Cyber Law in Bangladesh: The Cyber Security Act 2026, Offences, Tribunals and Rights

Cyber law in Bangladesh: the 2026 position

Cyber law in Bangladesh now rests on one main statute: the Cyber Security Act 2026 (Act No. 81 of 2026). Parliament passed it on 10 April 2026 to re-enact the interim government's Cyber Security Ordinance 2025, and it is deemed to have been in force since 21 May 2025.[1] [7] In June 2026 Parliament amended it to remove the online gambling offence.[8] A second, much more contested amendment on rumours, disinformation and defamation was still in draft in late September 2026.[10] Anyone who has been harassed online, accused of an online offence, or has to run a company's systems needs to work from the current text, not from commentary on the Digital Security Act 2018.

This guide explains how cyber law in Bangladesh reached its current form, then covers offences, victims' complaints, investigation, the Cyber Tribunal, bail, appeals, takedowns, corporate duties and official texts. Data protection, telecom and fintech are in our technology law guide; general procedure is in our criminal law guide.

Summary: The Cyber Security Act 2026 defines Bangladesh's cyber offences: hacking, malware, online fraud and forgery, cyber terrorism, unauthorised e-transactions, online sexual harassment, revenge pornography, sextortion and religious or ethnic hate speech. Cases are tried by the Cyber Tribunals set up under the ICT Act 2006, and appeals go to the Cyber Appellate Tribunal, which in practice has meant the High Court Division. The speech offences of the 2018 and 2023 laws, including defamation, are gone, and pending cases under them were cancelled. The Act also gives a National Cyber Security Agency power to block content, but each block must be approved by a Tribunal within three days.

Key point: Who may file a case is now restricted. Under section 40, only the aggrieved person, someone they authorise in writing, or a member of a law enforcement agency may start a case. For forgery, sexual harassment and hate speech cases, a magistrate must review the record within 24 hours and either order an investigation or dismiss the complaint and release the accused. Section 28 punishes anyone who files a case without lawful grounds in order to harm another person.

At a glance

Swipe or scroll →

Table of Contents

What cyber law in Bangladesh covers: the statutory map

There is no single cyber code. Cyber law in Bangladesh is a set of statutes, and one dispute often engages several. A leaked intimate video may be an offence under both the Cyber Security Act 2026 and the Pornography Control Act 2012, and also a data protection problem.

The core statutes

• Cyber Security Act 2026 (Act No. 81 of 2026): the main cybercrime statute. It sets out the offences, the investigation powers, takedowns, the National Cyber Security Agency and the protection of critical information infrastructure.[1]
• Information and Communication Technology Act 2006 (Act No. 39 of 2006): gives legal effect to electronic records and signatures, constitutes the Cyber Tribunals and the Cyber Appellate Tribunal, and protects network service providers in some cases. Its speech offences in sections 54 to 57 and 66 are marked as repealed.[2]
• Pornography Control Act 2012 (Act No. 9 of 2012): covers making and distributing pornography, including by internet or mobile phone, and using it to damage someone's reputation or to extort them.[3]
• General criminal law: the Penal Code, the Code of Criminal Procedure and the Evidence Act apply to cyber proceedings unless the 2026 Act provides otherwise.[1]
• Sector rules: the Bangladesh Telecommunication Act 2001 for networks and licensing, the Personal Data Protection Act 2026 for personal data, and the Ministry of Commerce's Digital Commerce Operation Guidelines 2021 for online sellers. These are covered in our technology law, data protection and e-commerce guides.

Internet and web law basics

Three rules shape most internet law questions. First, the Cyber Security Act 2026 prevails over any other law that conflicts with it, except the Right to Information Act 2009, which continues to govern access to information.[1] Second, the Act reaches beyond Bangladesh's borders. It applies to a Bangladeshi citizen who commits an offence abroad, to anyone abroad who commits an offence using a computer or device in Bangladesh, and to anyone in Bangladesh who commits an offence abroad (section 4).[1] Third, under section 79 of the ICT Act a network service provider is not liable for third-party data it makes available, if it proves the offence happened without its knowledge or that it made every reasonable effort to prevent it.[2]

The definitions are wide. "Cyberspace" covers the internet, telecom networks, blockchain, AI networks, gaming, cloud, the internet of things and social media; "service provider" covers platforms, anyone processing data for them, penetration testers and security operations centres.[1] Most technology businesses fall within them.

From ICT Act section 57 to the Cyber Security Act 2026

Four cybercrime laws in eight years have shaped cyber law in Bangladesh, and each still affects how pending cases are treated.

