(a) The provisions contained in this Law shall apply to any kind of electronic record and electronic data message used in the context of commercial and non-commercial activities including domestic and international dealings, transactions, arrangements, agreements, contracts and exchanges and storage of information. 

(b) This Law shall apply to any person who commits any offence actionable under this Law within the country or from inside of the country to outside of the country, or from outside of the country to inside of the country by making use of the electronic transactions technology.

Any person or organization from inside or outside of the country desirous of performing service as a certification authority shall apply to the Control Board to obtain the license in accordance with the stipulations.

The certification authority shall: 

(a) utilize the trustworthy system so as not to cause intrusion and misuse of computer hardware, software and procedures of computer; 

(b) prescribe a reasonable level of reliability in its services which are reasonably suited to the performance of intended functions; 

(c) carry out the secrecy and privacy of the electronic signatures in accordance with the security procedures; 

(d) observe the specified standards; 

(e) mention the detailed facts of electronic transactions certificate; 

(f) disclose its service that can be provided with respect to issuance of certificate; 

(g) disclose facts that may materially and adversely affect reliability, or responsibility or guaranty of a certificate that is issued or its ability to perform its services; 

(h) in the event of occurrences that may materially and adversely affect due to conditions permitted in the certificate or failure in the computer system: 

(i) notify the person who may foreseeably be affected, by any possible means; 

(ii) act in accordance with procedures governing such an occurrence specified in its certification practice statement; 

(i) comply with the regulations and duties prescribed by the Control Board from time to time.

(a) The certification authority who obtains a license issued under section 13 shall, on submitting a proposal to obtain a permit under the Myanmar Citizens Investment Law or Union of Myanmar Foreign Investment Law, apply to the Myanmar Investment Commission together with the license issued by the Control Board;

(a) Any person, desirous of performing as a subscriber, shall apply to the certification authority to obtain the certificate in accordance with the stipulations; 

(b) The certification authority may, after scrutinizing the application under sub-section (a), issue the certificate by prescribing conditions or refuse to issue the same.

The subscriber shall: - 

(a) when using valid signature by decryption of the electronic signature, take care so that such decryption may not be used by others unlawfully; 

(b) in using the certificate issued for electronic signature during the period granted, take care to be completely accurate and correct with respect to facts relevant to him or facts that are to be inserted; 

(c) if the secrecy of decryption of the electronic signature has been compromised or is in a situation where compromise may possibly occur, inform the persons who are related to his electronic signature as arranged by the certification authority or by any suitable arrangement without delay.

The subscriber shall be responsible for the consequences of the loss and damage to be caused by his failure to comply with the provisions of section 17.

Responsible for managing personal information:

(i) Type the personal information for which you are responsible, systematic maintenance in accordance with the law according to the level of security, prevention and management must be carried out.

(ii) allowing any other person or entity under his management to scrutinize any personal information, except with the permission or permission of the owner of an existing law; Disclosure Notification Distribution Shipping Reform; Destruction; Do not make copies or submit as a witness.

(iii) personal information may not be used for management matters that are inconsistent with the purpose.

(iv) personal information collected for a limited time must be systematically destroyed beyond the specified time.

Under any existing law, any investigation team that receives information, including personal information, The person entrusted with the responsibility on his behalf or under his direction must keep the information he obtains confidential, except as required by law.

Whoever commits any of the following acts by using electronic transactions technology shall, on conviction be punished with imprisonment for a term which may extend from a minimum of 7 years to a maximum of 15 years and may also be liable to a fine: 

(a) doing any act detrimental to the security of the State or prevalence of law and order or community peace and tranquility or national solidarity or national economy or national culture. 

(b) receiving or sending and distributing any information relating to secrets of the security of the State or prevalence of law and order or community peace and tranquility or national solidarity or national economy or national culture.

Whoever commits any of the following acts shall, on conviction be punished with imprisonment for a term which may extend to 5 years or with fine or with both: 

(a) sending, hacking, modifying, altering, destroying, stealing, or causing loss and damage to the electronic record, electronic data message, or the whole or part of the computer programme dishonestly; 

(b) intercepting of any communication within the computer network, using or giving access to any person of any fact in any communication without permission of the originator and the addressee; 

(c) communicating to any other person directly or indirectly with a security number, password or electronic signature of any person without permission or consent of such person; 

(d) creating, modifying or altering of information or distributing of information created, modified or altered by electronic technology to be detrimental to the interest of or to lower the dignity of any organization or any person.

Any certification authority or any of his officer or employee who violates any of the prohibitions contained in the order issued by the Control Board shall, on conviction be punished with imprisonment for a term which may extend to 3 years or with fine or with both.

Whoever violates any of the prohibitions contained in the rules, notifications and orders issued under this Law shall, on conviction be punished with imprisonment for a term which may extend to 1 year or with fine or with both.

Whoever commits any of the following acts shall, on conviction be punished with imprisonment for a term which may extend to 1 year or with fine or with both:- 

(a) knowingly misrepresents to the certification authority his identity or authorization in applying for a certificate or in submitting for suspension or cancellation of a certificate; 

(b) obstructing or impeding or assaulting the Central Body and body or person assigned duty by it or the Control Board and body or person assigned duty by it which performs the functions and duties in accordance with this Law or failing to comply with the demand to perform in accordance with this Law.

Whoever attempts to commit any offence of this Law or conspires amounting to an offence or abets the commission of an offence shall be punished with the punishment provided for such offence in this Law.

If the person responsible for maintaining personal information is found guilty of failing to manage personal information in accordance with the provisions of this law, he shall be punished with imprisonment for a term of not less than one year and not more than three years or a fine not exceeding one hundred thousand kyats or both punishments shall be imposed. (4) In managing the matters under sub-section (3), Defining administrative authority by the department or organization assigned by the Central Body and implementing in accordance with those provisions.

No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Disclosure roaming, destruction, reform, distribution if convicted of sending or misappropriating another person, the person shall be punished with imprisonment for a term of not less than one year and not more than three years or a fine not exceeding five hundred thousand kyats or both punishments must be imposed.

If convicted of fabricating false or misleading information for the purpose of defamation or dissolution, to scare the public in the cyber field or to distrust, he shall be punished with imprisonment for a term of not less than one year and not more than three years or a fine not exceeding fifty hundred thousand kyats or both punishments must be imposed.

If convicted of cyber-attacks by installing malware on a computer with the intent to harm someone, to effect sovereignty of the State security, peace and stability, blocking access to cyber resources for the purpose of threatening or undermining the rule of law or national unity, making it difficult or attempting to hack into a cyber source without permission or using more than allowed, the person can be sentenced to a minimum of two years and a maximum of five years in prison or a fine not exceeding three hundred thousand kyats or both punishments must be imposed.

If convicted of attempted intrusion or unauthorized use of a cyber-source for security reasons in a joint venture between the State and other countries, whoever intends to damage the close relations between the State and other countries for the benefit of another country, he shall be punished with imprisonment for a term not exceeding three years and not exceeding seven years or a fine not exceeding five hundred thousand kyats or both punishments must be imposed.

Any offence contained in this Law is cognizable by the Myanmar Police Force.