Bangladesh Data Protection Law: 2026 Guide

Summary. This Bangladesh data protection law guide explains the country’s comprehensive statutory framework for personal-data processing: the Personal Data Protection Act, 2026 (the PDPA). It replaced the 2025 Ordinance and is the central source for organisations that collect, use, store, disclose or transfer personal data with a Bangladesh connection. The framework is new and deliberately detailed, but parts of its operating machinery still depend on regulations, standard operating procedures, institutional steps and later commencement. This guide states the published legal position as at 18 October 2026 and separates it from practical readiness measures. [1] [2]

Table of contents

Bangladesh data protection law: status and territorial reach

The PDPA is Law No. 63 of 2026, dated 10 April 2026. The Bangladesh Government Press records its publication in the extraordinary Gazette on that date. The Act repeals the Personal Data Protection Ordinance, 2025 and the Personal Data Protection Amendment Ordinance, 2026, while preserving actions and proceedings taken under those instruments. A reference to the repealed Ordinance should therefore not be treated as the current statement of Bangladesh law. [1] [2]

The Act has an unusual commencement design. With the express exception of section 23 and sections 31 to 35, it is deemed to have taken effect on 6 November 2025. Section 23 concerns Chief Data Officers; sections 31 to 35 cover complaints to the Authority, certain administrative fines and compensation. Those excluded provisions can take effect only after 18 months have elapsed after the Act’s issue and on a date later fixed by Government notice in the official Gazette. On the date checked for this guide, that 18-month condition had not elapsed. It is therefore important not to state that the statutory complaint, fine, compensation or Chief Data Officer regime is already operative. [1]

The PDPA is not confined to a locally incorporated business. It applies to persons, data fiduciaries, processors and others connected with processing where, among other things, the relevant individual is a Bangladeshi citizen, resides or ordinarily resides in Bangladesh, works there or is temporarily there for a purpose. It also applies to processing in Bangladesh, apart from mere transit, and to processing outside Bangladesh connected with supplying goods or services to, or monitoring or profiling, a data subject located in Bangladesh. The Act also contains provisions addressing contraventions involving conduct across the border. [1]

That scope should be tested against the actual processing, not a company’s registered address alone. A foreign online service, an overseas group platform, an outsourced customer-support operation or a cloud-hosted workforce system may raise a Bangladesh question where it serves, monitors or profiles people in Bangladesh. Equally, a Bangladesh connection does not by itself answer every question about which entity is responsible, which data are involved, or whether another jurisdiction’s rules also apply.

The constitutional context matters. Article 43 of the Constitution protects, subject to lawful reasonable restrictions, the privacy of correspondence and other means of communication. The PDPA provides a more specific statutory framework for personal data; it should not be read as displacing every sectoral, contractual, cyber-security or constitutional issue that may arise. [5]

Key terms, roles and data categories

For Bangladesh data protection law purposes, organisations should map which entity decides why and how data is used before assigning controller, processor or other operational responsibilities.

The PDPA uses its own terminology. Personal data is broad: it includes information relating to an individual such as a name, parents’ names, identification number, mobile number, identifying financial data, location information and a similar online identifier. It also reaches physical, physiological, genetic, biometric, psychological and financial information, as well as other elements prescribed by regulation that help identify a person. Processing covers the full lifecycle, from collection and recording through storage, use, transfer, disclosure, restriction and deletion. [1]

A data subject is the natural person to whom personal data relate. The statutory definition expressly covers an identifiable person whether living or dead. A data fiduciary is the person that alone or jointly processes personal data for a specified purpose, supervises that processing, or authorises another person to process it for that purpose. A processor processes personal data on behalf of a data fiduciary. These are functional descriptions. An organisation should map actual decision-making and instructions rather than assume that a supplier’s contract label settles the point. [1]

The Act identifies a wide category of sensitive personal data. Its examples include genetic and biometric data; data related to ethnic or indigenous community; political or philosophical beliefs; religious beliefs; trade-union membership; health data; sexual orientation; data on criminal offences, criminal proceedings or convictions; data about alleged offences; and real-time location or geolocation. The Government may prescribe further categories. The legal and reputational consequence of misclassifying a dataset can be significant, especially where the data are to be shared, outsourced or transferred outside Bangladesh. [1]

