You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 1, 2025

Myanmar Cybersecurity Law Takes Effect

Subscribe to Updates

On July 30, 2025, Myanmar’s Cybersecurity Law No. 1/2025 came into effect with the State Administration Council’s issuance of Notification 113/2025. The law, which was enacted on January 1, 2025, aims to regulate various aspects of digital security and online activities.

Below are some key provisions, implications, and penalties under the Cybersecurity Law.

  • Extraterritorial penalties. The law contains an important provision that authorizes penalties against Myanmar citizens who are found guilty of violations, even if these occur outside the country’s borders.
  • VPN definition and regulation. Virtual private networks (VPNs) are defined by this law as specific systems that function as backup networks by using technological means in order to ensure the safety of linking networks to each other. This definition sets the framework for subsequent regulations and penalties associated with VPN usage. The law does not restrict individuals or entities from using VPNs; it regulates VPN service providers.
  • Penalties for unapproved VPN services. Establishing a VPN or providing VPN services without approval from the designated ministry (to be appointed later by the government) can result in significant penalties. For individuals, the punishment may be imprisonment for 1–6 months, a fine of MMK 1–10 million (approx. USD 476–4,760), or both, with the proceeds of the violation being confiscated. If the violator is a company or organization, the minimum fine will be MMK 10 million, and the proceeds will be confiscated.
  • Government oversight. The ministry designated by the government is authorized to investigate and take control of cybersecurity services and digital platform services for national defense and security purposes, or upon request from a government department or organization in accordance with respective laws.
  • Licensing requirements. The Cybersecurity Law introduces two types of licenses, valid for a period of 3–10 years, for (1) cybersecurity services and (2) digital platform providers. Digital platforms with over 100,000 users are required to apply for the latter license. Noncompliance with this requirement will be subject to a fine of at least MMK 100 million (approx. USD 47,600), and any proceeds resulting from the violation will be confiscated.
  • Penalties for unsolicited communications. Individuals who transmit unwanted and unsolicited messages, emails, or data via a network will be subject to imprisonment for 1–2 years, a fine of MMK 5–20 million (approx. USD 2,380–9,530), or both.
  • Penalties for cyber misuse. Engaging in cyber misuse—including the alteration, deletion, or sale of computer programs or data, as well as the unauthorized control and execution of computer systems, programs, or electronic data—will be subject to imprisonment from 6 months to 3 years, a fine of MMK 1–20 million (approx. USD 476–9,530), or both.
  • Penalties for online theft or mischief. Committing or inciting others to commit online theft or mischief using cyber resources will be subject to imprisonment for 2–7 years and the possibility of additional fines.
  • Penalties for unapproved online gambling. Operating an online gambling system without proper authorization may result in imprisonment for 6 months to 1 year, a fine of MMK 5–20 million (approx. USD 2,380–9,530), or both, with the proceeds from such activities being confiscated. If the offender is a corporation or organization, the minimum fine is MMK 20 million, and the illicit proceeds will also be confiscated. The law does not address how online gambling platforms can obtain official approval.

Myanmar’s Cybersecurity Law represents a significant step in the country’s regulation and oversight of digital security and online activities. Businesses, digital platform providers, cybersecurity service providers, and VPN providers need to understand these requirements and ensure compliance to prevent substantial penalties.

Nonetheless, given that services such as VPNs are very widely used, it remains to be seen how these new far-reaching regulations will actually be enforced.

 

This article was prepared with the assistance of Tilleke & Gibbins intern Ian Michael Yam.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

