TRW Insight / Bangladesh
The Cyber Security Act 2026 and the Personal Data Protection Act 2026 turned cyber law from a list of offences into a set of positive duties. Every IT and online business now needs owners, an incident playbook, a retention schedule and evidence its controls work.
Cyber law compliance Bangladesh: what businesses must do in 2026
Cyber law compliance Bangladesh businesses have to deliver in 2026 is no longer a matter of avoiding a handful of online offences. The Cyber Security Act 2026 (Act No. 81 of 2026) imposes positive duties on organisations that suffer incidents, run critical systems or receive investigation requests, and the Personal Data Protection Act 2026 (Act No. 63 of 2026) adds security, retention and record-keeping obligations for anyone handling personal data.[1] [2] The ICT Act 2006 still governs electronic records, digital signatures and the licensing of certifying authorities.[3]
This guide is a working checklist for boards, general counsel, CISOs and founders of IT, online and data-driven businesses. It covers who is in scope, critical information infrastructure duties, incident reporting, data protection status, retention and records, government and BTRC takedown requests, employee policies, digital signatures, and a penalties table for corporate offences. For the offences themselves, the Cyber Tribunal and victims' remedies, read our guide to cyber law in Bangladesh; this article stays on what a compliant organisation must actually do.
Summary: Three statutes now drive cyber compliance in Bangladesh: the Cyber Security Act 2026 for incident reporting, critical information infrastructure, investigations and takedowns; the Personal Data Protection Act 2026 for data security, retention and records; and the ICT Act 2006 for electronic records and digital signatures. Several obligations are already live, while data protection fines and complaints are switched off until the government notifies them. A business that maps its systems, names owners, writes one incident playbook and documents its controls is in a far stronger position than one that waits for rules.
Key point: Any government, private or autonomous body that experiences a cyber incident must inform the National CERT of the National Cyber Security Agency immediately under the proviso to section 9(4) of the Cyber Security Act 2026. There is no materiality threshold and no hour count. Directors and managers directly connected with an offence by the company are personally liable unless they prove it happened without their knowledge or that they made every reasonable effort to prevent it.
At a glance
Immediate reporting
Every organisation must tell the National CERT about a cyber incident without delay under section 9(4) of the Cyber Security Act 2026.
Critical infrastructure
Systems declared by gazette must run their own CIRT and SOC, report quarterly and complete an annual internal and external audit.
Data protection
The Personal Data Protection Act 2026 is deemed in force from 6 November 2025, but fines, complaints and the Chief Data Officer rule are deferred.
Records
Data fiduciaries must keep a register of personal data processed for at least five years and log every operation on it.
Personal liability
Owners, directors, managers and employees directly connected with a company's offence are deemed to have committed it.
Table of Contents
Cyber law compliance Bangladesh: the statute book in 2026
Bangladesh has rewritten its cyber statute book three times since 2018, and compliance programmes built before 2025 are now citing laws that no longer exist. The interim government repealed the Cyber Security Act 2023 by the Cyber Security Ordinance 2025, gazetted on 21 May 2025, which dropped nine speech-related sections and annulled cases under them.[6] The elected Parliament then passed the Cyber Security Bill 2026 on 10 April 2026.[4] The resulting Act is deemed in force from 21 May 2025, repeals the 2025 ordinances in section 51 and deals with pending cases under the 2023 Act in section 50.[1]
Parliament amended the Act once on 30 June 2026, removing section 20 on online gambling after a separate gambling law was adopted.[5] A second, more contested amendment on disinformation and defamation was still a draft at a stakeholder consultation on 26 September 2026.[7] Until a bill is passed and published, the Act as amended in June is the text to comply with.
The three statutes that set the duties
- Cyber Security Act 2026: incident reporting, critical information infrastructure, data preservation orders, investigation assistance, content blocking and the offences that can be committed by or against a business.[1]
- Personal Data Protection Act 2026: lawful bases, data subject rights, security standards, retention limits, records, breach notification, audits and data protection plans.[2]
- ICT Act 2006: legal recognition of electronic records and signatures, electronic record retention, certifying authority licensing, intermediary protection and the Cyber Tribunals.[3]
Sector rules sit on top. Financial institutions follow Bangladesh Bank's cyber framework, telecom operators the Bangladesh Telecommunication Act 2001 and BTRC licence conditions, and online sellers the digital commerce rules described in our guide to e-commerce law in Bangladesh.