A significant data fiduciary is not simply every large company. The Act leaves designation to regulations and refers to potential effects on national sovereignty, data volume or financial linkage, risk to data-subject rights, and potential threats to security, public order, public safety, economic order or public health. Until regulations and a designation process provide further detail, it is unsafe to self-declare that a business is, or is not, significant solely by reference to headcount, turnover or a familiar overseas threshold. [1]

The Act separately defines a child as a person below 18, unless the Government prescribes another age. It also defines a personal-data breach, pseudonymised data and encryption. Those definitions are practical prompts: a data map should capture not only a customer database but identity documents, authentication logs, cookie or device identifiers, location information, employee records, recordings, support tickets and copies residing with vendors, back-ups or test environments.

Lawful processing, consent and special cases

Verified legal position. Consent is the general starting point in section 5. A data fiduciary or processor may process under the Act and applicable regulations after obtaining consent. Consent must be voluntary, specific, clear and withdrawable. Before it is obtained, the data subject must be informed of the purpose, retention period, transfer and the method for withdrawal. The data fiduciary bears the burden of proving valid consent. A generic click-through that does not describe the intended use, retention and transfer facts may therefore be difficult to rely on. [1]

Consent is not the Act’s only possible processing ground. Section 5 allows processing without consent where a listed lawful basis or legitimate interest exists, subject to the applicable regulatory conditions and to necessity, proportionality and purpose limitations. The listed situations include performance of a contract involving the data subject; steps at the subject’s request before a contract; establishment of a legal right or defence of a legal claim; vital interests relating to life or health; implementation of employment, labour-rights or social-security legal rights; data voluntarily made public by the data subject; and a risk of harm to another person if consent is unreasonably delayed. These are statutory grounds, not a general permission to repurpose information for commercial convenience. [1]

Further processing is permitted where it is compatible with the original purpose, subject to the Act, rules and regulations. Disclosure without consent for a purpose other than the original collection purpose is prohibited by section 16, subject to the Act’s other provisions. This makes purpose definition more than privacy-notice drafting: it informs collection design, access rights, vendor instructions, marketing use, analytics and internal sharing. [1]

Sensitive personal data has an additional statutory gateway. Section 7 allows processing, subject to sections 5 and 6, where conditions include specific consent; a contract to which the subject is party; employment and social-security rights or obligations; health workers’ medical duties and emergency care connected with life or health risk; a duty imposed by or under law; or data voluntarily made public by the individual. The applicable condition and the dataset’s sensitivity should be documented rather than presumed. [1]

For children and persons unable to consent, section 9 requires consent from a parent, legal guardian or a person empowered to decide on their behalf, using the prescribed procedure. Processing must protect their rights and interests. The consent remains effective until the child reaches 18, or the person gains capacity, subject to the Act and any later regulatory detail. [1]

The Act also contains consent exemptions for specified contexts, including national security, defence, public order or public interest; compliance with a lawful court order; crime prevention, detection, investigation or prosecution; tax-evasion prevention or detection; certain public-health or emergency medical situations; misuse of public funds; personal, recreational or household use; research and statistics; and public-interest publication, journalism, archival, educational, artistic or literary work. The exemption from consent is not a blanket exemption from all rules about processing, storage, retention or disclosure. [1]

Practical guidance. Before a project begins, identify the purpose in operational terms, decide which legal ground is being relied on for each processing purpose, and make the consent route distinguishable from contractual terms. Separate optional marketing or analytics choices from processing needed to deliver the service. Keep evidence of what was shown, when it was accepted, and how withdrawal can be actioned. These are sensible governance measures; they are not substitutes for an analysis of a particular fact pattern.

Transparency, security, retention and suppliers

A practical Bangladesh data protection law programme brings privacy notices, access controls, retention schedules and supplier terms into one accountable governance record.

