Cyber security law in Bangladesh has changed three times in three years. The Digital Security Act 2018 gave way to the Cyber Security Act 2023, which was replaced by an interim ordinance in 2025 and then re-enacted by Parliament in 2026. Businesses and individuals need to know which offences survive, which were dropped and what is expected of organisations.

How cyber security law in Bangladesh evolved

The history of cyber security law in Bangladesh matters, because cases filed under older laws still affect people and businesses, and because the names of the laws are easily confused. The Information and Communication Technology Act 2006 was the first major cyber statute. Its section 57 on online speech was widely criticised and was replaced by the Digital Security Act 2018, which itself became notorious for arrests over social media posts.

In 2023, Parliament repealed the Digital Security Act and passed the Cyber Security Act 2023, which kept much of the structure but reduced some penalties. After the change of government in August 2024, the interim government replaced that Act with an ordinance in 2025, usually translated as the Cyber Protection Ordinance 2025, and later amended it to void pending cases under certain speech-related sections of the old Digital Security Act.

The 2026 Act

Following the parliamentary election, the new Parliament reviewed interim ordinances in April 2026. It adopted a successor cyber law closely based on the 2025 ordinance; English reports translate its title variously as the Cyber Safety Act 2026 or Cyber Protection Act 2026. In June 2026, Parliament passed a Cyber Security (Amendment) Bill 2026 removing section 20 on online gambling, after the government said a separate Gambling Prevention law now covered it. Because translations differ, always refer to the Bengali gazette text for the exact title and section numbers.

What changed in 2025 and 2026

The central policy change was a move away from criminalising speech. According to analysis by a former ICT Division policy analyst published in 2026, the new framework removed offences relating to political speech, defamation, wounding religious sentiment, damaging the image of the Liberation War and vague "offensive" content. Disinformation was deliberately not criminalised.

At the same time, the reforms kept or strengthened offences aimed at concrete harms: incitement to violence against religious or ethnic groups, sexual harassment online, revenge pornography and child sexual abuse material, together with traditional cyber crimes such as illegal access, hacking, data theft and online fraud. For businesses, the practical effect is that cyber security law in Bangladesh now focuses more on attacks on systems and on people, and less on what people say.

Procedural safeguards

Reports on the Act describe several safeguards. Only the person harmed, their written representative or the police may file a complaint under a standing provision; police generally need a magistrate's warrant for search and seizure; cases must be placed before a magistrate within twenty-four hours; and filing a false complaint is itself punishable. These were designed to stop the misuse seen under the Digital Security Act.

Offences under cyber security law in Bangladesh

Exact section numbers should be taken from the gazetted Act, but the main categories of offences relevant to organisations are as follows.

• Illegal access. Accessing a computer, system or network without authorisation, including critical information infrastructure.
• Damage and disruption. Introducing malware, deleting or altering data, denial-of-service attacks and interfering with systems.
• Computer-related fraud and forgery. Using digital means to cheat, impersonate or forge records, including phishing and account takeover.
• Identity misuse. Using another person's identity information without authority.
• Online sexual harassment and image abuse. Sharing intimate images without consent, sextortion and harassment.
• Child sexual abuse material. Producing, sharing or possessing such material.
• Cyber terrorism. Attacks intended to threaten national security or public order through digital means.
• Blackmail. Threatening to expose private information or cause harm to obtain an unlawful benefit.

Penalties vary by offence and include imprisonment and fines, with higher penalties for attacks on critical information infrastructure and repeat offences. Some offences are bailable and others are not.

Interaction with other laws

Cyber crimes often overlap with other statutes: the Penal Code 1860 for cheating, extortion and criminal intimidation; the Pornography Control Act 2012; the Money Laundering Prevention Act 2012 for proceeds of online fraud; and the Bangladesh Telecommunication Regulatory Act 2001 for telecom-related offences. Prosecutors may choose among them, so defence and complaint strategies should consider all relevant laws.

Agencies and enforcement

Under cyber security law in Bangladesh, the National Cyber Security Agency, created under the earlier cyber security framework, coordinates national cyber security, supports critical information infrastructure and runs incident response functions. The ICT Division of the Ministry of Posts, Telecommunications and Information Technology leads policy. The Bangladesh Telecommunication Regulatory Commission (BTRC) regulates operators and can direct blocking of content under its own law.

Investigation and prosecution are carried out by the police, including specialised cyber units of the Criminal Investigation Department and the Dhaka Metropolitan Police, with cases tried by designated tribunals or courts as the Act provides. For regulated sectors, Bangladesh Bank and BSEC issue their own cyber security guidelines, which carry regulatory consequences independently of criminal law.

Obligations for organisations

Most criminal provisions target attackers, but cyber security law in Bangladesh also places expectations on organisations, especially those operating critical information infrastructure, financial services and telecoms.

• Critical information infrastructure. Entities designated as critical information infrastructure must meet security standards, allow audits and report incidents to the national agency.
• Financial sector. Banks and financial institutions follow Bangladesh Bank's ICT security guidelines, including incident reporting, testing and governance requirements.
• Capital market. Exchanges, brokers and other intermediaries follow BSEC cyber security directives.
• Telecoms. Operators follow BTRC licence conditions on security and lawful interception.
• Cooperation. All organisations may be asked to preserve and produce data for investigations under lawful orders.