IT law compliance versus compliance with cyber law
Clients often ask for "IT law compliance" or "compliance with cyber law" as though they were the same exercise. They overlap but are not identical. IT law compliance is broader: it covers electronic contracting and signatures, software licensing, data protection, telecom licensing and payment rules, which our technology law in Bangladesh guide maps in full. Compliance with cyber law is narrower and more operational: it is about securing systems, reporting incidents, handling investigations and preventing staff from committing offences on company systems. Cyber law compliance Bangladesh regulators will test after an incident sits mostly in the second category, so it is where this checklist concentrates.
Who is in scope: IT and online businesses
The Cyber Security Act 2026 is drafted to reach almost every technology business. "Service provider" includes anyone, including a software, algorithm or AI agent developer, who enables users to communicate through a computer or digital process; anyone who processes or stores computer data for such a service; recognised testing and penetration-testing laboratories; third-party security operations centres; and entities involved in semiconductor design for cyber security.[1] "Cyberspace" covers the internet, telecom networks, cloud, the internet of things, social media, blockchain and AI networks.[1]
The Personal Data Protection Act 2026 reaches further still. It applies to Bangladeshi citizens and residents, to processing inside Bangladesh, and to processing outside Bangladesh where the controller offers goods or services to, or monitors or profiles, data subjects in Bangladesh (section 1(2)).[2] A foreign SaaS provider with Bangladeshi users is therefore in scope even with no local office.
Compliance obligations for IT and online businesses at a glance
- All organisations: report cyber incidents immediately to the National CERT, assist investigating officers, keep investigation information confidential and comply with data preservation orders.[1]
- Data fiduciaries and processors: apply technical and organisational security measures, observe retention limits, keep five-year registers and notify significant breaches once regulations prescribe the form and timing.[2]
- Declared critical information infrastructure: run a CIRT and SOC, report quarterly, audit annually and accept inspection.[1]
- Platforms and intermediaries: handle blocking requests routed through the BTRC and preserve the evidence needed for the section 79 intermediary defence under the ICT Act.[1] [3]
- Regulated financial entities: meet Bangladesh Bank's Cybersecurity Framework by 31 December 2026.[11]
Critical information infrastructure duties
The heaviest obligations under cyber law compliance Bangladesh imposes fall on critical information infrastructure. Section 2 defines it as physical or virtual infrastructure that controls, processes, transmits or stores data and whose compromise could harm public safety, economic security or public health, or affect national security or sovereignty.[1] Under section 15 the government declares critical information infrastructure by gazette notification and must update the list at least once a year.[1]
Who has been designated
Designation is not theoretical. When the Chittagong Port Authority's systems were declared critical information infrastructure in late August 2026, the Financial Express reported that 36 organisations in total now held that status.[8] The designation covered the port's whole IT environment, including data centres, communication systems, databases and API hubs. The authority remains owner and operator of its systems; designation brings oversight, not a government takeover.[8] Private suppliers to designated entities should expect those duties to flow down into their contracts.
