E-Commerce Law in Bangladesh: A 2026 Business Guide

Summary. E-commerce in Bangladesh is governed by a connected set of laws rather than one comprehensive “e-commerce act”. An online seller or marketplace should consider the law of contract and electronic records, consumer protection, personal-data protection, cyber security, payment regulation, tax, product-specific permissions and, where relevant, import, export and foreign-exchange rules.

The Ministry of Commerce’s Digital Commerce Operation Guidelines 2021 remain an important operational reference, but they should be read alongside binding statutes and regulator requirements. The most material 2026 change is that the Personal Data Protection Act 2026 and the Cyber Security Act 2026 are now the current statutory reference points; descriptions that still treat the Digital Security Act 2018 or the Cyber Security Act 2023 as the live baseline are out of date.[4] [5]

This guide is written for founders, retailers, marketplaces, payment-adjacent businesses, overseas suppliers and investors considering sales to Bangladesh. It explains the framework as at 19 October 2026, identifies areas where implementing rules or official operational material may affect the answer, and suggests a proportionate launch plan.

Table of Contents

E-commerce law: no single e-commerce statute

“E-commerce law” is a useful commercial label, but it can obscure the real compliance question: which activity is the business carrying on, and which rules attach to it? A direct-to-consumer fashion retailer, a multi-vendor marketplace, a social-commerce seller, a subscription software provider and a payment aggregator may all take orders online. Their legal exposures are not identical.

At the core, the Information and Communication Technology Act 2006 recognises electronic records and electronic signatures in circumstances addressed by the Act. Its structure includes legal recognition of electronic records and signatures, rules for their retention, and provisions on acknowledgement and sending and receipt of electronic records.[6] This helps support digital contracting and recordkeeping. It does not remove the need to meet ordinary legal requirements that apply to the underlying transaction, such as capacity, authority, a valid product licence, tax treatment or consumer law.

The Consumers’ Right Protection Act 2009 applies in addition to other applicable law. Its definition of anti-consumer-right practice includes using false or untrue advertising to sell goods or services, and failing properly to sell or deliver goods or services promised for consideration. The Act also contains offences and sanctions relating to those practices.[1] An online channel does not dilute those expectations; in practical terms, the product page, promotion, checkout, confirmation and delivery process should tell one consistent story.

The Ministry of Commerce’s National Digital Commerce Policy 2018 is a policy document. The Ministry also published the Digital Commerce Operation Guidelines 2021 on 4 July 2021, with the guideline appearing in the Bangladesh Gazette.[3] The guideline is highly relevant operational material for digital-commerce businesses, including around trader and product information, availability, price presentation and customer-facing conduct. It is not a substitute for analysing an Act, rule, licence condition or regulator direction that applies to a particular business. Where a guideline, a later regulator instruction or a statute appears to point in different directions, the legal hierarchy and the facts matter.

The 2026 statutory landscape matters particularly for digital businesses. The Personal Data Protection Act 2026 is Act No. 63 of 2026, dated 10 April 2026. It covers specified Bangladesh-linked processing, including processing outside Bangladesh connected with providing goods or services to, or monitoring, a data subject located in Bangladesh.[4] The Cyber Security Act 2026 is Act No. 81 of 2026, also dated 10 April 2026, and its official record states that it repeals and re-enacts the Cyber Security Ordinance 2025.[5] The ordinance had itself displaced the 2023 statute. A compliance register and website policy should therefore be updated rather than copying old references to the Digital Security Act 2018.

A useful way to organise work is by journey rather than by statute: establish the seller, market the product, collect the order and data, take payment, fulfil the order, handle returns and complaints, and preserve the evidence. Each stage produces a different legal and operational control.

What an online business should show before checkout

Trust is a legal and commercial asset. A buyer who can readily identify the seller, understand the product and price, and see how delivery and returns work is less likely to abandon a purchase or complain after it. Those outcomes also support consumer-law compliance.

Make the seller identifiable

The site, app, social storefront and order confirmation should consistently identify the legal or trading entity operating the offer, a physical or service address as appropriate, usable contact details and a clear route for questions and complaints. A marketplace should separately explain whether the customer is contracting with the marketplace, a third-party seller, or both for different elements of the transaction.

