You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 1, 2025

Myanmar Cybersecurity Law Takes Effect

Subscribe to Updates

On July 30, 2025, Myanmar’s Cybersecurity Law No. 1/2025 came into effect with the State Administration Council’s issuance of Notification 113/2025. The law, which was enacted on January 1, 2025, aims to regulate various aspects of digital security and online activities.

Below are some key provisions, implications, and penalties under the Cybersecurity Law.

  • Extraterritorial penalties. The law contains an important provision that authorizes penalties against Myanmar citizens who are found guilty of violations, even if these occur outside the country’s borders.
  • VPN definition and regulation. Virtual private networks (VPNs) are defined by this law as specific systems that function as backup networks by using technological means in order to ensure the safety of linking networks to each other. This definition sets the framework for subsequent regulations and penalties associated with VPN usage. The law does not restrict individuals or entities from using VPNs; it regulates VPN service providers.
  • Penalties for unapproved VPN services. Establishing a VPN or providing VPN services without approval from the designated ministry (to be appointed later by the government) can result in significant penalties. For individuals, the punishment may be imprisonment for 1–6 months, a fine of MMK 1–10 million (approx. USD 476–4,760), or both, with the proceeds of the violation being confiscated. If the violator is a company or organization, the minimum fine will be MMK 10 million, and the proceeds will be confiscated.
  • Government oversight. The ministry designated by the government is authorized to investigate and take control of cybersecurity services and digital platform services for national defense and security purposes, or upon request from a government department or organization in accordance with respective laws.
  • Licensing requirements. The Cybersecurity Law introduces two types of licenses, valid for a period of 3–10 years, for (1) cybersecurity services and (2) digital platform providers. Digital platforms with over 100,000 users are required to apply for the latter license. Noncompliance with this requirement will be subject to a fine of at least MMK 100 million (approx. USD 47,600), and any proceeds resulting from the violation will be confiscated.
  • Penalties for unsolicited communications. Individuals who transmit unwanted and unsolicited messages, emails, or data via a network will be subject to imprisonment for 1–2 years, a fine of MMK 5–20 million (approx. USD 2,380–9,530), or both.
  • Penalties for cyber misuse. Engaging in cyber misuse—including the alteration, deletion, or sale of computer programs or data, as well as the unauthorized control and execution of computer systems, programs, or electronic data—will be subject to imprisonment from 6 months to 3 years, a fine of MMK 1–20 million (approx. USD 476–9,530), or both.
  • Penalties for online theft or mischief. Committing or inciting others to commit online theft or mischief using cyber resources will be subject to imprisonment for 2–7 years and the possibility of additional fines.
  • Penalties for unapproved online gambling. Operating an online gambling system without proper authorization may result in imprisonment for 6 months to 1 year, a fine of MMK 5–20 million (approx. USD 2,380–9,530), or both, with the proceeds from such activities being confiscated. If the offender is a corporation or organization, the minimum fine is MMK 20 million, and the illicit proceeds will also be confiscated. The law does not address how online gambling platforms can obtain official approval.

Myanmar’s Cybersecurity Law represents a significant step in the country’s regulation and oversight of digital security and online activities. Businesses, digital platform providers, cybersecurity service providers, and VPN providers need to understand these requirements and ensure compliance to prevent substantial penalties.

Nonetheless, given that services such as VPNs are very widely used, it remains to be seen how these new far-reaching regulations will actually be enforced.

 

This article was prepared with the assistance of Tilleke & Gibbins intern Ian Michael Yam.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

