What Myanmar requires: overseas cloud storage of HR records
Myanmar has no general data-localisation rule for HR records — they may be stored on overseas cloud servers. The deadline / duty is to produce records on inspection and to retain them for the statutory periods. Employers carry primary responsibility regardless of where the data lives.
Filing | Deadline | Form | Authority
| Obligation | What it means for cloud storage | Authority |
|---|---|---|
| Production on inspection | Records must be retrievable on the inspection day, regardless of physical location | Township labour office / IRD / SSB / OSH |
| Retention period | 7 years HR/payroll/SSB/IRD; 5 years OSH | Sectoral statutes |
| Confidentiality | Constitutional + sectoral + contractual duties continue | Civil / criminal courts |
| Sectoral data (banking / telecom / health) | May require Myanmar localisation under sector rules | Sectoral regulator |
| Cross-border transfer | No general PDPA — but contractual safeguards advised | Civil enforcement |
Process — safeguards to put in place
- Execute a written data-processing agreement with the cloud / HRIS provider covering: confidentiality, sub-processor controls, security standards (e.g. ISO 27001), audit rights, breach notification, return / destruction at contract end.
- Configure role-based access; enable audit logging.
- Maintain a list of where records are stored (region, data centre).
- Test export-on-demand quarterly to ensure records can be produced.
- For banking / telecom / health data, validate sectoral localisation rules before cloud-hosting overseas.
- Maintain a local backup or export to satisfy emergency-inspection requirements.
Records and retention
| Record type | Retention duration | Reason |
|---|---|---|
| Personnel files | 7 years post-exit | ESDL 2013 |
| Payroll / SSB / PAYE | 7 years | Sectoral statutes |
| Cloud DPA (data-processing agreement) | Life of contract + 7 years | Audit / dispute defence |
| Cloud audit logs | Per IT policy + 7 years | Breach investigation |
| OSH records | 5 years | OSH Law 2019 |
Employer takeaway
Overseas cloud storage of Myanmar employee records is permissible, but the employer retains primary responsibility for production-on-inspection and retention. Execute a written data-processing agreement, ensure on-demand access, run quarterly export tests, and maintain a local backup for emergency inspection. Sectoral data (banking, telecom, health) may carry separate localisation rules. Retain HR records 7 years post-exit; OSH 5 years.
Penalties for non-compliance
- Inability to produce on inspection — fine + remediation under the relevant statute.
- Wrongful disclosure via cloud breach — civil damages, ETL penalties.
- Sectoral localisation breach — sectoral fine + licence consequences.
Common cloud-storage mistakes
- Cloud HRIS without a written data-processing agreement.
- No local backup; total dependence on overseas cloud means a network outage delays inspection production.
- Storing banking / telecom / health subsets overseas without sectoral validation.
- No role-based access — every HR user can see every employee.
- See Myanmar PDPA status and HR records data-protection.
We publish practical, legally-grounded HR guidance for Myanmar employers. Each piece is reviewed by our compliance team against current MLIP and Labor Law requirements.