Call Recording, Customer Data and AI Transcription in Bangladesh: Privacy Rules for Telecom and BPO Businesses

Call recording law Bangladesh: what changed in 2026

Call recording law Bangladesh businesses must follow in 2026 is no longer a matter of habit and client preference. Three statutes now meet on every recorded call: the Personal Data Protection Act 2026, which treats a caller's voice, number and location as personal data and a voiceprint as sensitive data; the Bangladesh Telecommunication Act 2001 as rewritten by Act No. 51 of 2026, which criminalises eavesdropping and the unauthorised collection of call records; and the licence and registration conditions that tell operators and call centres what they must keep and hand over.[1] [2]

This guide is for telecom operators, BPO and contact-centre providers, in-house helplines and their overseas clients. It answers one question: what a business may collect, record, retain, analyse and transfer when it handles calls in or from Bangladesh, from call-detail records and notices through retention, hosting, processor contracts and breach response to training AI systems on recordings and transcripts.

Summary: A business that records or transcribes calls in Bangladesh is processing personal data and needs a lawful ground, a clear notice, a retention limit and security proportionate to the content. Call-detail records that BTRC conditions require must be kept for at least six months and produced on demand, but they are personal data too. Listening to other people's conversations without lawful authority is an offence, and repurposing recordings for analytics or AI needs a compatible purpose or fresh consent.

Key point: The core duties under the Personal Data Protection Act 2026 have applied since 6 November 2025; only complaints, administrative fines, compensation and the Chief Data Officer requirement await a gazette date. A recording programme that cannot show consent or another lawful ground, a notice, a retention rule and access logs is already non-compliant.

At a glance

Swipe or scroll →

Table of Contents

Call recording law Bangladesh: three regimes on every call

No single statute is titled a call recording law, so the answer comes from reading three regimes together. The Personal Data Protection Act 2026 (Act No. 63 of 2026) governs what may be done with information about identifiable people, including callers and agents.[1] The Bangladesh Telecommunication Act 2001, amended by the Bangladesh Telecommunication (Amendment) Act 2026 with effect from 5 February 2026, protects the confidentiality of communications and defines the offences.[2] Both statutes were gazetted on 10 April 2026.[3] BTRC licence guidelines and registration conditions then add record-keeping, monitoring and disclosure duties for the businesses they cover.

The wider telecom framework, including BTRC's powers and the 2026 interception reforms, is explained in our guide to telecommunications law in Bangladesh. The full readiness checklist for the data statute is in our data protection compliance guide. This article applies both to recorded voice traffic.

What is switched on now

Section 1(3) of the data protection statute deems it in force from 6 November 2025, except section 23 on Chief Data Officers and sections 31 to 35 on complaints, administrative fines and compensation, which start on a date the government notifies after 18 months.[1] As at 31 October 2026 we found no such notification. The core duties therefore already bind every recording programme, and the telecom offences are fully in force.

Who the rules reach

Section 1(2) applies the data statute to processing inside Bangladesh and to processing outside Bangladesh connected with supplying goods or services to, or monitoring or profiling, people in Bangladesh.[1] A Dhaka centre recording calls for a London client, and a Singapore platform analysing Bangladeshi customers' calls, are both within reach.

Call-detail records versus conversation recordings

The first discipline of call recording law Bangladesh compliance is to separate what describes a call from what captures it. The two attract different obligations, retention rules and criminal exposure.

What a call-detail record is

BTRC's call centre instructions define a call-detail record (CDR) as the file generated for every incoming and outgoing call, including the calling and called numbers, origin and destination, duration, time and location.[5] The data statute's definition of personal data expressly lists mobile numbers and location data, so a CDR is personal data whenever it links to an identifiable caller or agent.[1] Real-time location data is also listed as sensitive personal data.[1]

Records the regulator requires

Registered call centres must be able to record and store all CDRs for at least six months, keep daily traffic-monitoring (MRTG) records for six months, and provide the CDRs of specified calls whenever BTRC or the monitoring authority asks.[5] IP telephony licensees must maintain at the regulator a console holding traffic data, log files and a CDR and IP detail record dump for six months, and must keep a subscriber register with name, address and national ID number.[6] These regulatory minimums supply a lawful ground for keeping that data.

Conversation recordings

No general rule in the statutes or the BTRC conditions we reviewed requires a business to record call content. Recording is a choice, usually driven by quality assurance, dispute evidence, client contracts or regulation in the client's own country. Because it is a choice, the business must justify it under the data statute, tell callers about it, limit how long it is kept and secure it. Content is also where health details, card numbers and third-party complaints appear.

Transcripts and derived data

A transcript is the recording in another format, and analytics outputs such as sentiment scores, keyword flags and agent performance ratings are personal data about the people they describe. The statute defines profiling as automated evaluation or prediction of a person's preferences, behaviour, reliability or movements, which covers most speech analytics.[1] Every derived dataset inherits the limits of its source recording.

When recording or listening becomes an offence

The criminal side of call recording law Bangladesh operators face sits in the Telecommunication Act. The 2026 amendment rewrote the relevant sections, so policies written against the 2001 text are out of date.

Eavesdropping under section 71

The original 2001 text punished intentionally listening to a telephone conversation between two other persons.[4] The 2026 replacement covers a person who, in breach of the Act, intentionally eavesdrops using telecom equipment on a conversation between two or more other persons, with up to two years' imprisonment, a fine of up to Tk 1.5 crore, or both. New section 71(2) applies the same penalty to surveillance or harassment of citizens using SIM and device registration data.[2] [8]

Participants, supervisors and silent monitoring

An agent who records a call to which the agent is a party is not listening to a conversation between two other persons. A supervisor who silently monitors an agent's live call is in a different position, because the supervisor is not a party. Monitoring by the business that runs the line, disclosed in advance and done for a documented purpose, is defensible; covert listening, or monitoring outside the disclosed purpose, is where prosecution risk lies.

Operator staff and stolen call records

Operator employees commit an offence if they use equipment to obtain information about the sender, recipient or content of a message without BTRC authority, or disclose such information outside Commission or court proceedings, with up to five years or Tk 35 lakh.[2] New section 72A(3) goes further: anyone, other than a security agency or an authorised representative of a licensed operator, who without BTRC or government written permission intrudes into a telecom network or collects or transfers its data commits an offence. The explanation lists call-detail records, IP data, traffic data, subscriber information and operator data, and the penalty is up to five years or Tk 49 crore.[2]

Processing grounds for recordings and transcripts

Every recording, CDR and transcript needs a lawful basis recorded before collection. Section 5 makes consent the primary basis, and the fiduciary bears the burden of proving it was validly given.[1]

Consent and what callers must be told

Consent must be voluntary, specific, clear and withdrawable, and the data subject must be told the purpose, the retention period, any transfer and how to withdraw before consent is taken.[1] Continuing a call after a recorded message is weak evidence of consent for sensitive or secondary uses; offer a real alternative, such as an unrecorded callback.

Grounds that do not depend on consent

Section 5(3) permits processing without consent where a legitimate ground exists and the processing is necessary, proportionate and purpose-limited: performance of a contract with the data subject, steps at the data subject's request before contracting, establishing or defending legal claims, vital interests, employment and social security rights, and data the subject has made public.[1] Recording a telephone sale to prove the order can rest on these grounds; blanket recording for unspecified future use cannot.

Voiceprints and biometric authentication

The statute's definition of biometric data expressly includes a voiceprint, alongside fingerprints, facial images, iris scans and gait, and biometric data is sensitive personal data.[1] Section 7 limits sensitive data processing to specific grounds, led by the data subject's specific consent.[1] Voice authentication, speaker identification and emotion detection that relies on vocal characteristics therefore need specific consent or another section 7 ground, separately captured. The risk is real: in December 2025 investigators found retailers had unlawfully stored customers' biometric data and used it to activate SIMs without consent.[10]

Children and callers who cannot consent

Under section 9, a child's data, meaning a person under 18, may be processed only with a parent's or guardian's consent in the manner regulations prescribe.[1] Helplines that take calls from minors need a rule on whether those calls are recorded at all.