This is not merely a design preference. It determines who makes product representations, who receives payment, who issues the receipt, who arranges delivery and who answers a statutory complaint. Ambiguity becomes expensive when an item is defective, delayed, counterfeit or not delivered.

Businesses should ensure that any company or partnership description accords with their underlying registrations. The Registrar of Joint Stock Companies and Firms maintains an official service portal with the Companies Act 1994 among its listed laws and business-process materials.[13] A company is only one possible vehicle; the correct structure, registrations and local permissions depend on the ownership, activities, location and regulated products involved.

Make the offer capable of being understood

For each product or service, use a description that a normal buyer can understand. It should be specific about the item or service, material restrictions, variants, price, VAT or other tax treatment where stated, delivery destination and charges, expected dispatch or delivery timing, payment methods, warranty terms, cancellation or return conditions, and customer-support contact point. If stock is uncertain, say so before payment rather than after it.

Photographs, influencer copy, live-stream claims, “limited stock” banners and comparison prices are all part of the offer. Marketing review should therefore include the same product, legal and operations owners who approve the catalogue and fulfilment promise. A price or delivery promise that can be made in an advertisement but not honoured by the warehouse is not a marketing-only problem. The 2009 Act specifically addresses false or untrue advertising and failure properly to deliver promised goods or services.[1]

Give terms a real checkout role

Terms should be easy to find before the buyer commits, written for the transaction at hand, and retained in the version accepted. A pre-ticked box hidden behind a generic link is weak evidence and poor customer experience. Better practice is to present the material terms at the relevant point: delivery and refund terms at checkout, subscription renewal terms before enrolment, and seller/platform allocation where a marketplace is involved.

The order confirmation should record the essential deal: order number, item, agreed price, payment status, delivery information, customer contact, applicable terms version and support channel. Maintain an auditable record of the web page, campaign, basket, acceptance event and confirmation sent. The ICT Act’s recognition of electronic records does not make evidence management optional; it makes disciplined electronic evidence more valuable.[6]

Consumer protection: delivery, advertising and complaints

Consumer protection is the most visible legal risk for a retail business. It affects copy, product sourcing, inventory management, fulfilment partners, refunds and how frontline staff respond when something goes wrong.

What the 2009 Act means in online practice

The Consumers’ Right Protection Act 2009 describes anti-consumer-right practices broadly enough to matter to online sales. Relevant examples include selling or offering goods or services through false or untrue advertising, and not selling or delivering properly the goods or services promised for money. Section 44 provides for punishment for deceiving a buyer by false or untrue advertising; section 45 addresses failure properly to sell or deliver promised goods or services.[1]

The question is not only whether an item eventually arrives. Consider the whole promise: correct item, quantity, condition, price, delivery method, service scope and time commitment. A retailer that changes the price after payment, substitutes an inferior item without agreement, repeatedly displays unavailable stock as available, or obscures a material delivery charge creates both legal and reputational risk.

The Act is additional to other laws. Regulated categories such as food, cosmetics, medicines, telecommunications, financial products or imported goods may bring product-specific rules, approvals, labelling, safety standards or licences. No general e-commerce checklist can replace an assessment of the category being sold.

Design a complaint process before the first sale

Create a written process that has one accountable owner, defined response times, authority to refund or replace within limits, escalation for potential safety or fraud issues, and a method for retaining records. The process should work for website, app, call centre, WhatsApp and social-media enquiries. It should not require a buyer to repeat the same information to multiple teams.

The National Consumer Rights Protection Directorate explains that a complaint can be made in writing, including electronically, and that purchase receipts should be attached. It identifies the online complaint route and the National Consumer Complaint Centre contact details.[2] The Act provides that a complaint about an anti-consumer-right practice is not accepted if it is not made to the Director General or authorised officer within 30 days of the cause of action arising.[1] That short statutory period is a practical reason for retailers to preserve receipts, order records, communications, delivery evidence and refund decisions promptly.

A business should not tell a customer that its internal process is the only remedy. It may set out a fair internal escalation route, but it should not misstate statutory rights or make a refund policy appear to waive legal remedies. For complex disputes, chargebacks, fraud allegations, personal injury, regulated products or high-value transactions, the facts and evidence should be reviewed individually.

