Data protection law in Bangladesh changed more in the last twelve months than in the previous twenty years. A standalone personal data law, first made by ordinance in November 2025 and amended in February 2026, now sets rules on consent, individual rights, localisation and cross-border transfers that reach almost every business holding customer or employee data.

Data protection law in Bangladesh: where things stand in 2026

For years Bangladesh had no general personal data statute. Privacy was protected only indirectly, through the Constitution, scattered provisions in technology and cyber laws, banking secrecy and sector licence conditions. Drafts of a Data Protection Act circulated from 2022 and a cabinet-approved draft appeared in 2023, but none was passed.

That changed under the interim government, and data protection law in Bangladesh now has a dedicated statute. The table below summarises the main steps. Because several of them were made by ordinance, the status of each instrument after the new Parliament met in 2026 matters as much as its content.

A note on the April 2026 position

Ordinances not approved by Parliament lapsed on 11 April 2026, and several, including the ACC amendment, did lapse. Professional commentary published after that date, including an April 2026 law-firm briefing and a July 2026 article in The Daily Star, treats the personal data regime as continuing, and refers to a Personal Data Protection Act 2026. We have not been able to inspect the gazetted Act, so check the final text, especially section numbers and penalty figures.

Other sources of privacy obligations

The new statute did not replace everything that came before. Data protection law in Bangladesh still draws on several older sources, and they continue to apply alongside it.

• The Constitution. Article 43 protects the privacy of a citizen's home, correspondence and other means of communication, subject to reasonable restrictions imposed by law.
• Cyber security legislation. The Cyber Security Ordinance 2025 replaced the Cyber Security Act 2023 and was in turn replaced by a cyber security law passed by Parliament in April 2026, amended again in June 2026. It covers unauthorised access, hacking and critical information infrastructure.
• The ICT Act 2006. Governs electronic records and signatures, and its appellate tribunal hears appeals under the new data regime.
• Telecommunications. The Bangladesh Telecommunication Act 2001 and BTRC licence conditions impose confidentiality duties on operators.
• Banking and finance. Banks owe customers a duty of confidentiality, and Bangladesh Bank's ICT security guidelines set technical standards for the sector.
• Right to Information Act 2009. Allows public authorities to refuse disclosure of information that would invade personal privacy.

Who the personal data rules apply to

The new data protection law in Bangladesh has a wide reach. It covers government bodies, autonomous and state-owned entities and private organisations that collect or process personal data in Bangladesh. It also reaches foreign entities that handle the personal data of Bangladeshi citizens, which matters for offshore platforms, outsourced call centres and group companies that host data abroad.

Data fiduciaries and processors

The law uses the term "data fiduciary" for the person or organisation that decides why and how personal data is processed, broadly what the GDPR calls a controller. A processor acts on the fiduciary's instructions, such as a cloud host, payroll provider or CRM vendor. The fiduciary remains responsible for what its processors do, so contracts must pass the obligations down the chain.

Significant data fiduciaries

Organisations whose processing could affect national sovereignty, economic stability or public safety can be designated as significant data fiduciaries. They face additional duties and closer oversight. The criteria and designation process are left to the regulator, so large banks, telecom operators, platforms and health providers should expect to be considered.

What counts as personal and sensitive data

Under data protection law in Bangladesh, personal data means any information that can identify a living individual, directly or indirectly: names, addresses, phone numbers, ID numbers, financial details, location data, online identifiers, and genetic and biometric data.

Sensitive personal data receives stronger protection. As described in official announcements and commentary, it includes biometric data, religion, caste, political affiliation, trade union membership, sexual orientation, health information, legal matters and geolocation. Processing it requires explicit consent and stronger security.

Children's data

Data of children, and of others who cannot give valid consent, needs the consent of a parent or legal guardian. Profiling, behavioural tracking and targeted advertising aimed at minors are prohibited, and automated decisions based on children's data are restricted. Ed-tech, gaming and social media businesses need to design for this from the start.

Lawful processing and consent

The core principles of data protection law in Bangladesh will be familiar to anyone who knows the GDPR or India's data law. Processing must be lawful, fair and transparent. Data may be collected only for specified, legitimate purposes, limited to what is necessary, kept accurate and retained only as long as the purpose requires.

Consent is the main lawful basis under data protection law in Bangladesh. It must be freely given, specific, informed and unambiguous, and it can be withdrawn at any time, after which processing must stop. Blanket consent buried in general terms and conditions is unlikely to be enough.

What you must tell people

At or before collection, the individual must be told why the data is collected, how it will be used, who will have access to it, whether it will be transferred, how long it will be kept and how to withdraw consent. In practice this means rewriting privacy notices, onboarding forms and app permission screens.

Processing without consent

The law allows processing without consent in limited cases: to comply with a legal obligation, where necessary for a contract with the individual, for public interest purposes and for national security. These exceptions must be proportionate and necessary. Relying on them should be a documented decision, not a default.

Rights of individuals

Data protection law in Bangladesh now treats individuals as the owners of their personal data, with organisations acting as custodians. Individuals can:

• Access the personal data held about them and learn how it is used.
• Correct inaccurate or incomplete data.
• Delete data that is no longer needed or was processed unlawfully, subject to legal retention duties.
• Withdraw consent at any time.
• Restrict automated decisions based on their data.
• Complain to the regulator and seek compensation for harm.

Expect the regulator to set response deadlines by regulation. Until then, build a documented process with a single intake channel, identity checks and a log of every request and response.

Security, breach notification and data protection officers

Data protection law in Bangladesh requires fiduciaries to protect personal data with appropriate technical and organisational measures: access controls, encryption where appropriate, logging, vendor checks and staff training. The standard rises for sensitive data and for significant data fiduciaries.