Recording notices that stand up

Section 15 requires transparent notice of the categories of data collected and how, the purposes, higher-risk categories, how to exercise rights and complain to the Authority, any transfer elsewhere, and the fiduciary's identity and contact details.[1] Use layers.

• Inbound calls: a short message stating that the call is recorded, who is recording it, the main purposes, and where to hear or read the full notice.
• Outbound calls: the agent states the recording at the outset, before collecting any detail, and logs the caller's response.
• Full notice: a web page and an SMS link setting out purposes, retention periods, transfers abroad, analytics and AI uses, and the rights process.
• Agents: written notice in the employment or engagement terms, covering monitoring, screen capture, performance analytics and disciplinary use.

Section 13(6) adds a duty that catches many analytics programmes: a fiduciary must not carry out automated processing or transfer of personal data without informing the data subject.[1] If transcripts are produced by speech-to-text engines, or calls are scored by software, the notice should say so.

Retention of recordings, CDRs and transcripts

Retention is where call recording law Bangladesh duties pull in opposite directions. Section 18 prohibits keeping personal data longer than the period prescribed for its purpose. Section 19 requires the fiduciary to keep all records relating to personal data it processes in a register for at least five years, unless another provision specifies otherwise.[1] The answer is to separate the data from the record of processing: delete or anonymise recordings when their purpose ends, but keep the log showing what was recorded, why, who accessed it and when it was deleted.

The BTRC six-month CDR floor applies to registered call centres and IP telephony licensees; it is a minimum, not a licence to keep CDRs forever.[5] [6] Client contracts often require longer retention for regulatory reasons in the client's country, and litigation holds can freeze deletion. Each exception should be documented with its legal basis and end date.

Deletion must be complete. Section 14(6) applies correction and erasure propagation to mirrors, caches, backups, disaster recovery copies, test environments and migration datasets held by any fiduciary or processor.[1] A recording deleted from the live platform but kept in a quality-assurance export or an analytics sandbox has not been deleted. The table below sets out a working retention map.

Overseas hosting and cross-border access

Under section 29, classified personal data may be transferred abroad with the data subject's consent, as part of a contract with the data subject for goods or services, or with consent for matters such as business, education, travel or immigration, and only to places with the technology and equipment regulations prescribe as adequate.[1] Until those regulations exist, document an adequacy assessment for each destination and vendor.

Two further rules matter for recordings. Section 29(6) requires mandatory notification to the Authority of bulk cross-border transfers of sensitive identifiers, including biometric identifiers.[1] A voice-biometric database replicated offshore is a candidate. And the Authority may order the suspension of personal data supplies to a foreign state or international organisation under section 26.[1]

Remote access is a transfer question too

A client's quality team in another country that streams recordings from a Bangladeshi server is receiving personal data abroad, even if nothing is copied. Registered call centres must also keep any disaster recovery centre inside Bangladesh and must provide monitoring access to the regulator where they use VPNs or encryption.[5]

Processor contracts between BPOs, clients and vendors

In most outsourced arrangements the overseas or local client is the data fiduciary for its customers' calls and the BPO is the processor. Section 8 treats processing by a processor as processing by the fiduciary, keeps the fiduciary liable for it, and requires the fiduciary to take reasonable steps to ensure the processor complies.[1] Processors are directly responsible for meeting the statute's security standards under section 17(5).[1] The BPO is itself a fiduciary for its employees' data and for any analytics it runs for its own purposes.

BTRC's call centre conditions add their own layer: a registered centre must take adequate measures to protect clients' sensitive or confidential information, and must give BTRC copies of its client agreements on demand.[5] A processing schedule should cover, at minimum:

• the categories of calls recorded, the purposes and the lawful basis relied on by the client;
• written instructions on recording, transcription, analytics and AI use, with a ban on use for the BPO's own purposes unless agreed;
• security measures, access controls and audit rights;
• sub-processor approval, including speech-to-text and cloud vendors;
• breach notification to the client within a fixed number of hours;
• retention periods, deletion certificates and the treatment of backups;
• handling of regulator and police requests in Bangladesh.

The commercial side of the relationship, including service levels, liability caps and termination, is covered in our companion guide to international call-centre outsourcing contracts. Hosting vendors should read our analysis of cloud PBX platforms.

