The framework
Myanmar has no single comprehensive statute and protects personal data through sectoral rules, principally the Cybersecurity Law (2025) data provisions.
Absent a local rule, the practical constraints come from platform policies and foreign laws with extraterritorial reach.
Key instruments
Cybersecurity Law (2025) data provisions; Law Protecting Privacy and Security of Citizens (2017, partly suspended)
Post-coup Myanmar regulates data through a January 2025 Cybersecurity Law oriented to surveillance and VPN control; no rights-based privacy framework operates in practice.
Marketing and advertising
No functioning comprehensive consent regime; the 2025 Cybersecurity Law is built around state control. With no operative local consent rule, the practical guardrails are platform policy and any foreign law that can reach the campaign.
Cross-border transfers
The state controls cross-border data flows directly. In practice, the binding transfer rules for most international campaigns touching this market come from the origin jurisdiction of the data.
Enforcement and penalties
Criminal penalties apply under security laws.