Myanmar Cybersecurity Law in force 30 July 2025

18 August 2025

On 30 July 2025, Myanmar’s State Administration Council issued Notification No. 113/2025 prescribing that the Cybersecurity Law (“Law”) would enter into force on the same date. The Law, enacted on 1 January 2025, is intended to regulate the digital space, including digital communications, and support the development of the digital economy based on secure cyber resources.

Set out below is an overview of the main highlights of the Law. A full discussion of the Law can be found in our article titled “Myanmar’s new Cybersecurity Law establishes framework and processes for use of digital resources”.

Summary of key aspects

  • Extraterritorial reach: The Law has extraterritorial reach, providing that any Myanmar citizen residing abroad who commits an offence under the Law remains within its remit and will be subject to the penalties set out therein.
  • VPN regulation: Virtual private network (“VPN”) providers must obtain permission to establish a VPN or provide VPN services within the national cyberspace. The Law defines a VPN as a system that is set up as a separate network within the original network using specific technology to ensure security when connecting to a network. Non-compliance will result in (i) for individuals, imprisonment for one to six months, a fine of between MMK1 million and MMK10 million (US$476 and US$4,760), or both; and (ii) for companies or organisations, a minimum fine of MMK10 million (US$4,760).
  • Digital platform regulation: Digital platform service providers are required to have adequate measures in place to identify relevant information and cyber resources in the event of certain circumstances, such as where information on their service is “false news”. User data must be retained for three years.
  • Licensing: Entities providing cybersecurity services or operating digital platforms with over 100,000 users must secure licences or registration in accordance with the law. These licences are valid for three to 10 years. Non-compliance can result in fines starting at MMK100 million (US$47,642) and the confiscation of proceeds resulting from the violation.
  • Penalties: The Law sets out penalties for unsolicited communications, cyber misuse, online theft or mischief, and unapproved online gambling.