Even where no specific statutory duty applies, a company that fails to protect customer data or systems may face civil claims, regulatory action and reputational damage. Strong security is therefore both a legal and commercial necessity.

Cyber security law in Bangladesh for banks and fintech

Financial institutions sit at the sharp end of cyber risk. Bangladesh Bank's ICT security guidelines require banks to maintain board-approved information security policies, appoint responsible officers, segregate duties, test systems, manage third-party risk and report significant incidents to the central bank. The 2016 theft from Bangladesh Bank's own account at the Federal Reserve Bank of New York remains the reference case that shaped these rules.

Mobile financial service providers, payment system operators and fintech partners of banks are expected to meet comparable standards through licence conditions and contracts. For a fintech, compliance with cyber security law in Bangladesh therefore means meeting criminal law, the regulator's guidelines and the bank partner's contractual requirements at the same time. Contracts should allocate responsibility for breaches, set notification timelines and give audit rights.

Customer fraud and liability

Account takeover and social engineering frauds raise the question of who bears the loss: the customer or the institution. Outcomes depend on the account terms, the institution's security measures and the customer's conduct. Institutions that can show strong authentication, clear warnings and prompt response are in a much stronger position.

Employees, social media and workplace policies

Changes to cyber security law in Bangladesh do not remove an employer's interest in how staff use company systems and social media. Workplace policies should cover acceptable use, confidentiality, use of personal devices, monitoring and the consequences of misuse. Monitoring should be proportionate and disclosed in policy, and investigations should follow fair procedures.

Where an employee leaks confidential data, harasses colleagues online or uses company systems for fraud, the employer may have both disciplinary and criminal options. Choose carefully, preserve evidence first, and take advice before filing any complaint, so that the company's own conduct cannot be criticised.

Personal data protection

Data protection has been debated alongside cyber security law in Bangladesh for years. In 2025, the interim government's Advisory Council approved a Personal Data Protection Ordinance 2025 and a National Data Management Ordinance 2025, intended to set rules on consent, processing, data subject rights and cross-border transfers. Their status after the April 2026 parliamentary review of ordinances has not been confirmed in the sources we checked.

Organisations should therefore plan on two levels: follow sector rules that clearly apply today, such as Bangladesh Bank and BTRC requirements, and prepare for a comprehensive data protection regime by mapping personal data, documenting lawful bases and tightening vendor contracts. Our data protection practice tracks the status of these laws.

Building a cyber compliance programme

A practical programme under cyber security law in Bangladesh does not need to be complicated. The steps below suit most mid-sized companies.

1. Map assets and data. List systems, cloud services, data types and where personal data is stored.
2. Assign responsibility. Appoint a senior officer accountable for information security, with a cross-functional incident team.
3. Set controls. Implement access management, multi-factor authentication, patching, backups and logging.
4. Train people. Run regular training on phishing, payment fraud, social engineering and data handling.
5. Plan for incidents. Write an incident response plan covering containment, evidence preservation, notification and communications.
6. Manage vendors. Include security, audit, breach notification and data location clauses in IT and cloud contracts.
7. Review regularly. Test controls, update policies and monitor legal changes at least annually.

When your organisation is attacked

Business email compromise, ransomware and payment fraud are the incidents under cyber security law in Bangladesh that we see most often. The first hours matter. Isolate affected systems, preserve logs and evidence, notify your bank immediately if funds have been transferred, and consider whether regulators or the national agency must be informed. Then decide, with legal advice, whether to file a complaint with the police under the cyber law and other statutes.

Complaints should be precise: what happened, when, which systems and accounts, what loss, and who may be responsible. Supporting evidence such as email headers, transaction records and screenshots should be preserved in their original form. Where funds were moved through banks or mobile financial services, rapid reporting can sometimes allow freezing before money disappears.

If you are accused under cyber security law in Bangladesh

Individuals and employees accused of cyber offences should seek legal advice immediately. Key early questions include whether the complainant has standing, whether the correct and current law is cited, whether search and seizure followed the warrant requirements, whether the case was placed before a magistrate in time and whether bail is available. Cases filed under repealed speech provisions may be challenged on that basis.

Employers should not automatically dismiss an employee who is accused, but should assess risk, protect evidence and follow disciplinary procedures under the Bangladesh Labour Act 2006 where applicable. Where the alleged conduct used company systems, the company itself may be asked for data and should respond through counsel.

Frequently asked questions about cyber security law in bangladesh

How we can help

We advise companies and individuals on cyber security law in Bangladesh: compliance programmes, incident response, regulatory reporting, complaints to law enforcement, defence of accusations and data protection readiness. Learn more about our data protection and privacy practice and our technology and digital work.

Primary sources: cyber and ICT statutes on the Laws of Bangladesh portal; regulatory directions of the BTRC and Bangladesh Bank; reporting in The Financial Express (30 June 2026), bdnews24.com (updated August 2026) and Netra News (2026).

This article is general information about Bangladeshi law as of October 2026 and is not legal advice. The cyber law framework changed repeatedly in 2023 to 2026 and English translations of titles vary; confirm the current Bengali text and status with a qualified lawyer before acting.