Forming and proving online contracts

An online sale is a contract process carried out electronically. The legal essentials do not disappear because the interface is a mobile screen. The business still needs a sufficiently certain offer, acceptance, price or other consideration, authority and capacity, and terms that can be proved.

The ICT Act 2006 expressly addresses the authentication of electronic records with electronic signatures, legal recognition of electronic records and legal recognition of electronic signatures. It also permits electronic preservation where the statutory conditions are met, including accessibility for later use and retention of information that can identify the origin, destination, date and time of sending or receipt.[6] For a routine retail checkout, this does not mean that every customer must use a formal electronic-signature certificate. It means a business should choose an acceptance design and evidence trail appropriate to the risk.

For low-value consumer orders, that can include a clear click-to-accept event, a timestamp, the terms version and order confirmation. For a high-value B2B supply, reseller arrangement, software licence, consumer-credit adjacency or cross-border distribution arrangement, parties may need a more robust signature method, authority checks, negotiated terms and retained execution package.

Operationally, the most important question is often: can the business reconstruct what happened? Keep the order history, product-page version, customer acceptance, payment reference, address provided, delivery handover evidence, support messages and refund record. Set a retention schedule that aligns with contractual, tax, consumer, litigation-hold and data-protection needs. Do not retain personal data indefinitely merely because storage is cheap.

Data protection and privacy after the 2026 Act

The Personal Data Protection Act 2026 changes the centre of gravity from a generic privacy-policy exercise to an accountable processing programme. The official text treats personal data as a person’s property for the purposes of the Act and addresses lawful processing, transparency, rights, accountability, processors and remedies.[4]

Scope and roles

The Act applies to persons, data fiduciaries, processors and others in listed Bangladesh-connected situations. This includes processing in Bangladesh other than mere transit, and certain processing outside Bangladesh related to providing goods or services to, or monitoring, a data subject in Bangladesh.[4] A foreign platform selling into Bangladesh should therefore assess the Act rather than assume it applies only to locally incorporated businesses.

A data fiduciary is the person that determines or oversees processing for a specific purpose. A processor processes personal data on the fiduciary’s behalf.[4] A retailer may be the fiduciary for customer accounts and orders, while a cloud host, delivery provider, customer-support tool or marketing vendor may be a processor or may have its own independent role. The labels in a vendor contract should follow the real data flows, not simply the preferred terminology of a software vendor.

Personal data is defined broadly and includes identifiers such as name, phone number, identifying financial data, location data and online identifiers. The Act separately defines sensitive personal data, including health, biometric, real-time geolocation and certain other categories.[4] This has practical consequences for a normal e-commerce stack: delivery addresses, account logins, cookies, device identifiers, payments information and customer-service recordings should be mapped before they are collected at scale.

Lawful basis, notices and customer controls

Section 5 provides for processing with consent, and states that consent must be voluntary, specific, explicit and withdrawable. Before consent is obtained, the data subject is to be informed about the purpose, retention period, transfer and withdrawal process. The same section also lists defined legitimate-interest situations in which processing without consent may be possible, including performance of a contract with the data subject and steps at the data subject’s request before entering a contract.[4]

This does not support a one-size-fits-all approach. Fulfilling an order may be necessary for the contract; sending unrelated promotional messages, deploying behavioural advertising or sharing data with a new partner may require a different analysis. Design the user journey so that required service communications are not confused with optional marketing. Record the basis for each material processing purpose and what choice, if any, the customer was offered.

Section 15 requires accountable and transparent processing measures. It calls for information on categories and collection methods, general purposes, potentially risky processing categories, rights exercise and contact information, complaint information, transfers where applicable, and the fiduciary’s identity and contact route.[14] A short, readable privacy notice layered into checkout can address the buyer’s immediate questions, while a fuller policy explains the detail. A notice should describe actual practice; it is not a licence to collect data without limits.

The Act gives data subjects a route to exercise rights by written application to the data fiduciary. The related procedures are to be prescribed, and the fiduciary should verify sensitivity and fraud risk when handling a request.[15] Businesses should begin with a workable intake channel, authentication procedure, ownership map and audit log. Those controls also reduce the chance that a person seeking access or correction becomes a social-engineering target.

