulation identified in any searched source. #### Sub-modules (6) #### Cookies And TrackersRed No cookie/tracker consent law identified. #### Dark PatternsRed No dark-pattern prohibition identified. #### Opt Out SignalsRed No opt-out-signal (GPC/DAA-equivalent) recognition identified. #### Clean Rooms And DcrRed No clean-room/data-collaboration-room rules identified. #### Cross Context AdvertisingRed No cross-context-advertising ('sale'/'share') regime identified. #### Direct MarketingRed No direct-marketing consent/suppression framework identified. No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, cross-context-advertising regime, or direct-marketing consent/suppression framework was identified for Myanmar. ### Myanmar: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ The only substantive content in this module concerns broadened state-surveillance carve-outs; ADM, biometric, genetic, and AI-risk-assessment sub-modules are unpopulated. Primary framework Law Protecting the Privacy and Security of Citizens (2017, as amended 2020). Traffic-light rationale — Red The only substantive content in this module concerns broadened state-surveillance carve-outs; ADM, biometric, genetic, and AI-risk-assessment sub-modules are unpopulated. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 78 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Myanmar: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No children/vulnerable-groups data protection regime identified. Traffic-light rationale — Not assessed No children/vulnerable-groups data protection regime identified. #### Sub-modules (5) #### Age VerificationRed No age-verification requirement identified. #### Parental ConsentRed No parental-consent mechanism identified. #### Minor Profiling BansRed No minor-profiling ban identified. #### Education SettingsRed No education-settings-specific rule identified. #### Dependent AdultsRed No dependent-adults protection identified. No age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adults protection was identified for Myanmar in any reviewed source. ### Myanmar: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Enforcement powers are narrow, sector/criminal-law based, and there is no dedicated DP regulator, enforcement-activity index, or private right of action. Primary framework Law Protecting the Privacy and Security of Citizens (2017, amended 2020); Cybersecurity Law (2025). Traffic-light rationale — Red Enforcement powers are narrow, sector/criminal-law based, and there is no dedicated DP regulator, enforcement-activity index, or private right of action. Periodic update · new data 2026-10-25 #### Enforcement & Redress Violations of Sections 7 or 8 of the Privacy Law are reported to carry imprisonment of six months to three years and a fine of MMK 300,000 to 1.5 million, with liability narrowed by a 2020 amendment to apply only to 'competent authorities.' The 2025 Cybersecurity Law is reported to provide criminal penalties for operating unlicensed cybersecurity services or digital platforms and for unauthorized VPN use. No material development in Myanmar's data-protection or cybersecurity regulation is reported within the 180 days preceding, with the most recent substantive development remaining the Cybersecurity Law's 30 July 2025 entry into force. #### Outlook Criminal penalties exist under both the Privacy Law and the 2025 Cybersecurity Law, but are administered through general courts and ministries rather than a dedicated data protection authority, and no enforcement-activity index or collective-redress mechanism has been identified. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 100 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (34 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties