A privacy policy in Bangladesh tells customers, users and employees what personal data a business collects, why, who it is shared with and how it is protected. Bangladesh's data protection framework has changed rapidly, with a personal data protection ordinance in 2025 and a new cyber security law passed by Parliament in April 2026, alongside sector rules for banks, telecoms and e-commerce. A clear, accurate privacy notice is now a basic legal and commercial requirement.
- A privacy notice should explain what data is collected, the purposes, legal basis, sharing, transfers, retention, security and individuals' rights.
- A personal data protection ordinance was issued in 2025; its status after the April 2026 parliamentary session should be checked before relying on specific provisions.
- Cyber security legislation, sector regulators and e-commerce guidelines impose additional data and security obligations.
- Businesses serving users in the EU or other regions may also need to meet foreign laws such as the GDPR.
- The policy must match actual practice; an inaccurate notice can itself create legal and reputational risk.
Why a privacy policy in Bangladesh matters
Digital services in Bangladesh, from mobile financial services and e-commerce to ride-hailing, telemedicine and online education, collect vast amounts of personal data. Users, regulators, investors and international partners expect businesses to explain how that data is handled. A privacy policy in Bangladesh builds trust, supports compliance with current and emerging laws, and is often required by app stores, payment gateways and foreign clients.
Our data protection and privacy practice helps businesses draft notices and build compliance programmes.
The legal landscape
| Source | Relevance to privacy notices |
|---|---|
| Personal data protection ordinance (2025) | Introduced a data protection framework; confirm whether it remains in force or has been replaced |
| Cyber security law (2026) | Cyber offences, critical information infrastructure and security duties |
| Information and Communication Technology Act 2006 | Electronic records, signatures and certain data-related provisions |
| Bangladesh Bank rules | Customer data, ICT security and confidentiality for financial institutions |
| BTRC regulations | Subscriber data and lawful interception for telecom operators |
| Digital commerce guidelines | Customer information and transparency for e-commerce platforms |
| Foreign laws (GDPR and others) | Apply when targeting or monitoring users abroad |
Because the framework is evolving, a privacy policy in Bangladesh should be reviewed whenever laws or business practices change.
What a compliant privacy notice should cover
- Who you are. Company name, contact details and, where appointed, a data protection contact.
- Data collected. Categories of personal data, such as identity, contact, financial, location, device and usage data, and any sensitive data.
- Sources. Whether data comes directly from users, from partners or from public sources.
- Purposes. Why each category is used, such as providing services, payments, security, marketing or legal compliance.
- Legal basis. Consent, contract, legal obligation or legitimate interests, as recognised by applicable law.
- Sharing. Categories of recipients, including service providers, group companies, regulators and law enforcement.
- Transfers. Whether data is stored or processed outside Bangladesh and the safeguards used.
- Retention. How long data is kept and why.
- Security. General description of technical and organisational measures.
- Rights. How individuals can access, correct, delete or object, and how to complain.
- Cookies and tracking. Use of cookies, analytics and advertising tools.
- Children. Rules for services used by minors.
- Changes. How updates will be communicated.
Write in plain language, and consider a Bangla version for local users. Regulators and courts look at whether ordinary users could understand what they were agreeing to.
Consent and children
Consent is a recurring issue in any privacy policy in Bangladesh. Where consent is the basis for processing, it should be informed, specific and freely given, with an easy way to withdraw. Bundling unnecessary consents with service terms is poor practice. Services aimed at children require particular care, including parental consent where appropriate and limits on profiling and marketing. A privacy policy in Bangladesh for education or gaming apps should address these points directly.
Cross-border transfers and cloud services
Many Bangladeshi businesses use foreign cloud providers or group systems abroad. Data localisation and transfer conditions have been debated in the context of the data protection ordinance and sector rules, especially for financial and telecom data. The notice should disclose transfers and the safeguards used, and the business should check whether any regulator requires local storage or approval for certain data.
Security and breach handling
Security commitments in a privacy policy in Bangladesh must be realistic. A privacy notice should not promise perfect security, but it should describe reasonable measures such as encryption, access controls and staff training. Behind the notice, businesses need incident response plans to detect, contain and assess breaches, and to notify regulators and affected individuals where required by law or contract. Financial institutions must also follow Bangladesh Bank ICT security guidelines on incident reporting.
Employee privacy notices
Employers collect extensive personal data about staff: identity documents, bank details, salary, health information, performance records and, increasingly, biometric attendance data and CCTV footage. A separate employee privacy notice explains how this data is used for payroll, compliance with the Labour Act 2006 and tax law, security and HR management. Monitoring of emails, devices or locations should be disclosed and proportionate. An internal privacy policy in Bangladesh for employees is as important as the public-facing notice, especially for multinationals that apply global standards.
Sector-specific considerations
Banks, finance companies and mobile financial services must protect customer confidentiality under banking law and Bangladesh Bank guidelines, and must also comply with KYC and AML record-keeping. Telecom operators handle subscriber data subject to BTRC rules and lawful interception requirements. Healthcare providers handle sensitive health data and should take particular care with consent and access. E-commerce platforms are expected to protect customer information and handle complaints under digital commerce guidelines and consumer protection law. A privacy policy in Bangladesh should reflect the specific rules of the sector in which the business operates.