The implementation point that requires care

The Act says that, other than sections 23 and 31–35, it is deemed effective from 6 November 2025. Those identified provisions are to take effect on a date notified by the Government after 18 months from promulgation.[4] As at the date of this article, businesses should not treat every operational detail as settled simply because the Act has been enacted. Rules, regulations, official notifications and sectoral directions may define forms, procedures and technical expectations. The correct response is not to wait: build a data inventory, transparent notices, access controls, vendor diligence, retention decisions and incident-response plan now, then update them when authoritative implementation material is issued.

Cyber security: the current statutory position

The current statutory reference is the Cyber Security Act 2026, not the Digital Security Act 2018. The official Laws of Bangladesh record describes the 2026 Act as repealing the Cyber Security Ordinance 2025 and providing for cyber security and the identification, prevention, suppression and trial of cyber-space offences.[5] The official Gazette records the Act as Act No. 81 of 2026, dated 10 April 2026.[16]

For an e-commerce operator, legal compliance and security engineering should reinforce each other. Protecting the storefront, customer accounts, order-management system, product catalogue, cloud console, employee email, payment integrations and delivery interfaces is basic commercial hygiene. It also supports obligations under the Personal Data Protection Act, which defines a personal-data breach broadly to include unauthorised access, unlawful transfer, disclosure, alteration, destruction, loss or conditions that create an opportunity for intrusion through lack of appropriate means.[4]

A proportionate baseline includes multi-factor authentication for privileged accounts, least-privilege access, secure software development and patching, encryption where appropriate, tested backups, separation of production and test data, supplier-access controls, log review, phishing-resistant staff training and an incident playbook. Test the playbook with the people who would actually act: technology, legal, customer support, payments, communications and senior management.

Bangladesh Bank states that participating banks must ensure two-factor authentication for online, e-commerce, interbanking and card-not-present transactions through the National Payment Switch Bangladesh.[7] That is not a reason for a merchant to outsource its entire security responsibility to a bank or gateway. The merchant still needs to secure its checkout implementation, credentials, customer service and administration layer.

Payments, wallets and gateways

Payment flow must be matched to the business model. A retailer accepting card, bank or mobile-financial-service payments through an authorised provider is in a different position from a business that holds customer value, offers a wallet, aggregates merchants or operates settlement between participants.

Bangladesh Bank’s Payment Systems Department is responsible for regulation, policy, licensing and oversight of payment systems, including Payment Service Providers (PSPs) and Payment System Operators (PSOs). Bangladesh Bank describes a PSP as a company facilitating payments or payment processes directly to customers and settling through a scheduled bank or financial institution; a PSO operates a settlement system among participants, with payment gateways and payment aggregators given as examples.[7]

The Bangladesh Payment and Settlement Systems Regulations state that no person may provide payment services or operate a payment system unless licensed by Bangladesh Bank. The Regulations also address capital, governance, dispute rules, IT safety, interoperability, data protection and contingency controls for licensed businesses.[8] In most conventional merchant cases, the sensible question is not “do we need to become licensed?” but “are we contracting with a Bangladesh Bank-authorised provider for the function we need, and are the contractual and technical allocations clear?” Bangladesh Bank publishes a list of authorised PSPs and PSOs on its payment-systems page.[7]

Before launching, document who takes the customer payment, when settlement occurs, which party bears fraud and chargeback risk, how refunds are initiated, where reserves may be held, what data the provider receives, and what happens if the gateway or wallet is unavailable. A marketplace must be especially careful: collecting money for third-party sellers, netting fees, releasing funds after delivery and offering stored value can change the regulatory analysis.

Do not use a payment processor’s brand name as a substitute for due diligence. Check its current authorisation, product scope, onboarding conditions, security requirements, settlement cycle, complaint process and whether it supports the intended transaction type. If the business adds recurring billing, instalments, credit-like features, cross-border collection or customer balances, obtain model-specific advice before build and launch.

