The State Administration Council enacted Cybersecurity Law No. 1/2025 in January 2025. The law officially entered into force on 30 July 2025 through Notification No. 113/2025.

‍

This Law is enacted with the following principal objectives:

1. To ensure the security and protection of matters relating to cybersecurity resources;
2. To promote and regulate the development of cybersecurity services; and
3. To support the growth of the digital economy in Myanmar.

‍

‍

Competent Government Authority

The Ministry, Departments and authorities responsible for enforcement under the Cybersecurity Law have not yet been officially designated. However, in the draft Cybersecurity Law 2022, the Ministry of Transport and Communication was designated as the focal Ministry and the Information Technology and Cybersecurity Department was designated as the implementation department. 

‍

‍

Supervision of the Government

The Ministry (once designated under the Law) is empowered to inspect and supervise cybersecurity service businesses or digital platform service businesses where deemed necessary, with respect to matters concerning national defense, state security, or the public interest.

Furthermore, the Ministry holds the authority to:

1. to temporarily suspend digital platform services or the dissemination of electronic content;
2. to control or restrict content related to digital platform services; and
3. to order the closure of digital platform service businesses.

‍

‍

Licensing and Registration Requirements under Cybersecurity Law No. 1/2025

1. Registration Obligation
   
   • Any cybersecurity service provider, as well as any digital platform service provider with 100,000 or more users, must be incorporated as a company under the Myanmar Companies Law.
2. Licensing Requirement
   
   • Such entities are also required to obtain a business license under the Cybersecurity Law.
   • Where applicable, service providers must also apply for permits or documentation under other relevant laws governing the specific services offered.

3. License Term and Renewal
   
   • Licenses will be granted for a term of not less than three (3) years and not more than ten (10) years.
   • Applications for renewal must be submitted at least six (6) months prior to the expiration of the license.

‍

‍

Regulation of Virtual Private Networks (VPN)

A Virtual Private Network (VPN) is defined as a system established as a separate network to ensure secure connectivity between one network and another. Any service provider intending to establish or provide VPN services within Myanmar’s national cyberspace must obtain prior authorization from the Ministry.

‍

Any violation or non-compliance by individual offenders will be subject to imprisonment for a term of not less than one (1) month and not more than six (6) months, a fine of not less than MMK 1,000,000, or both. Provided that all evidence related to the case will be confiscated as State property. In the case of corporate or entity offenders, the penalty will be a fine of not less than MMK 10,000,000, together with confiscation of all evidence related to the case as State property.

‍

‍

Penalties under the Cybersecurity Law

Any person convicted of providing cybersecurity services without obtaining a license shall be subject to a fine of not less than MMK 1,000,000 and not more than MMK 10,000,000, or to both fines and penalties, and all evidence related to the case shall be confiscated as State property.

‍

A business operating without renewing its cybersecurity service provider license shall be subject to a fine of not less than MMK 1,000,000 and not more than MMK 5,000,000. Where a digital platform service provider is convicted of operating without registration, it shall be subject to a fine of not less than MMK 100,000,000 and all evidence related to the case shall be confiscated as State property. If such a provider fails to renew its license, it shall be subject to a fine of not less than MMK 5,000,000.

‍

Any person who establishes an online gambling system within the national cyberspace without the Ministry’s permission shall be subject to imprisonment for a term of not less than six (6) months and not more than one (1) year, a fine of not less than MMK 5,000,000 and not more than MMK 20,000,000, or both. In such cases, all evidence related to the case shall be confiscated as State property. In the case where the offender is a company or other legal entity, the punishment shall be a fine of not less than MMK 20,000,000, together with the confiscation of all related evidence as State property.

‍

Offences committed within the territory of the State, on board any vessel or aircraft registered in Myanmar, within the national cyberspace, or in any other cyberspace connected to the national cyberspace, as well as offences committed abroad by Myanmar citizens, shall be subject to adjudication under the Cybersecurity Law.