The statutory duties
- Own CERT or CIRT and SOC: each declared system must have its own computer emergency or incident response team and a security operations centre, and every SOC must report its activities and performance indicators quarterly to the national operations centre (section 9(2)).[1]
- Resources: the entity must ensure its CERT has the necessary technical capacity, people and budget (section 9(7)).[1]
- Annual audit: internal and external infrastructure must be audited every year in the manner prescribed by rules, with the report submitted to the National Cyber Security Council and its contents notified to the Director General (section 16(2)).[1]
- Qualified auditors: monitoring, inspection and audit must be carried out by cyber security experts, and audits may be performed by testing laboratories or certified bodies following recognised international standards (sections 16(4) and 16(6)).[1]
- Inspection: the Director General monitors and inspects declared systems and reports to the Council (section 16(1)).[1]
The CIRT itself must meet capability standards in section 9(6): round-the-clock channels with publicly disclosed contact details, secure premises, a request-handling system, sufficient trained staff and redundant equipment.[1] The Chittagong Port notice added operational expectations: 24/7 monitoring, regular risk and vulnerability assessments, penetration testing, encrypted offline backups and tested business continuity and disaster recovery plans.[8]
Criminal exposure
Unauthorised access to critical information infrastructure carries up to five years' imprisonment or a fine of up to Tk 50 lakh, rising to seven years or Tk 1 crore where data is stolen, destroyed or altered, or source code is tampered with (section 17).[1] The offence names software developers and users of AI tools expressly, and it is non-bailable (section 46).[1] Vendors with remote access to a designated system should therefore have that access documented, authorised in writing and logged.
Cyber incident reporting: one playbook, several regulators
Within any cyber law compliance Bangladesh programme, incident reporting is the obligation most likely to be tested, and the one most organisations have not rehearsed. The proviso to section 9(4) of the Cyber Security Act 2026 requires any government, private or autonomous body or institution that experiences a cyber incident to inform the Agency's National CERT immediately.[1] The Cyber Security Act 2026 does not define "cyber incident" or set a threshold, and no rules have narrowed it. The prudent reading is that any confirmed compromise of confidentiality, integrity or availability is reportable.
Where to report
On 4 August 2026 the National Cyber Security Agency launched a Cyber Incident Reporting System that lets citizens and organisations file reports online, with each report moving through verification, analysis, escalation, response, monitoring and resolution.[9] BGD e-GOV CIRT, based at the Bangladesh Computer Council in Agargaon, continues to run its own online incident form, which asks for the affected domain and IP, the incident type, the attack vector, whether the incident is ongoing, an impact rating and steps already taken, with evidence uploaded as a compressed archive.[10] Those fields are a useful template for an internal first report.
Sector and data protection reports
- Financial institutions: Bangladesh Bank's Cybersecurity Framework, issued on 29 March 2026, requires critical cyber incidents to be reported within 72 hours to internal and external stakeholders, including Bangladesh Bank and BGD-CIRT. It applies to scheduled banks, finance companies, MFS providers, payment service providers and payment system operators.[11]
- Personal data breaches: section 20 of the Personal Data Protection Act 2026 requires a data fiduciary to notify the National Data Management Authority of a breach likely to cause significant harm, in the form, manner and time set by regulations, covering the nature of the breach, categories and estimated numbers affected, contact points and remedial measures.[2]
- Critical information infrastructure: the Chittagong Port designation required regular reports and incident reports to the Agency and the national security operations centre.[8]
Building the playbook
One incident can trigger three or four reports with different recipients and clocks. Build a single playbook that records who decides an event is an incident, who files each report, the template for each, and who signs off. Keep the first report factual and short; update it as facts develop. Preserve logs before remediation overwrites them, because the Director General can order data preserved for up to 90 days, extendable by the Tribunal to 180 days in total (section 36).[1] Above all, log the time each report was sent. "Immediately" will be judged with hindsight.
Data protection: Personal Data Protection Act 2026 status
Many compliance documents still refer to the Personal Data Protection Ordinance 2025. That ordinance has been replaced. The Personal Data Protection Act 2026 (Act No. 63 of 2026) is deemed to have taken effect on 6 November 2025, except section 23 and sections 31 to 35, which take effect on a date the government fixes by gazette notification after eighteen months.[2] The regulator is the National Data Management Authority established under the National Data Management Act 2026.[2]
What is live and what is deferred
The deferred provisions are the Chief Data Officer requirement for significant data fiduciaries (section 23), complaints (section 31) and the administrative fines and compensation provisions (sections 32 to 35).[2] Everything else, including lawful bases, data subject rights, security standards, retention, records, breach notification, data audits and data protection plans, is already part of the law. The absence of fines is not the absence of obligations: non-compliance today becomes evidence tomorrow, and section 36, which allows the Authority to fine directors, managing directors and operational staff on a data subject's complaint, is not on the deferred list.[2]
Security measures the Act requires
Section 17 requires every data fiduciary and processor to take appropriate technical and organisational measures, scaled to the volume and sensitivity of data, the likely harm, the scope of processing, the retention period and the cost of available tools. The measures must include pseudonymisation, encryption, resilience of systems, timely restoration after incidents, periodic risk assessment, regular testing of controls and continuous updating.[2] Processors are directly responsible for meeting those standards, so vendor contracts should allocate them expressly.
Lawful bases, sensitive data, cross-border transfers and data subject rights are covered section by section in our guide to Bangladesh data protection law in 2026, and health platforms should also read our analysis of patient data and cloud hosting. The checklist point here is narrower: cyber law compliance Bangladesh organisations undertake should treat section 17 as the security baseline, because it is the standard against which any breach will be measured.
Data retention, security and record-keeping
Retention is where the Cyber Security Act 2026, the Personal Data Protection Act 2026 and the ICT Act interact most, and where internal policies most often contradict each other. A defensible schedule reconciles four rules.
Electronic records under the ICT Act
Where another law requires a document or record to be retained, section 9 of the ICT Act 2006 allows it to be kept electronically if it remains accessible for later reference, is kept in its original format or one that accurately represents it, and preserves information identifying its origin, destination and time of dispatch or receipt.[3] The section does not apply where another law prescribes a specific manner of retention.[3] Tax, company and labour records therefore need checking against their own statutes before paper originals are destroyed.
Retention limits and registers under the data protection law
Section 18 of the Personal Data Protection Act 2026 prohibits retaining personal data beyond the period set by regulation for the purpose for which it was processed, with limited exceptions for public interest, research and statistics.[2] Section 19 pulls the other way: a data fiduciary must keep a register of all personal data it processes for at least five years and maintain up-to-date records of every operation on a data principal's data, including storage, alteration, erasure and portability.[2] The practical answer is to delete the underlying data when its purpose ends but keep the processing record for at least five years.
Preservation orders and litigation holds
Section 36 of the Cyber Security Act 2026 lets the Director General order whoever controls a computer system to preserve specified data for up to 90 days, extendable to 180 days by the Tribunal.[1] A preservation order overrides ordinary deletion. The retention policy must therefore include a hold procedure that suspends automatic deletion for the data covered, records who applied the hold, and lifts it only when the order expires.
Security of the records themselves
Records are only useful if they are trustworthy. Logs should be time-synchronised, write-protected and retained long enough to investigate incidents that are discovered late. Bangladesh Bank's framework expects SIEM, multi-factor authentication, web application firewalls, strong encryption and least-privilege access in regulated entities, which is a sensible benchmark for any organisation holding sensitive data.[11]
Government requests, takedowns and the BTRC
Platforms, publishers, hosting providers and ISPs receive more government requests than any other category of business. Cyber law compliance Bangladesh platforms need here is a process, not an improvised reply.
Blocking and removal under section 8
The Director General may remove or block content that threatens cyber security, or ask the BTRC to do so. Law enforcement agencies may seek removal, through the Director General or the BTRC, of content that threatens national integrity, security, defence or public order, or that incites violence or crime.[1] The government must publish a list of blocked content, and every removal or block needs the relevant Tribunal's approval within three days, failing which the content must be restored.[1]
The volume is real. Google reported 279 removal requests from Bangladesh covering 1,023 items in January to June 2025; the government said such referrals typically come from law enforcement and the National Cyber Security Agency and are forwarded to the BTRC.[12] Licensing and network-level obligations are covered in our guide to telecommunications law in Bangladesh.
Investigation requests and confidentiality
An investigating officer may ask any person, entity or service provider for information or assistance, and the recipient is obliged to provide it (section 38).[1] Section 39 protects the provider from civil or criminal claims for disclosure made for an investigation, but requires everyone involved to keep investigation information confidential. Breach is punishable with up to two years' imprisonment or a Tk 1 lakh fine, and any provider that discloses information must send the National Cyber Security Council a list of what it disclosed every six months.[1]
A request-handling protocol
- Route every request to a named legal owner, never to the account manager who happened to receive it.
- Verify the requester's identity and authority, and identify the statutory basis relied on: section 8, section 34 warrant, section 36 preservation or section 38 assistance.
- Disclose only what is asked for, and record exactly what was disclosed, to whom and when.
- Maintain the six-monthly disclosure list required by section 39(4).
- For blocking requests, diarise the three-day Tribunal approval window and the restoration obligation if approval does not follow.
- Decide in advance when users are told, consistent with the confidentiality duty.
Employee policies and insider risk
Most cyber offences committed "by" a company are committed by its people, which is why employee policies sit at the heart of cyber law compliance Bangladesh boards can defend. Section 18 punishes anyone who intentionally gains unauthorised access to a computer or network, or helps another to do so, with up to one year or a Tk 10 lakh fine, rising to five years or Tk 50 lakh where data is stolen, destroyed or altered.[1] A departing employee who downloads a client database, or an administrator who keeps credentials after reassignment, can fall within it.
Why policies matter for directors
Under section 29, where a company commits an offence, every owner, chief executive, director, manager, secretary, partner, officer, employee or representative directly connected with it is deemed to have committed it, unless that person proves it happened without their knowledge or that they made every reasonable effort to prevent it.[1] The company may be prosecuted in the same proceedings but can only be fined. "Company" includes partnerships, associations, societies and other organisations.[1] Section 67 of the ICT Act 2006 contains a parallel rule for ICT Act offences.[3] The "every reasonable effort" defence is proved with documents: policies, training records, access reviews and evidence that warnings were acted on.
The minimum policy set
- Acceptable use: permitted use of company systems, prohibited conduct (including the section 25 and 26 content offences), and consequences.
- Access control: role-based access, least privilege, multi-factor authentication, prompt revocation on exit or transfer, and periodic access reviews.
- Personal devices and remote work: conditions for BYOD, encryption, remote-wipe consent and use of public networks.
- Confidentiality and data handling: classification, sharing rules, and the section 39 duty not to disclose investigation information.
- Incident escalation: a duty on every employee to report suspected incidents internally at once, with protection for good-faith reporters.
- Monitoring notice: clear notice of what systems are monitored and why, so that monitoring itself does not breach the data protection law.
- AI tools: rules on entering personal or confidential data into external AI services, given that sections 17 and 18 of the Cyber Security Act 2026 expressly cover data generated through AI agents.
Disciplinary and termination consequences should match the Labour Act process; our employment law compliance practice aligns IT policies with service rules and works with HR on dismissals for misuse, discussed further in our guide to hiring and firing laws in Bangladesh.
ICT Act 2006 remnants: digital signatures and CCA licensing
The ICT Act 2006 lost its speech offences, but its commercial core remains in force and still forms part of cyber law compliance Bangladesh businesses must manage. Sections 54 to 57 and section 66 are marked as repealed on the official text.[3] What survives is essential to e-contracting and record-keeping.
Electronic records and signatures
The Act gives legal recognition to electronic records and electronic signatures. Section 7 allows information or a document that another law requires to be signed or certified to be authenticated by an electronic signature affixed in the prescribed manner.[3] Sections 16 and 17 set the standards for a secure electronic record and a secure electronic signature.[3] Section 11, however, does not oblige ministries, statutory bodies or government-controlled authorities to accept or issue documents electronically.[3] Filings with public bodies therefore depend on what each body accepts.
Certifying authority licensing
Chapter 5 establishes the Controller of Certifying Authorities and requires a licence to issue electronic signature certificates. Under section 22 a licence is refused to an applicant lacking the prescribed qualifications, expertise, manpower, financial capacity and infrastructure; it is valid for a prescribed period, subject to conditions, and cannot be inherited or transferred.[3] Licences can be renewed, suspended and revoked under sections 24 to 27.[3] The Controller sits within the ICT Division, which in February 2022 issued Bangladesh Bank its own certifying authority licence.[13]
For businesses the checklist is simple. Use certificate-based digital signatures from a licensed certifying authority for high-value or contested documents; keep the certificate chain and audit trail; and treat instruments that must be stamped, registered or attested as paper-first unless the receiving authority confirms otherwise.