August 23, 2023
Introduction The idea of the metaverse rose to prominence in the public discourse in 2021, most notably when Facebook renamed itself Meta and announced a new focus on launching a virtual, immersive world. The initial excitement around the metaverse has since faded, with worsening economic conditions having a particularly acute effect on companies in the technology sector. When Meta CEO Mark Zuckerberg announced in March 2023 that artificial intelligence (AI) was the company’s “single largest investment,” many took this as a sign of the company shifting focus away from the metaverse. However, there remains significant interest in the metaverse from both businesses and consumers. Zuckerberg himself reaffirmed Meta’s focus on the metaverse, highlighting how developments in AI will improve virtual reality (VR) and augmented reality (AR) technology. Meanwhile, Roblox, a metaverse gaming platform, announced that in Q1 2023, its number of daily active users had increased to 66 million. Most recently, the announcement by Apple of its new ‘Vision Pro’ AR headset is reported to have renewed interest in the metaverse among developers. A particular area of interest in the developing metaverse is digital fashion and retail. In its Metaverse Fashion Trends Report 2022, Roblox found that nearly three in four users aged 14 to 24 spend money on digital fashion items. Roblox itself has partnered with fashion brands Burberry, Gucci, Tommy Hilfiger, and others, to offer experiences and items for use on the platform. In March 2023, Decentraland, a metaverse platform with a decentralized governance structure, hosted the Metaverse Fashion Week, featuring brands such as Adidas, Coach, and DKNY. As businesses continue to invest and look for opportunities to expand into the metaverse, whether through traditional e-commerce or more innovative digital asset offerings, it is important that they consider the ways in which new and existing laws apply
Read More
August 22, 2023
On August 17, 2023, the Thai government rolled out a royal decree that provides certain exemptions to data controllers’ obligations under the Personal Data Protection Act B.E. 2562 (PDPA). The royal decree, which will come into effect after the lapse of 150 days from its publication in the Government Gazette, reflects the government’s ongoing quest to strike a balance between privacy, state interests, and the data protection regulatory burden on organizations. The royal decree seeks to clarify the circumstances in which data controllers—including business operators and state agencies—are exempt from certain PDPA requirements on the collection, use, and disclosure of personal data and data subject rights. In doing so, it establishes three foundational pillars in considering exemptions: Collection or requests for personal data are to be for the public interest pursuant to the purpose and scope prescribed by any law authorizing a state agency to carry out a certain action, without imposing an undue burden on the data controller responsible for disclosing the personal information. Data controllers can share personal data without the data subject’s consent if legally authorized state agencies request it and specify the statutory provisions granting authority to request the data. Data subjects and data controllers of requested personal data must have the right to submit complaints to the PDPA’s Expert Committee or seek its expertise for clarification or determination. Under the three foundational pillars, data controllers will be partially exempted from certain requirements under the PDPA when the following state agencies request personal data: The National Anti-Corruption Commission or other government entities with mandates aligned with anticorruption laws; The Revenue Department, Customs Department, Excise Department, or other governmental units operating under taxation laws; Local governmental bodies recognized by the Personal Data Protection Committee (PDPC), or any government unit with mandates as per the laws related
Read More
July 31, 2023
On July 13, 2023, Thailand’s Personal Data Protection Committee (PDPC) published a draft notification on the requirements for appointment of a data protection officer (DPO). Under the Personal Data Protection Act B.E. 2562 (PDPA), data controllers or data processors must appoint a DPO if: The data controller or data processor is a state agency as prescribed by the PDPC (the list of state agencies was published in the Government Gazette on July 18, 2023); The activities of the data controller or data processor in relation to the processing of the personal data require “regular monitoring of the personal data or the system,” by reason of “having large-scale personal data” as prescribed by the PDPC; or The core activity of the data controller or data processor is related to the processing of special categories of personal data (e.g., health-related data, biometric data, etc.). The draft notification’s criteria for determining whether a processing activity (1) requires regular monitoring of the personal data or the system, and (2) involves large-scale personal data are outlined below. General Principles When determining whether processing of personal data requires regular monitoring due to having large-scale personal data, it is likely that only the “core activity” of the data controller or data processor is to be taken into consideration. The term “core activity” denotes an essential and integral activity directly related to the primary operations of the data controller or data processor and does not include any supplementary business activities. Regular Monitoring of Personal Data or Systems According to the draft notification, activities related to processing personal data require regular monitoring of the personal data or the system if: The core part of the data controller’s or data processor’s activities consists of tracking, monitoring, analyzing, or predicting the behavior, attitude, or profile of individuals; and These activities
Read More
July 31, 2023
Vietnam’s Decree No. 72/2013/ND-CP, as amended by Decree 27/2018/ND-CP (referred to collectively as “Decree 72”) regulates internet services and online information, and plays a crucial role in governing significant services such as social networks, online games, and aggregated information websites, as well as key matters like domain names and online information security. Given the rapid pace of development in these areas, Decree 72—having been in effect for nearly a decade—is in need of an update. The Ministry of Information and Communications (MIC) had initially intended to draft an amendment to Decree 72 in 2021. However, the magnitude of required changes made it impractical to retain the form of an amending decree, leading the MIC to shift its focus toward replacing Decree 72 entirely. As a result, a new draft decree to replace Decree 72 (the “Draft Decree”) was released by the MIC for public consultation from July 17 to September 15, 2023. The Draft Decree is comprehensive, with six chapters, 87 articles, and an appendix of 56 forms. The following are some of the main issues covered by the new Draft Decree. 1. Social Network Services Classification and licensing/notification Social network services include onshore and offshore social network services. Onshore social network services refer to those provided by organizations or enterprises with legal status in Vietnam, and are divided into “high-visitor” or “low-visitor” categories based on number of regular visitors. The high-visitor category includes social networks with total visits of 10,000 or more per month for six consecutive months or with more than 1,000 regular members in a month. High-visitor onshore social network service providers must obtain a license to provide social network services. Low-visitor onshore social network service providers only need to notify the MIC’s Authority of Broadcasting and Electronic Information (ABEI) and receive the ABEI’s written notification
Read More