Access controls and security for recording platforms

Section 17 requires technical and organisational measures calibrated to the volume and sensitivity of the data and the likely harm, and lists measures that must be included: pseudonymisation, encryption, confidentiality, integrity, availability and resilience of systems, timely restoration after an incident, periodic risk assessment of transmission, regular testing and continuous updating.[1] For a recording estate that translates into a short list of controls we expect to see:

• role-based access, with agents unable to replay calls other than their own and supervisors limited to their teams;
• replay, download and export logged, with downloads disabled by default;
• pause-and-resume or automatic redaction when callers give card or account credentials;
• encryption at rest and in transit;
• transcripts held in the same controlled environment as the audio, with quarterly access reviews.

Telecom licensees must also keep lawful interception capability, protect subscriber data from unauthorised access and log interception-related activity, under the 2025 licensing policy.[7] Keep those systems segregated from commercial recording.

Breach response for call recordings

Under section 20, where a personal data breach is likely to cause significant harm to data subjects, the fiduciary must notify the Authority in the form, manner and time regulations prescribe, covering the nature of the breach, the categories and approximate number of people and records affected, a contact point and the mitigation measures.[1] No statutory deadline has yet been fixed, so the contract with the client will usually set the real clock.

For recordings, containment includes takedown requests, a voice-biometric breach may require customers to re-enrol, and an insider who listens to or copies recordings without authority may have committed the eavesdropping or data-collection offences described above, which raises the question of a police complaint. Our guide to cyber law compliance in Bangladesh covers incident reporting under the cyber security regime.

Once fines start, section 34 requires the Authority to weigh prompt notice and remediation, so document both.[1]

Call recording law Bangladesh and AI: training on recordings and transcripts

The fastest-growing question is whether years of stored calls can train speech recognition, summarisation, quality scoring or conversational AI models. The statute does not mention artificial intelligence by name, but several provisions apply directly.

Purpose compatibility and legacy data

Section 6 permits further processing only where it is compatible with the original purpose.[1] Training a model for the same client's service quality may be compatible; training a model to sell to other clients is unlikely to be. Section 40 is stricter for data collected before the statute took effect: processing may continue only for the original purpose, and any change of purpose needs the data subject's prior consent.[1] A pre-November 2025 recording archive is therefore not available for new AI uses without fresh consent.

Automated decisions and profiling

Data subjects may withdraw consent to automated decisions about their personal data under section 13(1), and an access request must be answered with, among other things, the logic and significance of automated decisions.[1] A model that scores callers for fraud risk or agents for dismissal must be explainable.

Voice cloning and synthetic voices

The 2026 amendment created a new offence in section 70(3): without reasonable cause, copying or using another person's voice, image or other identifiable, sensitive or biometric data through artificial intelligence to harm another person.[2] Section 66A also targets bulk AI-call fraud and synthetic identity data fraud causing economic loss, with up to five years or Tk 99 crore.[2] The government presented image and voice protection as part of the reform.[8] Synthetic voice projects should use voices licensed for the purpose, never voices harvested from customer calls.

De-identification and test data

The statute treats pseudonymisation as a security measure, not an exit from the law: it defines pseudonymised data as data that cannot identify the person without separately held additional information, which means the person can still be identified by whoever holds that information.[1] Removing names from transcripts does not take them outside the law. Training sets are also within section 14(6), so an erasure request must reach the training corpus and, where feasible, future model versions.[1]

Third-party AI vendors

Sending recordings to a foreign transcription or model provider is both processor engagement and a cross-border transfer. Contracts should bar the vendor from training its own models on the data, require deletion after processing and fix the hosting location.

Law enforcement requests and lawful interception

Recordings and CDRs attract requests from police, intelligence agencies and the regulator. Section 97A, as replaced in 2026, allows interception only for state security, public order or the prevention of serious crime, subject to necessity, proportionality and legality, with prior approval of a court or a government-constituted authority except for temporary emergency approval; operators must assist once they receive a lawful direction.[2] [9] Registered call centres accept that authorised agencies may intercept traffic originating or terminating at the centre.[5]

IP telephony licensees may disclose subscriber information only to persons authorised by the Commission for crime investigation, where the Commission or security and law enforcement agencies deem it necessary, or under a court order or law.[6] The data statute's exemption for crime prevention and court orders removes the need for consent only; it does not lift the duties of security, retention and disclosure control.[1] Keep a request register and disclose the minimum.