May 9, 2024
On April 29, 2024, Thailand’s Office of the Personal Data Protection Committee (PDPC) issued the master plan for personal data protection, which outlines the PDPC’s strategies for developing and enhancing the data protection framework in Thailand from 2024 to 2027. A draft of this four-year plan had previously been released for a public hearing on November 27, 2023. Overview The master plan sets out the long-term direction for the protection of personal data in Thailand, analyzing the current landscape, challenges, and obstacles encountered since the full enactment of the Personal Data Protection Act B.E. 2562 (2019) (PDPA). It aims to align with Thailand’s National Security Policy and Plan for 2024–2027 and focuses on key sectors in its initial two years. These sectors are: Public security and key government services; Retail and e-commerce; Information and communication technology and telecommunications; Finance, investment, and insurance; Public health; Tourism; and Education. Objectives The master plan’s goals include increasing organizational compliance with the PDPA, reducing data breaches, updating the PDPA to reflect current circumstances, introducing various PDPC e-services, and enhancing Thailand’s global competitiveness in data privacy and personal data protection. It sets targets and indicators of the plan’s success, such as achieving a 100% PDPA compliance rate across all sectors in Thailand and raising Thailand’s digital competitiveness to at least 30th in the World Digital Competitiveness Rankings from the IMD World Competitiveness Center. Strategic Initiatives To achieve these objectives, the master plan introduces four strategic initiatives: Effective and balanced PDPA enforcement: Develop standards, principles, criteria, tools, indicators, and data privacy governance, including law enhancements. A recent example of this is the PDPC’s launch of the Personal Data Protection Surveillance Centre (PDPC Eagle Eye) to monitor data breaches. Knowledge and trust enhancement: Build human capacity and trust by enhancing knowledge through initiatives like the forthcoming
Read More
May 3, 2024
Vietnam’s Ministry of Public Security (MPS) recently published on its website a dossier of the Draft Law on Data (the “Draft Law”) for public feedback, initiating a consultation period from February 26 to March 26, 2024. The dossier comprises a Policy Impact Assessment Report and a Summary Report on the implementation of existing legal documents governing data. An outline of the Draft Law was later circulated to relevant organizations for their input and commentary. The MPS drafted this legislation with several objectives, including bolstering national data infrastructure, advancing digital government while streamlining administrative procedures, fostering growth in the digital economy and building a digital society, and establishing a National Data Center. Comprising 65 articles across 6 chapters, the Draft Law is slated for implementation on January 1, 2026. The Draft Law currently is very preliminary, resembling a framework document. It features numerous provisions akin to policy mandates, yet only presents introductory concepts without further elaboration. Scope of Application The Draft Law applies to agencies, organizations, and individuals involved in data activities in Vietnam. This scope of application appears excessively broad and ambiguous, without a clear definition of “data activities”, leaving uncertainty regarding the breadth of this term’s coverage. Key Policy Groups The Draft Law focuses on four key policy groups: 1. Regulations on development, processing, and management of data This policy group focuses on matters relating to the collection, digitalization, and creation of data; assurance of data quality; data classification; data storage; data combination, adjustment, and updating; data strategy; data management; data sharing; provision of data to state agencies; data analysis and synthesis; data verification and authentication; data disclosure; access and retrieval of data; data encryption and decryption; data copying, transmission, and transfer; data revocation, deletion, and destruction; application of science and technology in data processing; identification and management
Read More
April 30, 2024
On March 25, 2024, Thailand’s Securities and Exchange Commission (SEC) published an amendment to its Notification re: Public Digital Token Offering to strengthen governance for initial coin offerings (ICOs). The amendments took effect on April 16, 2024, and reflect the SEC’s commitment to creating a safer and more transparent ICO environment, enhancing investor protection, and building confidence in ICOs as a fundraising tool. The key changes are outlined below: New Checks and Balances Requirements The new regulations require digital token issuers to implement checks and balances to protect investor rights—including an annual audit requirement and measures to prevent and manage conflicts of interest. These measures must be clearly disclosed in the ICO filing documents. In addition, certain project-related decisions must be approved by the issuer’s board of directors, which is also responsible for the accountability of such decisions. Improved Rules Concerning Voting Rights The SEC has introduced rules concerning voting rights and procedures for digital token holders, particularly for token types that previously lacked regulatory clarity. These rules specify the procedures for soliciting votes, the rationale behind vote requests, and the criteria for determining voting outcomes. The new rules, however, do not apply to real estate-backed tokens or infrastructure-backed tokens. Enhanced Advertising Regulations The SEC has revised advertising guidelines to ensure that investors receive essential information. The updated rules now require all ICO advertising to be fair and informative and to avoid misleading content. Advertisements must include appropriate risk warnings and a credible source for any claims made. The notification also stresses that it is the responsibility of digital token issuers to strictly supervise and ensure that those who create advertisements with or for an issuer comply with all relevant advertising regulations, including the following: Warning of investment risk: Advertisements must include warnings about investment risks and contact information
Read More
April 5, 2024
On March 15, 2024, Thailand’s Board of Investment (BOI) updated its investment incentives for software development and data centers by issuing a regulation replacing the previous categories of software or platforms for digital services or content (category 8.1) and data centers (category 8.2.1). The new and updated categories are detailed below. Software and Platform Development Under the new promotion policy, the BOI has made separate subcategories for “development” and “improvement” of software or platforms, each with its own set of incentives. The BOI is expected to clarify the characteristics of these two activities in a forthcoming announcement. Qualifying development activities are eligible for a corporate income tax (CIT) exemption for eight years (capped), while improvement activities are not eligible for any CIT exemption. A number of adjustments have been made to the eligibility criteria for development of software and platforms for digital services or content. These include the following: Salary expenditures for Thai information technology (IT) personnel hired temporarily after applying for investment promotion can now be included in the calculation of total salary expenditures for Thai IT personnel hired subsequent to applying for investment promotion. Previously, only salary expenditures for permanently employed personnel could be included in this figure. The minimum salary expenditures for each project remain unchanged at THB 1.5 million per year. Similarly, salary expenditures for temporary hiring of Thai IT personnel can be included in calculating the actual expenditures in the year that the project would like to benefit from the CIT exemption. Projects must commence operations within 12 months of the promotion certificate being issued. No extensions are allowed. Projects are no longer allowed to extend the machinery importation period. The other eligibility criteria for development of software and platforms for digital services or content remain unchanged. Projects in the new BOI subcategory for
Read More