Recent Developments on Myanmar’s Cybersecurity and Citizens Privacy Law

Cybersecurity Law No. 1/2025 officially came into force on July 30 after being enacted by the military-led State Administrative Council (SAC) in January. State media framed the law’s commencement as a measure to protect national cyber stability and sovereignty in the face of growing cyber threats and to bolster control over digital activities. Simultaneously, the military-led National Defense and Security Council (NDSC), pushed through an amendment to the 2017 Law Protecting the Privacy and Security of Citizens, suspending key provisions (Sections 5, 7, and 8) that had previously safeguarded citizens against warrantless searches, surveillance, and prolonged detention. This has effectively nullified legal privacy protections for the duration of the ongoing emergency rule, concentrating broad powers in the authorities’ hands under the banner of cybersecurity and public order. 

Since the Cybersecurity Law took effect, enforcement on the ground has visibly tightened, and even citizens abroad can be prosecuted for online violations. In Mandalay and other cities, military patrols have begun stopping people to inspect smartphones for banned VPN apps or social media usage, a new layer of intrusive monitoring directly enabled by the law’s anti-VPN provisions. Residents report that police and military checkpoints now demand access to devices, with alleged false accusations of VPN concealment. Further, authorities have deployed additional high-tech surveillance tools, notably leveraging a Chinese-backed “Person Scrutinization and Monitoring System” (PSMS) to cross-check IDs and track individuals in real time. Digital rights groups like the Myanmar Internet Project warn that the Cybersecurity Law enables sweeping surveillance and censorship, allowing the military “legal cover” to monitor user data, block websites, and punish any online dissent under broad pretexts. These concerns are heightened as the December general elections draw near.   

Members should note that Myanmar’s new Cybersecurity Law requires government approval for VPN services and licensing for digital platforms with over 100,000 users or cybersecurity providers. It introduces two types of licenses for Cybersecurity services and Digital platform providers, valid for 3–10 years. Failure to comply may result in fines of at least MMK 100 million (approximately USD 47,600), and any proceeds from violations will be confiscated.