Under data protection law in Bangladesh, a personal data breach must be reported promptly to the regulator, with a description of the incident, the likely risk to affected individuals and the remedial steps taken. The published summaries do not give a fixed number of hours, so watch for regulations that set one, and plan to notify within days, not weeks.

Data protection officers

Organisations are expected to appoint data protection officers during the transition period, with details to follow in regulations. Even where the law ends up making this mandatory only for significant fiduciaries, naming an accountable lead is good practice for any organisation handling customer data at scale.

Data localisation and cross-border transfers

Localisation is the area where data protection law in Bangladesh differs most from the GDPR. The February 2026 amendment rewrote section 29: for critical information infrastructure, as defined in cyber security law, and for restricted personal data, at least one synchronised, real-time copy of data stored in the cloud must be kept within Bangladesh.

Other personal data may be transferred abroad only to a country or organisation that ensures an equivalent level of protection. The government had not published a list of adequate jurisdictions by mid-2026, and "equivalent protection" is not yet defined in detail. Transfers for law enforcement or international cooperation must follow formal agreements.

What this means for cloud and group hosting

Companies using foreign cloud regions or group data centres should identify which datasets are restricted or relate to critical infrastructure, plan for an in-country synchronised copy where required, and put contractual safeguards in place for other transfers. Our technology and digital practice advises on these hosting arrangements.

The regulator, enforcement and penalties

The regulator is a National Data Governance Authority established under the National Data Governance Ordinance 2025; some official English releases call it the National Data Management Authority. Its functions include issuing regulations, codes and technical standards, registering and classifying fiduciaries, auditing, investigating complaints and imposing administrative fines. Appeals against its decisions go to the appellate tribunal under the ICT Act 2006.

Penalties under data protection law in Bangladesh have moved during drafting. The October 2025 approved version provided for imprisonment of up to seven years, fines, or both for unauthorised collection, use or disclosure. The February 2026 amendment replaced imprisonment with fines for the offences in section 48. Later commentary describes administrative fines of different scales, including turnover-based figures for significant fiduciaries. Because the figures differ between sources, check the current Act before quoting any number.

Directors and responsible officers can be personally liable for a company's offence unless they show due diligence, and anyone who aids or encourages an offence faces the same liability.

A roadmap for compliance with data protection law in Bangladesh

With the transition expected to end around May 2027, the practical question is what to do first. This is the sequence we recommend to clients:

1. Map your data. List what personal data you hold, why, where it is stored, who can access it and which vendors process it.
2. Classify it. Separate sensitive data, restricted data, children's data and data linked to critical systems, because each attracts extra rules.
3. Fix the legal basis. Decide the lawful basis for each purpose, and rewrite consent forms and privacy notices to meet the new standard.
4. Build rights processes. Create a channel, procedure and log for access, correction, deletion and withdrawal requests.
5. Review hosting and transfers. Identify data held abroad, plan in-country copies where needed and paper other transfers with safeguards.
6. Secure and prepare. Close security gaps and write a breach response plan that names who decides, who notifies and how fast.
7. Assign ownership. Appoint a data protection lead, train staff and report to the board.

Common mistakes to avoid

Early reviews of client systems against data protection law in Bangladesh show the same gaps again and again:

• Copied privacy policies. A policy borrowed from a foreign website that refers to the GDPR, names no Bangladeshi contact and does not match what the business actually does.
• Consent by default. Pre-ticked boxes, or consent bundled into general terms, which will not meet the standard of specific, informed consent.
• No vendor inventory. Nobody can list which cloud, marketing, analytics or payroll providers receive customer or staff data, or where they host it.
• Indefinite retention. Old customer files, CVs and CCTV footage kept for years with no retention schedule or deletion routine.
• Shared logins. Generic accounts for core systems, which make it impossible to show who accessed what in a breach investigation.
• Waiting for regulations. Delaying all work until the regulator issues detailed rules, then facing a short window to rebuild systems.

None of these needs a large budget to fix. Most can be addressed with an inventory, a few rewritten documents and clear internal ownership, which also put a business in a stronger position if the regulator or a customer raises a complaint.

Sector notes

Banks, fintech and mobile financial services

Financial institutions must reconcile data protection law in Bangladesh with Bangladesh Bank rules, KYC record-keeping duties under anti-money laundering law and banking confidentiality. Legal retention duties override deletion requests, but must be explained to customers.

Telecom operators and digital platforms

Alongside data protection law in Bangladesh, operators already face BTRC licence conditions on subscriber data and lawful interception. Expect them to be early candidates for significant fiduciary designation. Our guide to BTRC compliance covers the licensing side.

Employers

HR files, CCTV, biometric attendance systems and background checks all involve personal data, some of it sensitive. Review notices to staff, retention schedules and access rights to HR systems.

Foreign companies and outsourcing

Foreign groups processing Bangladeshi customer data offshore, and Bangladeshi BPO firms processing foreign data, should map which law applies to which dataset and align contracts with both regimes.

Frequently asked questions about data protection law in Bangladesh

How we can help

We help banks, fintechs, telecom and technology companies, healthcare providers, employers and foreign groups comply with data protection law in Bangladesh: data mapping, privacy notices and consent flows, vendor and intra-group transfer agreements, localisation planning, breach response and dealings with the regulator. Learn more about our data protection and privacy practice.

Primary sources: the Personal Data Protection Ordinance 2025 and later instruments, the ICT Act 2006 and the Bangladesh Telecommunication Act 2001 on the Laws of Bangladesh portal; the Bangladesh Telecommunication Regulatory Commission; Bangladesh Bank ICT security guidelines.

This article is general information about Bangladeshi law as of October 2026 and is not legal advice. The personal data framework changed several times in 2025 and 2026 and regulations are still awaited; confirm the current text with a qualified lawyer before acting.