Myanmar has no general product-security, connected-device, or reasonable-security-baseline statute reaching an ordinary software product, platform, or business that holds covered data.
The one substantive, currently-binding security-posture duty located binds a narrow licensed role rather than a general product or platform: the Electronic Transactions Law (State Peace and Development Council Law No. 5/2004, as amended by Law No. 6/2014) requires any person or organization licensed by the Electronic Transactions Control Board as a certification authority to utilize a trustworthy system that prevents intrusion and misuse of computer hardware, software, and procedures, to prescribe a reasonable level of reliability in its services, to carry out the secrecy and privacy of electronic signatures in accordance with security procedures, and, where an occurrence materially and adversely affects a certificate's reliability or the computer system fails, to notify foreseeably affected persons by any possible means and act according to the procedures its own certification practice statement specifies.
This role, a certification authority under a public-key-infrastructure licensing scheme, is not one this corpus's activity vocabulary currently expresses, the same treatment already given to Chad's trust-service-provider duties, Singapore's Cybersecurity Act designated parties, and Bermuda's Monetary-Authority-licensed entities, so it is recorded here in prose rather than raised against a declared activity, and a developer whose product is not itself a certification authority is not reached by the lint on this account.
No duty to report an incident or a vulnerability to a government authority on a stated clock was located: the certification authority's own notification duty runs to the affected user rather than to a regulator, and the Control Board's own power to inspect and audit a certification authority's records and systems is an oversight power rather than an operator-initiated reporting duty.
A separate provision lets a person using electronic transactions determine and select the type and level of security for an electronic record or data message according to their own requirement, which is a permissive, self-determined option rather than a mandatory duty, so it does not amount to a baseline security statute reaching every business that holds covered data.
Enforcement of the certification authority's security duties runs through the Electronic Transactions Control Board, primarily administratively. The Board fixes a licence's terms and conditions at issuance, and it may impose a stipulated penalty, suspend the licence for a fixed term, or cancel it outright where the certification authority violates a licence condition or is convicted of an offence under the Law.
A certification authority, or an officer or employee of one, who violates a prohibition contained in an order the Control Board issues faces imprisonment of up to three years, a fine, or both, though the Law does not state that its security duties are themselves framed as such an order rather than as direct statutory duties, so whether a breach of those duties alone triggers this particular offence, separately from the administrative licence remedies, is not established from the text read.
The Law's other criminal provisions punish acts against state security, hacking and unauthorized interception, misrepresentation to a certification authority by an applicant, and obstruction of the Central Body or the Control Board, none of which is a certification authority's own security or notification duty. No private right of action was located; a subscriber's dispute with a certification authority is settled by the Control Board itself rather than through a civil claim.
The Cybersecurity Law (State Administration Council Law No. 1/2025) is structured to reach further.
Its own definitions clause names a licensed cybersecurity provider and an authorized cybersecurity team, and its Steering Committee is charged with providing guidance on cybersecurity services for critical information infrastructure and with granting authorization to cybersecurity teams, which points toward an operator-facing licensing and critical-information-infrastructure regime of the kind this topic researches.
The chapters that would state those operative duties, the licensing conditions on a cybersecurity provider, the obligations placed on a critical-information-infrastructure operator, and the Law's own penalty provisions, were not located in readable form anywhere.
The only complete primary-source copy identified, the Ministry of Information's own reproduction of the Law's official English translation, is itself a serialized newspaper excerpt that stops after its tenth section, mid-committee-structure, with the words "To be continued" and no located continuation article carries the remaining sections.
This is a gap in the located primary text rather than a finding that the missing chapters impose no security duty, and it does not extend to the Law's data-retention and disclosure provision, which a secondary copy allowed this jurisdiction's privacy-topic record to establish; that provision is catalogued there and is not restated here.
Myanmar has no breach-notification statute to name as this jurisdiction's privacy-topic counterpart. Its privacy-topic record finds no comprehensive personal-data-protection law at all, and the one individual-data provision it could establish, a mandatory three-year retention and state-disclosure duty running toward government access rather than away from it, is a state-access duty rather than a breach-notice regime.