Business set-up, tax and platform records

Establish the operating model first

A legal launch plan should identify the seller of record, owner of stock, importer of record where relevant, operator of the domain and social accounts, employer of the customer-support team, payment counterparty, logistics contracting party and entity that receives revenue. These roles may align in a simple retailer, but often separate in a group, marketplace or cross-border business.

The official RJSC portal provides company-law and process materials, and the Ministry/RJSC has published Digital Business Identification (DBID) Registration Guidelines 2022.[12] DBID should be considered in the registration workstream. However, the DBID portal displayed a maintenance notice when checked on 19 October 2026. More importantly, businesses should not assume from a general guideline or a portal’s existence alone that the same DBID requirement, workflow or timing applies unchanged to every model. Confirm the current administrative position and eligibility with the responsible authority before treating it as a launch gate.

A local trade licence, tax registration, sector licence, product approval, import or export registration and labelling obligation may each arise depending on the seller, location and merchandise. Consumer goods, food, medical or health-adjacent items, telecommunications, education, travel, financial services and controlled products should receive a category-specific regulatory review.

Tax: reconcile official material before relying on a threshold

E-commerce does not create a tax-free category. The Income-tax Act 2023’s consolidated official text includes income from the sale of goods or services by electronic means to purchasers in Bangladesh among income deemed to accrue or arise in Bangladesh.[11] The National Board of Revenue’s public FAQ also lists selling goods or services to consumers in Bangladesh through a digital platform among situations in which return filing is mandatory.[10] Residence, permanent establishment, source, withholding, deductible cost, VAT treatment and treaty questions remain fact-sensitive, particularly for overseas sellers and platforms.

VAT registration and invoicing deserve early attention. The consolidated text of the Value Added Tax and Supplementary Duty Act 2012 currently defines the registration threshold as Taka 50 lakh of turnover from economic activities in a 12-month period, subject to the statutory wording and exclusions. It also provides that every registered or enlisted person must issue a tax invoice in the prescribed manner when tax becomes payable on a taxable supply.[9]

There is a material uncertainty to resolve, not paper over: the NBR VAT FAQ currently says registration is required above Taka 80 lakh and enlistment above Taka 30 lakh in 12 months, with a 15-day application period after the need arises.[17] That differs from the consolidated statutory threshold displayed on the official legal text. The statute is the stronger legal source, but a business should obtain current confirmation from NBR or specialist advice before setting its registration trigger, pricing, invoice engine or returns calendar. It should also preserve the official source checked and the date, because revenue rules can change through finance legislation and administration.

For operations, the immediate controls are straightforward: map supplies, estimate turnover by entity, identify the correct taxpayer and business identification numbers, build serialised invoice and credit-note capability where needed, preserve sales and payment data, and make sure refund records reconcile with stock, payment and tax records. A finance function should be involved before a promotional campaign or marketplace fee schedule is launched, not after.

Marketplaces, sellers and cross-border models

A marketplace is not simply a retailer with more product pages. It has at least two contractual relationships: platform-to-seller and platform/customer-to-buyer. Its legal architecture should allocate responsibilities honestly without obscuring the customer’s protections.

Marketplace governance

Seller terms should set verification requirements, permitted goods, product-information standards, intellectual-property warranties, stock and delivery duties, pricing controls, refund cooperation, complaint responses, data use, audit rights and suspension grounds. The marketplace should decide who handles a consumer complaint first, who funds a refund, what evidence is required and how repeated seller failures affect listing access.

Customer terms and product pages should explain the marketplace’s role in the sale and fulfilment. A disclaimer cannot cure an interface that otherwise makes the platform appear to be the seller or that hides the actual seller. Platform liability will depend on the facts, representations and applicable law. The practical objective is to make the supply chain visible and to retain the evidence needed to resolve a claim.

