Myanmar’s cyber law a serious threat
to privacy, speech, and security
10 January 2025
Rather than ensuring cybersecurity, Myanmar’s newly adopted Cyber Security “Law” grants the
military sweeping powers to control online spaces, enabling systematic violations of digital
rights, including the rights to privacy, freedom of expression, and access to information. This
analysis highlights how the law deviates from international human rights standards and
threatens privacy, digital security, VPN use, free expression, fair trial, digital rights NGOs, and
social media.
While earlier drafts of the law under the National League for Democracy (NLD) administration
already raised concerns about potential infringements on digital rights, post-coup revisions by
the military in 2021 and 2022 further weakened safeguards. Human rights experts noted that
the military’s revisions added new crimes—some of which have now been removed—and
stripped away protections. Therefore, this analysis compares the final adopted law to earlier
drafts to examine how the military’s repression has evolved.
Privacy protections removed
The Cyber Security Law represents a deliberate effort by the military to dismantle essential
privacy protections in Myanmar, undermining the right to privacy as enshrined in international
human rights instruments. Even the military’s 2022 draft included provisions aimed at
safeguarding personal data held by government and private entities—protections crucial for
addressing cybercrime involving unauthorised data collection and interception (2022v Art. 4.c).
In the final adopted law, all privacy safeguards have been completely erased. Critical definitions,
such as personal information and responsibilities for its protection, have been removed (2022v
Arts. 3.n–o). The objective of protecting personal data has been eliminated (2022v Art. 4.c), as
has the duty to ensure the security of private data and infrastructure (2022v Art. 14.i).
Moreover, Chapter 6—which previously mandated measures such as appointing data officers to
secure data handling, prevent unauthorised disclosure, and ensure data destruction—has been
deleted, along with penalties for failing to protect privacy (2022v Arts. 79–81).
The new law imposes disproportionate obligations on digital platforms, requiring them to retain
user data for three years and hand it over upon mere request by any military-controlled