Myanmar

Myanmar's Cybersecurity Law (State Administration Council Law No. 1/2025) contains no data-protection framework: its Chapter II definitions define cybersecurity-related terms but no "personal data" or "biometric data" term at all, and the sole use of "personal information" in the entire law is at section 33, which requires a digital platform service provider to retain personal information of a user, usage records, and any data the Department specifies for 3 years, disclosed to an authorised individual or organisation on written request under section 34.

This is a retention and state-access duty, not a protective one: it carries no consent standard, no purpose limitation, no retention ceiling beyond the 3-year floor, and no individual notice or objection right, and it runs toward government access to personal data rather than away from it, reaching a voiceprint or faceprint a covered platform stores exactly like any other user data.

The law's own section 2 commences it only on a date the president appoints by notification; independent trackers converge on State Administration Council Notification No. 113/2025 bringing it into force 30 July 2025, but that notification is not cited here, so this instrument is recorded as enacted rather than in effect.

Enforcement runs through a Central Committee and a Steering Committee on Cybersecurity and a Department with licensing and investigation powers (Chapter III); no private civil right of action exists anywhere in the law's text.

Section 34 of the Electronic Transactions Law punishes, with imprisonment for a term which may extend to 5 years or a fine or both, sending, hacking, modifying, altering, destroying or stealing an electronic record, electronic data message or computer programme dishonestly, and separately punishes intercepting a communication within a computer network or giving another person access to a communication's contents without the permission of the originator and the addressee.

The offence's elements turn on dishonesty and interception rather than on defeating a technical access control, so reading a public, unauthenticated page without more falls outside a plain reading of the provision, and no reported case has tested the point.

A more serious tier at section 33 punishes, with imprisonment from 7 to 15 years, acts detrimental to state security or public order committed using electronic transactions technology, and section 38 extends the punishment for any offence to an attempt, conspiracy or abetment of it.

The English text catalogued here carries no personal-data definition, misinformation offence, or VPN-circumvention provision of the kind secondary reporting attributes to a 2021 amendment (State Administration Council Law No. 7/2021); that amendment's own text is not among the sources cited for this instrument, so this instrument reflects only the law as amended through Law No. 6/2014.

The Copyright Law grants the reproduction right at section 18(a) and then carves out narrow, named exceptions rather than a general fair-use or text-and-data-mining standard: personal-use reproduction of a part of a published work at section 24, expressly excluding reproduction of the whole or a substantial part of a book, a database in digital form, or a computer programme outside section 30's own terms; quotation of a lawfully published work with source and author attribution at section 26; reproduction of part of a published work or a newspaper or journal article for teaching purposes at section 27; and current-events news reporting and short-excerpt reproduction at section 29.

Section 30 permits a lawful owner of a computer programme copy to reproduce or adapt it only for the use for which it was obtained, for archival back-up, or for replacing a lost or destroyed copy, and any such copy must be destroyed once lawful possession ends. None of these provisions creates a text-and-data-mining exception or a machine-readable opt-out mechanism, so reproducing copyrighted text or a computer programme at scale to train a model has no exception of its own to rest on.

Reproducing beyond what these sections permit, for a commercial purpose and without the right holder's consent, is punishable under section 82 with imprisonment for a term not exceeding 3 years or a fine not less than 1,000,000 kyats, or both, and the Copyright Law also allows the aggrieved person to pursue a separate civil case for damages.

The Law's own commencement is deferred to a date the President sets by notification; no such notification is among the sources cited for this instrument, so status is recorded as enacted rather than in effect.

Section 15 protects, as a derivative work, a compilation of data whether in machine-readable or other form, but only where the collection constitutes an intellectual creation by reason of the selection or arrangement of its content, and it expressly states that the contents of the collection are not themselves protected.

Myanmar therefore confers no sui generis database right of the kind that protects the investment in obtaining, verifying or presenting a database's contents regardless of originality; a scraper that extracts the contents of a Myanmar-compiled database without reproducing the compiler's own selection or arrangement faces no compilation-copyright claim over the data taken.

Reproduction of the whole or a substantial part of a database in digital form is also carved out of the Law's own personal-use exception at section 24, so even a non-commercial reproduction of that kind needs the right holder's authorization once it goes beyond copying the protected selection or arrangement.

The Law's own commencement is deferred to a date the President sets by notification; no such notification is among the sources cited for this instrument, so status is recorded as enacted rather than in effect.

Section 16 excludes "news of the day or miscellaneous facts having the character of mere items of press information" from copyright or related-rights protection, so a bare fact carries no protection at all regardless of any exception.

Section 26 separately permits, without the right holder's authorization, quotation of a part of a lawfully published work, provided the quotation complies with fair practice, does not exceed the extent justified by its purpose, and is accompanied by an indication of source and the author's name.

Section 29 permits reproducing, broadcasting, or communicating to the public current political, economic, or religious articles from a published newspaper or periodical, subject to a proviso that the right holder may expressly prohibit that reproduction. It separately permits, for the purpose of reporting current events, reproducing or broadcasting short excerpts of an already-published or broadcast work, to the extent justified and not for a commercial purpose.

Neither provision carries a headline-length or short-extract cap distinct from its own fair-practice or current-events test, and no reported Myanmar decision applies either to a systematic news aggregator rather than an individual quoting a published work.

Neighbouring rights under the Law extend to performers and broadcasting organisations, not to a print or online news publisher's own reporting, so Myanmar confers no publisher-side neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates. The Law's own commencement is deferred to a date the President sets by notification; no such notification is among the sources cited for this instrument, so status is recorded as enacted rather than in effect.