Intermediary protection and confidentiality
Section 79 protects a network service provider from liability for third-party data it makes available if it proves the offence happened without its knowledge or that it made reasonable efforts to prevent it.[3] Section 63 makes it an offence for a person who gained access to records under the Act to disclose them without consent, punishable by up to two years or a fine of up to Tk 2 lakh.[3] Both depend on records: notice-and-action logs for section 79, access logs for section 63.
Cyber law compliance Bangladesh: penalties for corporate offences
The table below collects the provisions most relevant to cyber law compliance Bangladesh companies manage, with maximum penalties and bail status. Personal liability under section 29 applies to every Cyber Security Act 2026 offence. On a phone, scroll it sideways.
| Provision | Conduct | Maximum penalty | Bail status | Corporate point |
|---|---|---|---|---|
| CSA 2026, s 17(1)(a) | Unauthorised access to critical information infrastructure | 5 years or Tk 50 lakh, or both | Non-bailable | Covers developers and AI tool users; control vendor access |
| CSA 2026, s 17(1)(b) | Stealing, destroying or altering data or source code via unlawful access | 7 years or Tk 1 crore, or both | Non-bailable | Highest corporate-relevant penalty in the Act |
| CSA 2026, s 18(1)(a) | Unauthorised access to a computer or network | 1 year or Tk 10 lakh, or both | Bailable | Typical insider and ex-employee risk |
| CSA 2026, s 18(1)(c) | Hacking that steals, destroys or alters data | 5 years or Tk 50 lakh, or both | Non-bailable | Access reviews and logs are the defence evidence |
| CSA 2026, s 19 | Malware, system damage, denial of access, phishing or ransomware emails | 5 years or Tk 50 lakh, or both | Non-bailable | Compoundable with court consent |
| CSA 2026, s 21 | Cyber forgery, including false data and digital documents | 2 years or Tk 20 lakh, or both | Bailable | Compoundable with court consent |
| CSA 2026, s 22 | Cyber fraud on systems, e-commerce platforms or social media | 5 years or Tk 50 lakh, or both | Non-bailable | Relevant to online marketplaces and payment flows |
| CSA 2026, s 24 | Unauthorised e-transaction from a bank, insurer or MFS | 1 year and Tk 10 lakh | Bailable | Fintech and payment operators |
| CSA 2026, s 39 | Breaching confidentiality of investigation information | 2 years or Tk 1 lakh, or both | Not listed in s 46 | Six-monthly disclosure list to the Council |
| ICT Act 2006, s 63 | Disclosing records accessed under the Act without consent | 2 years or Tk 2 lakh, or both | Under the ICT Act | Section 67 director liability applies |
| PDPA 2026, s 32 | Failing to honour data subject rights | Tk 25 lakh; Tk 50 lakh for a significant data fiduciary | Administrative fine | Deferred until gazette notification |
| PDPA 2026, s 33 | Failing to secure personal data | Tk 25 lakh | Administrative fine | Deferred until gazette notification |
Three points follow from the table. First, the most serious offences, including hacking and cyber fraud, are non-bailable, so an employee or officer arrested in an investigation faces discretionary bail rather than bail as of right.[1] Second, several offences, including sections 19, 21, 22 and 24, are compoundable with the court's consent, which leaves room for settlement with a victim.[1] Third, the data protection fines are deferred but already written into the Act, at up to Tk 25 lakh, or Tk 50 lakh for a significant data fiduciary, with additional fines for repeat violations.[2] For criminal defence and quashment of misconceived cases, see our section 561A quashment guide.
Regulators and contact points
Knowing who to call matters as much as knowing what the law says. The Cyber Security Act 2026 places the National Cyber Security Agency, attached to the ICT Division and headed by a Director General, at the centre, with a National Cyber Security Council chaired by the Prime Minister overseeing policy.[1] The Agency's National ICT and Cyber Security Rating System grades organisations from A to E across four pillars and 131 indicators, which is likely to become a benchmark in procurement and regulatory review.[9]
National Cyber Security Agency
Attached to the ICT Division; runs the National CERT, blocks content and inspects critical information infrastructure.
