MyanmarCybersecurity Law, digital platform data retention and disclosure duty
Cybersecurity Law, State Administration Council Law No. 1/2025, ss.33-34
In force since .
An enforcement supervision rule binding public and private bodies.
- Private right of action
- No
What it requires
- If you run a digital platform service with 100,000 or more Myanmar users, retain each user's personal information, including a voiceprint or faceprint the platform stores, for 3 years, and disclose it to an authorised individual or organisation on written request.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does "Digital Platform Service", defined as a service that "can allow users to express, send, distribute or use data information by using cyber resources and similar systems or equipment", reach an application that only lets a user submit data to the operator for processing, with no sharing between users?
What this law does
Myanmar's Cybersecurity Law (State Administration Council Law No. 1/2025) contains no data-protection framework: its Chapter II definitions define cybersecurity-related terms but no "personal data" or "biometric data" term at all, and the sole use of "personal information" in the entire law is at section 33, which requires a digital platform service provider to retain personal information of a user, usage records, and any data the Department specifies for 3 years, disclosed to an authorised individual or organisation on written request under section 34.
This is a retention and state-access duty, not a protective one: it carries no consent standard, no purpose limitation, no retention ceiling beyond the 3-year floor, and no individual notice or objection right, and it runs toward government access to personal data rather than away from it, reaching a voiceprint or faceprint a covered platform stores exactly like any other user data.
A Ministry of Information report of records the Union Minister for Home Affairs stating that the Law has been in force since ; the notification fixing that day has not been located in an official text. Enforcement runs through a Central Committee and a Steering Committee on Cybersecurity and a Department with licensing and investigation powers (Chapter III); no private civil right of action exists anywhere in the law's text.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .