authority, with the threat of temporary or permanent blocking for non-compliance (Arts. 33-34, 52). By stripping away privacy safeguards and introducing vague, sweeping obligations for data retention, the final law facilitates mass surveillance, undermines individuals’ right to privacy, and increases the risk of arbitrary interference by the military. It prioritises State control over data at the expense of personal privacy, leaving individuals and vulnerable groups exposed to cybercrime, abuse, and State-led repression. Security safeguards removed The Cyber Security Law eliminates essential technical security safeguards, eroding digital trust and exposing Myanmar’s digital environment to heightened cyber threats. Earlier drafts, including the military’s 2022 version, identified protecting “electronic integrity” as a key objective (2022v Art. 4.g) and mandated authorities to develop and oversee electronic security (2022v Arts. 6.g, 20). Both provisions have been removed in the final adopted law. Notably, the entirety of Chapter 8—which previously established standards for electronic communication and security—has been deleted (2022v Arts. 20–32). This chapter outlined critical measures such as electronic certifications and anti-hacking provisions (2022v Arts. 20– 23). The absence of these safeguards undermines the right to security and leaves no clear framework to create reliable electronic systems, address digital fraud, or prevent unauthorised access. Penalties for failing to protect critical infrastructure have also been significantly weakened. While the 2022 draft imposed penalties of up to three years in prison (2022v Art. 81), the final law reduces this to six months, signalling diminished accountability for ensuring digital security (Art. 60). Previous criminalisation of crypto-currency has been removed, but without adding protective regulations, further weakening safeguards against financial cybercrime (2022v Art. 95). By removing these protections, the final law prioritises State control over ensuring public security, leaving critical systems vulnerable and exposing individuals to increased risks of exploitation and abuse. This systematic dismantling of security safeguards threatens the rights to remedy and security of person, further undermining trust in Myanmar’s digital infrastructure. VPN criminalisation partially removed The Cyber Security Law appears to reflect a softened stance on individual VPN use, which is vital for accessing blocked platforms and independent news, supporting the right to freedom of expression and access to information. The military’s 2022 draft criminalised VPN use, imposing penalties of up to three years in prison (2022v Art. 90) and requiring vendors to obtain a license, punishable by up to one year in prison (2022v Arts. 62, 100).