Data processing agreements with vendors
Most businesses rely on vendors for hosting, payments, marketing, analytics and customer support. Contracts with these vendors should require them to process data only on instructions, keep it confidential and secure, assist with rights requests and breaches, and delete or return data at the end of the relationship. Where vendors are abroad, contracts should include transfer safeguards. The public privacy policy in Bangladesh should describe categories of vendors without necessarily naming each one.
Handling user rights requests
Users may ask to access their data, correct errors, delete accounts or stop marketing messages. Businesses should set up a simple process, such as a dedicated email address or in-app form, verify the requester's identity, respond within a reasonable time and keep records of requests. Clear handling of these requests demonstrates that the commitments in the privacy policy in Bangladesh are real.
Common mistakes
- Copying a foreign template that does not reflect actual practices.
- Failing to disclose data sharing with partners or advertisers.
- Promising never to share data while sharing with vendors or authorities.
- Omitting cookies and tracking technologies.
- No process for handling user requests or complaints.
- Never updating the policy after new features are launched.
Avoiding these mistakes makes a privacy policy in Bangladesh a credible document rather than a legal risk.
Marketing, SMS and push notifications
Bangladeshi businesses rely heavily on SMS marketing, push notifications and social media advertising. The privacy policy in Bangladesh should explain how marketing preferences are collected and how users can opt out. BTRC rules and telecom operator policies regulate bulk SMS, and unsolicited marketing can generate complaints. Using customer data for targeted advertising through third-party platforms should be disclosed, with an option to object where required.
Government requests and law enforcement
Businesses may receive requests from law enforcement, regulators or courts for user data. The privacy notice should state that data may be disclosed where required by law, and internal procedures should verify the legal basis of each request, limit disclosure to what is required and keep records. Telecom and financial institutions face specific legal obligations in this area. Transparency about this possibility, without revealing confidential details of specific requests, is part of an honest privacy policy in Bangladesh.
Data retention schedules
Keeping data forever increases risk and cost. Businesses should set retention periods for each category of data based on legal requirements, such as tax and AML record-keeping periods, and business needs, then delete or anonymise data when it is no longer needed. The privacy policy in Bangladesh can summarise these periods in general terms, while a detailed internal schedule guides staff.
Practical checklist
- Complete a data map before drafting.
- Check the current status of the data protection ordinance and sector rules.
- Draft in plain English and Bangla.
- Disclose sharing, transfers, cookies and retention honestly.
- Set up processes for rights requests and breaches.
- Review the privacy policy in Bangladesh at least once a year.
Mobile apps and permissions
Mobile apps often request access to contacts, location, camera, microphone and storage. Each permission should be necessary for a feature the user wants, and the notice should explain why it is requested. App stores require a privacy policy link and increasingly require data safety disclosures that must match the policy. Inconsistencies between the app store declaration and the policy can lead to app removal. Developers should review permissions whenever features change and remove access that is no longer needed, then update the notice to match. Clear in-app explanations at the moment a permission is requested also improve user trust and acceptance rates.
Artificial intelligence and automated decisions
Fintech lenders use credit scoring algorithms, and other businesses use automated tools to detect fraud, personalise content or screen job applicants. Where automated decision-making significantly affects individuals, good practice is to disclose it, explain the logic in general terms and offer a route to human review. Emerging data protection rules in many countries address these issues, and transparency builds trust with Bangladeshi users as well. Including a short section on automated decisions in your privacy policy in Bangladesh prepares the business for future regulation.
Frequently asked questions about privacy policy in bangladesh
Is a privacy policy legally required in Bangladesh?
Data protection, sector and e-commerce rules, as well as app stores and payment partners, effectively require one for most online businesses.
Which data protection law applies?
A personal data protection ordinance was issued in 2025; confirm its current status, together with cyber security and sector rules.
Should the policy be in Bangla?
A Bangla version is good practice for local users, alongside English.
Do I need to mention cookies?
Yes, if your website or app uses cookies, analytics or advertising trackers.
Does GDPR apply to Bangladeshi companies?
It can, if they offer services to or monitor individuals in the EU.
How often should the policy be updated?
Whenever laws or data practices change, and at least annually.
How we can help
We draft and review every type of privacy policy in Bangladesh: website and app notices, employee privacy notices, cookie policies, data processing agreements, transfer assessments and breach response plans. Learn more about our data protection and privacy practice and our technology and digital practice.
Need a privacy policy that matches your business?
We map your data, draft clear notices and keep you aligned with Bangladesh's evolving rules.
Book a consultationData protection practicePrimary sources: the Information and Communication Technology Act 2006 and other laws on the Laws of Bangladesh portal; ICT security guidelines of Bangladesh Bank; telecom regulation by BTRC.
This article is general information about Bangladeshi data protection law as of October 2026 and is not legal advice. The legal framework is changing; confirm the current position before relying on any provision.
0 Comments