Cybersecurity law & regulation in Myanmar (2026)
Cybersecurity in Myanmar: comprehensive law.
Myanmar enacted a comprehensive Cybersecurity Law on 1 January 2025 (SAC Law No. 1/2025), which came fully into force on 30 July 2025. The law, spanning 16 chapters and 88 sections, regulates cybersecurity service providers, digital platform operators, VPN services, and critical information infrastructure, and applies extraterritorially to any entity serving users in Myanmar. It imposes licensing, incident-reporting, data-retention, and content-moderation obligations, with criminal and financial penalties for non-compliance.
Legal framework
Cybersecurity Law (State Administration Council Law No. 1/2025), enacted 1 January 2025, in force 30 July 2025; administered by a Central Cybersecurity Committee under the SAC and overseen by the Ministry of Transport and Communications
Key points: cybersecurity in Myanmar
Governing structure
The law establishes a Central Cybersecurity Committee (CCC) chaired by a Vice-President, with a Steering Committee beneath it assigning duties to relevant ministries. The Ministry of Transport and Communications is the primary operational regulator.
Licensing obligations
Cybersecurity service providers and digital platform operators with more than 100,000 users in Myanmar must register under the Myanmar Companies Act and obtain a ministry-issued licence valid for 3-10 years. Foreign entities serving Myanmar users are equally covered.
Incident reporting & breach notification
Cybersecurity service providers must immediately notify the relevant Department of any detected cybersecurity anomalies and advise affected customers on preventive action. All covered organisations must submit annual cybersecurity reports to the Steering Committee and maintain an Emergency Cybersecurity Incident Monitoring and Response Team.
Critical information infrastructure (CII)
Sectors designated as CII, including national defence, government services, finance, healthcare, and energy, must develop cybersecurity plans, form incident-response teams, and report annually. Additional sectoral requirements can be imposed by the Steering Committee.
Data retention & content obligations
Digital platforms with 100,000+ Myanmar users must retain user personal data and activity logs for up to three years and disclose them to authorities on request. Platforms must also prevent dissemination of content deemed 'destabilizing' or 'misinformation', raising significant freedom-of-expression concerns.
VPN & penalties
Section 44 requires prior Ministry approval to establish or provide VPN services; unauthorised VPN use is prohibited. Penalties range from MMK 1-10 million for unlicensed cybersecurity services (plus 1-6 months imprisonment) to a minimum MMK 100 million fine for unregistered large-scale digital platforms.
Sources
- moi.gov.mm/moi:eng/news/16633
- moi.gov.mm/moi:eng/news/16656
- dfdl.com/insights/content-hub/articles/myanmar-cybersecurity-law-effective-fro
- connectontech.bakermckenzie.com/myanmar-cybersecurity-law-enacted-on-1-january-2025/
- hoganlovells.com/en/publications/myanmars-cybersecurity-law-comes-into-effect-key-impl
- tilleke.com/insights/myanmar-cybersecurity-law-takes-effect/
- allenandgledhill.com/mm/publication/articles/31053/cybersecurity-law-in-force-30-july-2025
- vdb-loi.com/mm_publications/cyber-security-law-2025-establishes-a-framework-for-d
- dfdl.com/insights/content-hub/articles/myanmar-cybersecurity-law-2025-key-insi
Next for Myanmar: Starting a BusinessRestricted
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026