BGD e-GOV CIRT
Based at the Bangladesh Computer Council; takes incident reports online and offers testing and forensic services.
National Data Management Authority
The Authority under the Personal Data Protection Act 2026 for breach notifications, standards and, once notified, fines.
BTRC
Licenses networks and relays blocking and removal requests to platforms and operators.
Bangladesh Bank
Sets the Cybersecurity Framework for banks, finance companies, MFS and payment providers.
Controller of Certifying Authorities
Licenses certifying authorities that issue electronic signature certificates under the ICT Act 2006.
Cyber law compliance Bangladesh: step-by-step process
The sequence below reflects how we run cyber law compliance Bangladesh reviews for clients, from a first gap analysis to a programme the board can evidence.
Map systems and data
Inventory systems, data categories, vendors with access and cross-border flows, and identify every statute and sector rule that applies.
Confirm your status
Check whether you or a client have been declared critical information infrastructure, are a regulated financial entity or are likely to be a significant data fiduciary.
Name the owners
Appoint a security lead, a data protection lead and a legal owner for government requests, with board-level reporting lines.
Write the policies
Adopt acceptable use, access control, device, confidentiality, monitoring, AI-use and incident escalation policies, and train staff on them.
Build one incident playbook
Set triggers, templates and sign-off for the National CERT, Bangladesh Bank, data protection and contractual notices, with log preservation first.
Fix retention and holds
Reconcile ICT Act, data protection and sector retention rules, keep five-year processing registers and add a preservation-order hold procedure.
Control requests and takedowns
Route every police, Agency or BTRC request to a legal owner, verify the basis, disclose narrowly and keep the six-monthly disclosure list.
Audit, test and report
Run annual audits and penetration tests, rehearse the playbook, update for new rules and report to the board at least quarterly.
The order matters. Policies written before the data and systems are mapped describe an organisation that does not exist, and incident playbooks written without named owners fail at the first weekend breach. Our corporate governance and compliance practice runs these reviews and prepares the board papers that record them.
Board reporting
Boards should receive a short cyber report at least quarterly covering incidents and reports made, open audit findings, access reviews, government requests received, training completion and changes in the law. That record is the evidence of "every reasonable effort" that section 29 rewards.[1] For the wider duties of directors, see our guide to corporate governance and directors' duties in Bangladesh.
Common mistakes to avoid
- Citing repealed law: policies, contracts and terms of use that still refer to the Digital Security Act 2018, the Cyber Security Act 2023 or ICT Act section 57.
- Waiting for fines: treating the deferred data protection penalties as a deferral of the obligations themselves.
- One-regulator thinking: reporting to Bangladesh Bank but not the National CERT, or vice versa.
- Remediating before preserving: rebuilding a compromised server before logs are copied, destroying the evidence regulators and insurers will ask for.
- Informal disclosure: answering a police or agency request by email without checking the legal basis or recording what was sent.
- Unmanaged vendor access: shared credentials and undocumented remote access, which blur who is "authorised" under sections 17 and 18.
What to watch in 2026 and 2027
Four developments will shape cyber law compliance Bangladesh businesses face over the next year. First, the proposed second amendment to the Cyber Security Act 2026. A cabinet committee reviewed the draft in mid-July 2026 and recommended changes, and at the September consultation the government said a provision allowing reasons for a block to be given after three days had been dropped and an appeal mechanism added.[14] [7] Second, rules under section 49, which will settle the audit methodology for critical information infrastructure and the operation of the CERTs.[1]
Third, the regulations and gazette notification that will fix breach-notification timing and switch on the data protection fines and complaints.[2] Fourth, the draft National Cyber Security Strategy 2026 to 2030, released for consultation in August 2026, and the 31 December 2026 deadline for full compliance with Bangladesh Bank's framework.[9] [11] If you need a gap analysis, an incident playbook or board-level advice, contact TRW.
