Domestic law and policy
Myanmar presently does not have a comprehensive legal framework that governs digital identity systems.[43] From 2013 onwards, government strategies (e-Governance Master Plan 2016–2020, and the 12-point Economic Policy) identified digital ID and ‘smart cards’ as priorities.[44] More recently, the Myanmar e-Governance Master Plan 2030, released in December 2024, outlines the country’s transition plan to a digital government.[45] This plan, however, does not provide a detailed outline of the digital identity system.[46]
Data Protection
As mentioned above, there is no specific law or comprehensive digital ID statute in force in Myanmar and ‘digital identity’ is not specifically defined.[47] Article 357 of the 2008 Constitution protects the ‘privacy and security of home, property, correspondence and other communications of citizens’.[48] Additionally, the Law Protecting the Privacy and Security of Citizens (2017) regulates searches, surveillance and interception, but does not create a general data protection regime or detailed rules for digital ID databases.[49] Myanmar’s digital ID system raises serious concerns in relation to privacy, surveillance, and access to public resources.[50] The UID Smart Card and biometric SIM card registration are used to track individuals’ movements and communications. However, they operate without a legal framework, and there is no independent system to ensure accountability or provide redress..[51]
While certain provisions related to privacy exist in laws such as the Electronic Transactions Law (2004, amended in 2021), Law Protecting the Privacy and Security of Citizens (2017) and Cybersecurity Law (2025), none of these laws provide a comprehensive or enforceable structure for safeguarding personal data, particularly in the context of the country’s expanding digital identity system.[52] Furthermore, there is limited information available regarding the legal requirement for encryption of UID data. There are also no restrictions on government access to this information. The DLA Piper Data Protection Laws of the World report confirms that Myanmar relies on fragmented sectoral provisions and that there is no general data protection law in Myanmar nor an independent supervisory body to oversee data processing by public authorities or private actors.[53]
Additionally, in June 2021, Human Rights Watch reported that the UN High Commissioner for Refugees (UNHCR) shared the personal and biometric data of Rohingya refugees with the Bangladesh government.[54] This information was later made accessible to Myanmar authorities, and the transfer occurred without obtaining the refugees’ informed consent.[55] Human Rights Watch warned that this data could be used by Myanmar authorities to facilitate forced or unsafe repatriation, surveillance, or discrimination against a population that remains stateless and persecuted.[56]
International Commitments
Myanmar is not a party to international data protection frameworks such as the GDPR. Myanmar is a party to the CRC, and the CRPD.[57] The implementation of the UID system may violate the country’s human rights obligations with respect to access to essential services such as healthcare, education, and employment.[58] Most notably, the fulfilment of the country’s obligations under the CRC (Articles 7 and 24), and CRPD (Article 5, 24, and 25).[59] Myanmar has not ratified the ICCPR, ICESR, or acceded to the 1954 and 1961 Statelessness Conventions or the Refugee Convention.[60]
In addition, as a member state, the ASEAN Framework on Personal Data Protection and Framework on Digital Data Governance sets out non-binding principles to promote coordination and raise standards around data protection, privacy, and secure digital economies.[61] It encourages member states to adopt national data protection laws and supports mutual recognition. However, it does not impose binding commitments or specific mandates on digital ID systems or make provisions for the protection of stateless persons.[62]
Lastly, the country has also pledged to the Ministerial Declaration on a Decade of Action for Inclusive and Resilient Civil Registration and Vital Statistics in Asia and the Pacific at The Third Ministerial Conference on Civil Registration and Vital Statistics in Asia and the Pacific (2025).[63] As per the declaration, countries have pledged to ensure that every birth is registered by 2030 and to close registration gaps among marginalized populations.[64] Moreover, the declaration notes the barriers faced by stateless persons in access to civil registration services and pledged to ‘develop and implement measures to avoid the potential exclusion of digitally marginalized or vulnerable populations from statistical data and facilitate their access to services and entitlements’.[65]