Step-by-step: building a compliant recording programme

The sequence below is the order in which we build or repair recording programmes for operators, BPOs and in-house contact centres.

Swipe or scroll →

Annual compliance for licensees, including inspections and reporting to BTRC, is set out in our guide to BTRC compliance after launch.

Mistakes to avoid under call recording law Bangladesh

• Treating CDRs as non-personal: numbers, timings and locations identify people; location in real time is sensitive data.
• Relying on an IVR line for everything: continuing the call is weak evidence of consent for voice biometrics, analytics or AI training.
• Keeping recordings indefinitely: the six-month BTRC floor is a minimum; section 18 limits retention to purpose.
• Deleting only the live copy: erasure reaches backups, test environments and migration datasets.
• Letting supervisors listen covertly: undisclosed monitoring outside a documented purpose is where section 71 risk lies.
• Training models on legacy archives: section 40 confines pre-Act data to its original purpose.

What to watch in 2027

Four developments will reshape call recording law Bangladesh businesses operate under. First, the gazette notification switching on complaints, fines and compensation under the data statute. Second, regulations on retention periods, consent formats, breach deadlines and transfer adequacy, which must be published in draft for public comment before they are finalised.[1] Third, the rules under section 97A on interception procedure and retention. Fourth, the guidelines that will replace call centre registration as the 2025 licensing policy deregulates that category, and the compliance role it gives access network licensees.[7] TRW's data protection compliance team reviews recording programmes, notices and processor contracts against these moving rules.

Frequently asked questions

Is it legal to record customer calls in Bangladesh?

Yes, if the business has a lawful ground under the Personal Data Protection Act 2026, usually consent or a contract, legal-claims or similar ground, gives a clear notice, limits retention and secures the recordings. Listening in on other people's conversations is a separate offence under section 71 of the Telecommunication Act.[1] [2]

Is a call-detail record personal data?

Usually, yes. The statute's definition of personal data lists mobile numbers and location data, and real-time location is sensitive personal data. A CDR that links to an identifiable caller or agent is therefore personal data even though it contains no conversation.[1]

How long must a call centre keep call-detail records?

BTRC's call centre conditions require at least six months, with production on demand. That is a floor, not a ceiling.[5]

Can a supervisor listen to live calls without telling the caller?

It is risky. Monitoring disclosed to callers and agents for a documented purpose is defensible, but covert listening by someone who is not a party to the call engages the eavesdropping offence, which now carries up to two years or Tk 1.5 crore.[2]

Is voice authentication treated as biometric data?

Yes. The Personal Data Protection Act 2026 lists the voiceprint within biometric data, and biometric data is sensitive personal data that can be processed only on section 7 grounds, led by specific consent.[1]

Can recordings be stored on a cloud server outside Bangladesh?

The Act has no general localisation rule, but transfers abroad need a consent or contract ground and an adequate destination, bulk transfers of biometric identifiers must be notified to the Authority, and registered call centres must keep disaster recovery sites inside Bangladesh.[1] [5]

Can old call recordings be used to train an AI model?

Only for a purpose compatible with the original one, and data collected before the statute took effect may be used for a new purpose only with the data subject's prior consent under section 40. Automated processing must also be disclosed.[1]

Is cloning a customer's voice with AI an offence?

Using another person's voice or biometric data through artificial intelligence without reasonable cause to harm someone is an offence under section 70(3) of the Telecommunication Act, as amended in 2026.[2]

Who is liable if a BPO leaks a client's recordings?

The client, as data fiduciary, is liable for its processor's processing under section 8, and the BPO is directly responsible for security standards under section 17(5).[1]

Must a recording leak be reported to the regulator?

Under section 20, a breach likely to cause significant harm must be notified to the National Data Management Authority in the form and time regulations prescribe. No deadline has been fixed yet.[1]