Frequently asked questions
What is the main cyber law businesses must comply with in Bangladesh in 2026?
Must a private company report a cyber incident?
Yes, and it is the first item in any cyber law compliance Bangladesh checklist. The proviso to section 9(4) of the Cyber Security Act 2026 requires any government, private or autonomous body that experiences a cyber incident to inform the National CERT immediately. Financial institutions must also report critical incidents to Bangladesh Bank within 72 hours.[1] [11]
Is the Personal Data Protection Ordinance 2025 still in force?
No. It has been replaced by the Personal Data Protection Act 2026 (Act No. 63 of 2026), deemed effective from 6 November 2025. Section 23 and sections 31 to 35, covering the Chief Data Officer, complaints and fines, take effect only when the government notifies a date after eighteen months.[2]
What is critical information infrastructure in Bangladesh?
What must critical information infrastructure operators do?
Run their own CERT or CIRT and SOC, report SOC activity quarterly, resource the team adequately, complete an annual internal and external audit, submit it to the National Cyber Security Council and accept inspection by the Director General.[1]
How long must personal data records be kept?
A data fiduciary must keep a register of personal data it processes for at least five years under section 19, while section 18 prohibits keeping the data itself beyond the period set by regulation for its purpose.[2]
Can directors be personally liable for a company's cyber offence?
Yes. Under section 29, owners, directors, managers and other officers directly connected with the offence are deemed to have committed it unless they prove lack of knowledge or every reasonable effort to prevent it. The company itself can only be fined.[1]
Must a platform comply with a government takedown request?
Section 8 of the Cyber Security Act 2026 lets the Director General block or remove content directly or through the BTRC, but every block needs Cyber Tribunal approval within three days or the content must be restored. Platforms should verify the legal basis and log each request.[1]
Are electronic signatures valid in Bangladesh?
Yes. The ICT Act 2006 recognises electronic records and signatures, and certificates are issued by certifying authorities licensed by the Controller of Certifying Authorities. Government bodies are not obliged to accept electronic documents.[3]
What happens if we disclose information about a police cyber investigation?
Section 39 requires everyone involved in an investigation to keep its information confidential. Breach carries up to two years' imprisonment or a fine of up to Tk 1 lakh, and disclosing providers must file a six-monthly list with the Council.[1]
Source register
Primary legal and regulatory sources
Materials checked on 20 October 2026. Confirm the current official text before relying on any provision.
- Cyber Security Act 2026 (Act No 81 of 2026), as amended by Act No 99 of 2026 — Laws of Bangladesh
- Personal Data Protection Act 2026 (Act No 63 of 2026) — Laws of Bangladesh
- Information and Communication Technology Act 2006 (Act No 39 of 2006) — Laws of Bangladesh
- Dhaka Tribune, 10 April 2026 — Parliament passes 20 bills, including the Cyber Security Bill
- The Financial Express, 30 June 2026 — Bangladesh amends cybersecurity law, drops online gambling clause
- Prothom Alo, 22 May 2025 — Government issues gazette of Cyber Security Ordinance
- The Business Standard, 26 September 2026 — Stakeholders raise concerns over proposed Cyber Security Act amendments
- The Financial Express, 2 September 2026 — Ctg port declared critical information infrastructure
- The Daily Star, 5 August 2026 — New cyber platforms rolled out to boost security
- BGD e-GOV CIRT, Bangladesh Computer Council — Report Incident
- UNB, 29 March 2026 — Bangladesh Bank unveils new cybersecurity framework to safeguard financial sector
- The Daily Star, 28 November 2025 — Bangladesh made 279 requests for content removal in first half of 2025: Google report
- The Business Standard, 20 February 2022 — ICT Division issues Bangladesh Bank CA licence
- The Financial Express, 16 July 2026 — Cabinet committee reviews draft cyber security amendment act
Related TRW assistance
Move from information to a defined next step
TRW runs cyber and data compliance reviews, drafts incident playbooks and IT policies, advises critical information infrastructure operators and handles government requests and investigations. Explore our corporate governance and compliance practice or contact TRW to arrange a gap analysis.