Data sharing is equally important. If a seller receives a buyer’s name, phone number and address for fulfilment, the platform should set the permitted purpose, security standards, retention period, onward-transfer restrictions, incident escalation and deletion or return process. The 2026 data law’s role distinctions should be reflected in this allocation.[4]

Cross-border sales

Cross-border models add questions that cannot be solved by a domestic website’s terms. A foreign seller targeting buyers in Bangladesh may come within the territorial reach of the Personal Data Protection Act 2026 when its processing relates to goods or services for, or monitoring of, data subjects in Bangladesh.[4] The Income-tax Act 2023 also expressly treats electronic sales to purchasers in Bangladesh as a possible Bangladesh-source connection.[11]

The product’s route also matters. Who imports the item? Which customs classification and duty treatment apply? Are there product-specific restrictions, standards or approvals? Is local warehousing used? How are payment collection, currency, returns and warranty repairs structured? Are customer data and payment data transferred offshore, and on what contractual and security basis? Each of these questions can change the required licences, taxes and contractual risk.

For that reason, overseas marketplaces and brand owners should run a Bangladesh entry assessment before switching on country targeting, local-currency pricing, local delivery promises or a Bangladeshi seller programme. The business case, tax design, data flow and consumer proposition should be reviewed together.

Commercial implications

The legal framework should not be approached as a set of documents to upload once. It is an operating model. The highest-risk failures generally occur at the hand-offs: a campaign promises what inventory cannot deliver; a seller sends customer data to an unvetted courier; a customer is charged twice; a refund is approved but never settled; a data incident is discovered but nobody knows who owns communication; or a tax configuration is copied from another market without checking Bangladesh rules.

For founders, a lean launch should prioritise product truthfulness, seller identity, payment routing, delivery evidence, customer-service authority and clean recordkeeping. A polished privacy policy cannot compensate for untrained support staff, insecure admin accounts or false “available now” inventory.

For boards and investors, the key diligence questions are whether the business can identify its seller of record and data fiduciary, evidence customer acceptance and delivery, reconcile funds, control third-party sellers, produce invoices and records, and respond to complaints or incidents promptly. Those capabilities are value-protecting infrastructure. They improve trust, reduce refunds and fraud, and make expansion or a transaction easier to diligence.

For marketplaces and payment-adjacent businesses, regulatory perimeter analysis should come before product launch. The cost of redesigning a money-flow, settlement or stored-value feature after launch is often much greater than an early assessment against Bangladesh Bank’s regulated PSP/PSO model.[7] [8]

Practical next steps

1. Map the transaction. For each sales channel, record the seller, customer, product, jurisdiction, payment route, delivery party, refund route, data recipients and tax entity. Do this separately for direct retail, marketplace and cross-border flows.
2. Create a truthful customer proposition. Review catalogue claims, price displays, stock status, delivery promises, return terms, promotions and influencer scripts against actual operational capacity. Put a named owner behind each statement.
3. Build the evidence pack. Retain accepted terms, product-page versions, order confirmations, invoices, payment references, delivery evidence, complaint records and refunds. Set access and retention rules rather than relying on ad hoc screenshots.
4. Implement a data programme. Produce a processing register, determine roles and lawful bases, publish accurate notices, minimise collection, review cookies and marketing, contract with vendors, protect access, and create rights-request and incident workflows. Track regulations and notifications under the 2026 Act.
5. Validate payments. Use an appropriate Bangladesh Bank-authorised PSP or PSO where the model requires it. Test payment success, refunds, duplicate-payment handling, settlement reconciliation, fraud escalation and service outage communications.[7]
6. Resolve registrations and tax before scale. Confirm entity, trade, sector and DBID requirements; obtain a current view of VAT registration/enlistment thresholds; and build invoice, record and return processes into the technology stack rather than using manual workarounds.[9] [10] [12]
7. Prepare complaint and incident playbooks. Train customer support on promised goods, substitutions, delivery failures, refunds and regulatory escalations. Ensure the team knows that evidence and timing matter, including the statutory 30-day consumer complaint period.[1] [2]
8. Review the model before material change. New categories, recurring billing, credit-like products, wallets, influencer campaigns, cross-border shipping, seller payouts or behavioural advertising can alter the regulatory analysis. Make legal, tax, payments, privacy and operations review a launch requirement.

For support on a Bangladesh-related e-commerce matter, including a launch, platform terms, data governance, payments analysis or a regulatory review, explore TRW’s practice areas or contact TRW. Please use the contact route only to provide a high-level outline; do not send confidential, privileged or time-sensitive information through an initial online enquiry.

Frequently asked questions