Section 15 places accountability and transparency duties on data fiduciaries and processors. For significant processing activity, the data subject is to be informed about the categories and method of collection, general purpose, categories creating a risk of harm in special contexts, how to exercise rights, how to complain to the Authority, applicable transfer information, the fiduciary’s identity and an easy contact route. The forms and procedures remain to be prescribed. [1]

The security standard is expressly risk-sensitive. Data fiduciaries and processors must take appropriate technical and organisational measures to protect security, accuracy and confidentiality, and to prevent accidental or unlawful destruction, loss, misuse, alteration, unauthorised disclosure or access. The statutory considerations include data volume and sensitivity, likely harm, processing scale, retention period and the availability and cost of technology and other measures. The listed measures include pseudonymisation, encryption, resilience of systems and services, timely restoration after an incident, periodic risk assessment, regular testing and updating controls as risks develop. [1]

The Act does not prescribe a universal product, encryption protocol, certification or percentage of budget. Its stated factors point to a proportionate approach. A payroll platform holding account details, a healthcare archive, a biometric access-control system and a low-risk public mailing list are unlikely to present the same risk profile. A defensible programme should be able to explain its choices against the statutory factors and the more detailed standards that may later be prescribed.

Retention is purpose-led. A data fiduciary may not retain personal data beyond the period prescribed for the purpose for which it was processed. There is a qualified route for longer retention in the public interest, scientific or historical research, or statistical purposes, where the stated conditions are met. Separately, subject to section 18, the fiduciary must keep records concerning processed personal data in a register for at least five years unless another law specifically provides otherwise. The records include processing, retention, structuring, storage, adaptation, change and portability. [1]

Processors require active oversight. A data fiduciary may appoint or engage a processor to provide goods or services under a lawful contract, but processing performed by that processor is treated as processing by the data fiduciary. The fiduciary must take reasonable measures to ensure that the processor follows the Act and regulations, and remains responsible for the processor’s acts. Section 17 also makes processors responsible for meeting the applicable security standard. [1]

Practical guidance. A processor agreement should be read with the operational arrangement, not filed and forgotten. Useful review points include documented instructions, confidentiality, access controls, incident escalation, technical and organisational safeguards, sub-processing, assistance with rights requests, return or deletion on exit, evidence preservation, audit information and the place from which data can be accessed. The appropriate contractual position depends on the service, data, sector and cross-border facts.

Individual rights and request handling

The PDPA describes Chapter III rights as universal, inherent, inalienable and inviolable; they cannot be waived or curtailed by contract or notice. A data subject exercises the Chapter III rights through a written application to the data fiduciary. Regulations are intended to determine acknowledgement, refusal and fulfilment procedure, but the statute already requires verification that takes account of data sensitivity and fraud risk, and requires the action taken to be recorded for audit and notified to the subject. [1]

The access and portability right covers data processed by the fiduciary. On request, the individual is entitled to a concise, intelligible copy and information about the data summary, actions taken, purpose, type, recipients, retention, source, safeguards for cross-border transfer, and the logic and significance of automated decision-making. The response must also include an account of the people, fiduciaries or processors with whom the data have been shared. The Act contemplates direct transfer to another fiduciary using a federated interoperable ecosystem where applicable. Frequency, response and resolution timing are left to regulation. [1]

There is a right to seek correction, completion or updating of inaccurate, misleading or incomplete data. If a fiduciary refuses, it must provide written reasons. If it changes the data, it must inform the data subject and relevant parties within 30 days. An unhappy data subject may ask for the data to be marked as disputed and for the Authority to be informed. [1]

A data subject may withdraw consent, wholly or partly, for storage, processing or automated decisions through the simpler process to be specified in regulation. The Act also identifies circumstances in which the fiduciary must erase data following a request: the original purpose no longer exists; consent is withdrawn; the subject objects under the Act; processing is unlawful; or erasure is necessary to meet a legal obligation or prescribed condition. There are important exceptions, including an identifier while consent remains active, archives, legal-compliance retention, confidential personal data and restricted personal data. Lawful processing before consent withdrawal remains lawful. [1]

The statute also deals with system-wide propagation for approved corrections and erasures, including secondary fiduciaries, processors, mirrors, caches, back-ups, disaster-recovery environments, test environments and migration datasets where applicable. This illustrates why an organisation should know where its data copies sit before a request arrives. The detailed operating procedures and deadlines remain dependent on regulations. [1]

Practical guidance. A request process can be designed now without inventing regulatory timelines: designate an intake point, authenticate proportionately, locate the data and processors, preserve a decision trail, distinguish correction from deletion, and ensure a refusal has a legal basis and clear written rationale. Do not promise a response period that the PDPA does not currently specify.

International transfers and cloud arrangements

Cross-border use is regulated rather than automatically prohibited or automatically permitted. Section 29 allows Government to classify personal data as public or open, internal, confidential or restricted, taking the Schedule’s characteristics into account. A classified category may be transferred abroad if the section’s conditions are met: consent of the data subject; a contract for exchange of goods or services to which the subject is a party; or, with the subject’s consent, a matter concerning that person’s business, education, departure from Bangladesh or immigration. [1]

Lawfully transferable personal data may be transferred only to a place or country with suitable data-storage technology and tools as determined by regulations. Large cross-border transfers of sensitive personally identifiable data must be notified to the Authority. For that notification rule, the Act identifies high-risk examples: Government unique identifiers such as national ID, passport and taxpayer/TIN/PAN numbers; biometric identifiers; genetic or DNA information; and criminal or conviction records. [1]

The Authority may make regulations for section 29. It can also issue a direction to stop or suspend the supply of personal data to a foreign state, foreign customer or international organisation. Its standard operating procedures may address the method for transfers outside Bangladesh. The legal assessment is therefore not complete just because a cloud provider has security certifications, a contract includes standard terms, or an overseas group has its own privacy programme. [1]

Practical guidance. Before using overseas hosting, remote support or a group data lake, record the origin, category and sensitivity of the data; every access location; the transfer purpose and statutory condition; processors and sub-processors; available security information; and the ability to retrieve, correct, delete or preserve records. This is a practical evidence-building exercise. It does not determine the suitability of a destination, which the PDPA reserves for regulatory treatment.

Breaches and the cyber-security interface

The PDPA defines a personal-data breach broadly as a security breach resulting in unauthorised access, unlawful transfer, disclosure or alteration, or an incident, destruction, loss or opportunity for intrusion linked to the absence of necessary processing and storage equipment. If a breach is likely to cause significant harm to the affected data subject, the data fiduciary must notify the Authority in the form, manner and time prescribed by regulation. The Authority is to consider the breach nature, affected categories and estimated number of people and records, contact information, and mitigation taken or proposed. The Act does not state a fixed statutory notification-hour count in section 20. [1]

That distinction matters in an incident. The statutory condition is likelihood of significant harm; the notification mechanics are to be prescribed. Contractual obligations, sector-specific rules, insurance conditions and other laws can nevertheless create separate issues. An incident plan should not treat the PDPA as the sole source of notice or response duties.

Bangladesh’s Cyber Security Act, 2026 separately repeals and reenacts the Cyber Security Ordinance, 2025. It addresses cyber security and cyber-space offences, including certain unauthorised collection or interference with data, but it is not a replacement for the PDPA’s governance rules. BGD e-GOV CIRT publicly describes an incident-response service that receives incident information, triages matters and coordinates response. Its public service information is useful operational context, not a universal statutory report-to-CIRT duty. [4] [7]

Practical guidance. A measured first response normally preserves evidence and records decisions, isolates affected systems where appropriate, establishes what data and people may be involved, checks supplier and customer notice clauses, and keeps external communications controlled. If a CIRT reporting route is considered, use the current official channel and do not upload confidential material without an appropriate secure process. The published CIRT form includes incident categories such as data breach or leak and asks for affected assets, logs or evidence, impact and steps already taken. [7]

Authority, implementation and enforcement status

The PDPA designates the National Data Management Authority as the Authority, referring to the companion National Data Management Act, 2026. That Act establishes the Authority as a statutory body connected with the Prime Minister’s Office. Under the PDPA, the Authority’s functions include implementation, protection and remedy of data-subject rights, prevention of harm from management weaknesses, protection of confidentiality, security, fairness and interoperability, public awareness, guidance and coordination with Chief Data Officers. [1] [3]

The Authority has statutory powers to direct fiduciaries and processors, require data, issue notices, enter places and access equipment or data for examination, warn and direct, protect data-subject rights, and order a halt or suspension of disclosures to a foreign state, foreign customer or international organisation. The Act also contemplates regulations and Government-approved standard operating procedures on consent, rights requests, processing quality, notices, portability, transparency, deletion, impact assessments and international transfers. [1]

The rules and regulations themselves have a published consultation path. The Government may make rules by Gazette notification; the Authority may make regulations for matters not included in rules, subject to Government approval. In each case, a draft is to be published online and in at least one widely circulated Bangla and one English daily for stakeholder or public comment before final Gazette publication. That structure is a reason to monitor official instruments rather than rely on early summaries. [1]

The planned enforcement architecture needs careful treatment. Sections 31 to 35 include complaints, administrative fines for failure to uphold data-subject rights, security-failure fines, factors for calculating fines and compensation. But section 1(3) postpones their commencement, as explained above. The published text states ceilings of Tk 25 lakh for specified rights breaches and security failures, and Tk 50 lakh for a significant data fiduciary’s rights breach, but those fine and compensation provisions are among the later-commencing sections. They should not be reported as a present enforcement outcome as at 18 October 2026. [1]

For the same reason, a business should not present the Chief Data Officer appointment duty as currently live. The role, in the later-commencing section 23, is for significant data fiduciaries and would include representing the fiduciary before the Authority, reporting significant matters, acting as the rights contact point and dealing with certain sensitive-data complaints. Preparing governance ownership now may be prudent, but implementation must track the formal designation, Gazette commencement and relevant regulations. [1]

Practical readiness checklist

As Bangladesh data protection law implementation develops, organisations should preserve the decisions and evidence behind their readiness measures rather than relying on policy language alone.

The following is practical information, not legal advice or a universal compliance prescription. It can help an organisation organise its questions while the regulatory framework develops.

• Map the data lifecycle. Identify the people, data categories, purposes, systems, access locations, recipients, processors, cloud services, back-ups and retention points. Flag sensitive data and Government identifiers.
• Allocate roles. For each activity, identify who sets the purpose, who acts on instructions, who receives data and which entity supplies a product or service to people in Bangladesh.
• Record the processing basis. Link each purpose to consent or a specific statutory non-consent ground. Keep a record of the information given and, where used, evidence of consent and withdrawal.
• Review notices and interfaces. Make the purpose, collection method, retention, transfers, rights contact route and applicable risk information understandable. Avoid copying notices designed for another legal regime without a Bangladesh review.
• Test supplier controls. Check whether contracts and real-world operations support instructions, confidentiality, access management, incident escalation, assistance and exit arrangements.
• Set security and retention controls. Use a risk-based control plan that reflects sensitivity, likely harm, scale and duration. Include restoration, testing and reviews, as section 17 anticipates.
• Prepare rights and incident workflows. Build verification, search, decision-record and escalation steps, but do not impose unverified PDPA deadlines. Preserve the ability to identify copies held by processors, back-ups and test systems.
• Assess transfers separately. Treat foreign storage, remote access, group sharing and vendor support as potential transfers. Document classification, purpose, safeguards and the statutory condition rather than assuming a cloud location is neutral.
• Monitor official developments. Check the Laws of Bangladesh database, Government Press Gazette, ICT Division listings and the Authority’s future publications for rules, regulations, standard operating procedures, designations and commencement notices.

FAQ

Contact TRW

TRW’s Data Protection & Privacy information page outlines Bangladesh-related and cross-border questions that may arise around data governance, transfers, rights processes and incident planning. For an initial discussion, use the firm’s verified contact route or consultation booking route. Please provide only non-confidential context initially. Do not send personal data, credentials, incident evidence or other confidential material through an ordinary website enquiry.