The ICT Act 2006 and section 57

The ICT Act was enacted in 2006, and for over a decade its offence provisions were the cyber law. Section 57, on publishing false, obscene or defamatory material electronically, carried seven to fourteen years' imprisonment and a fine of up to Tk 1 crore. Most cyber prosecutions were brought under it. A Prothom Alo review of the Dhaka Cyber Tribunal found that 2,140 of 2,261 pending ICT Act cases were under section 57. Of 768 cases disposed of over seven years, only 22 ended in conviction.[12]

The Digital Security Act 2018

Section 57 and three related sections were repealed in 2018 when the Digital Security Act took their place.[12] The DSA came into force on 8 October 2018 and soon attracted the same criticism. By 2023 the government itself was reporting more than 7,000 cases filed under it.[6]

The Cyber Security Act 2023

Parliament passed the Cyber Security Act 2023 (Act No. 39 of 2023) on 13 September 2023 to replace the DSA. Rights groups described it as a rebranded DSA. It kept warrantless search and arrest powers, and it replaced imprisonment for defamation with a higher fine.[6]

The Cyber Security Ordinance 2025

The interim government gazetted the Cyber Security Ordinance 2025 on 21 May 2025, repealing the 2023 Act with immediate effect. It dropped sections 21, 24 to 29, 31 and 34 of that Act, covering Liberation War and national symbols "propaganda", impersonation, offensive or false information, misuse of identity information and defamation, and annulled pending cases and sentences under them.[5]

It added offences of online sexual harassment of women and children, online gambling and AI-enabled crime, and the law adviser said it recognised internet access as a civic right.[5] The Cyber Security (Amendment) Ordinance 2025 (Ordinance No. 54 of 2025), dated 22 October 2025, amended sections 2 and 50.[4]

Re-enactment as Act No. 81 of 2026

After the February 2026 election, the Posts, Telecommunications and IT Minister, Fakir Mahbub Anam, moved the Cyber Security Bill 2026. Parliament passed it by voice vote on 10 April 2026, along with other bills converting the interim government's ordinances.[7] The Act repeals both 2025 ordinances and treats everything done under them as done under the Act (section 51).[1] Section 50 deals with older cases:

• Pending cases under sections 17 to 20, 22, 23, 30, 32 and 35 of the 2023 Act continue before the Cyber Tribunal as if that Act had not been repealed. Cases at the complaint, charge-sheet or investigation stage are treated as pending.[1]
• Cases, investigations and sentences under sections 21, 24 to 29, 31 and 34 of the 2023 Act are cancelled.[1]
• Cases, investigations and sentences under sections 21, 24 to 29 and 31 of the Digital Security Act 2018 (Act No. 46 of 2018) are cancelled in the same way.[1]

The June 2026 amendment

On 30 June 2026 Parliament passed the Cyber Security (Amendment) Bill 2026, which removed section 20 on online gambling. The Home Minister, Salahuddin Ahmed, said there was "no longer any need" for it because a separate gambling prevention law now deals with gambling. Opposition MPs warned the government not to use the law to suppress dissent.[8] The official text records section 20 as omitted by the Cyber Security (Amendment) Act 2026 (Act No. 99 of 2026).[1] Running an online gambling portal is still listed as cyber forgery in the explanation to section 21, so online gambling has not left this Act entirely.[1]

The table below compares the four laws. On a phone, scroll it sideways.

Institutions under the Cyber Security Act 2026

The National Cyber Security Agency, based in Dhaka and attached to the ICT Division, is headed by a Director General who, like the directors, must hold internationally recognised cyber security certification (sections 5 and 6).[1] The Director General blocks content, orders data preservation and inspects critical information infrastructure.

The National Cyber Security Council is chaired by the Prime Minister. Its members include ministers, the Inspector General of Police, intelligence chiefs, a retired Supreme Court judge and two private experts. It must meet at least once every three months and review cyber risk every quarter (sections 12 to 14).[1] The Agency also runs a National Computer Emergency Response Team and a National Security Operations Centre. Each critical information infrastructure must have its own CERT or CIRT. Any government, private or autonomous body that suffers a cyber incident must report it immediately to the National CERT (section 9).[1]

Sections 10 and 11 provide for accredited digital forensic laboratories, and section 43 makes digital forensic evidence admissible at trial notwithstanding the Evidence Act 1872.[1]

Offences and punishments under cyber law in Bangladesh

Chapter VI sets out the offences that define cyber law in Bangladesh today. Most carry imprisonment, a fine, or both; the figures below are maximums.

Hacking and unauthorised access: sections 17 and 18

Unauthorised access to critical information infrastructure carries up to five years or a fine of up to Tk 50 lakh. If the access is used to steal, delete or alter data, generate data through an AI agent or tamper with source code, the maximum rises to seven years or Tk 1 crore. The offence applies to software developers and users of AI tools as well as individuals.[1] For ordinary computers and networks, section 18 has three levels. Unauthorised access carries up to one year or Tk 10 lakh. Access in order to commit an offence carries up to two years or Tk 20 lakh. Hacking that steals, destroys or alters data carries up to five years or Tk 50 lakh.[1]

Malware, phishing and ransomware: section 19

Section 19 covers harmful unauthorised data collection, introducing malware, damaging systems or their physical infrastructure, denying lawful access, sending phishing or ransomware emails, and manipulating systems to obtain services or shift charges to another account. The maximum is five years or Tk 50 lakh.[1]

Forgery and fraud: sections 21 and 22

Cyber forgery under section 21 carries up to two years or Tk 20 lakh. Its explanation lists, among other things, creating false data or programs, making or altering digital documents, producing digital or crypto currency, running mobile banking through a SIM registered to someone else's national ID, hundi operations and running an online gambling portal.[1] Cyber fraud under section 22 covers altering or distorting information on a system, an e-commerce platform or social media to gain a benefit or cause harm, and deception generally. It carries up to five years or Tk 50 lakh.[1]

Cyber terrorism: section 23

The most serious offence carries up to ten years or Tk 1 crore. It covers attacks threatening the State's integrity, security or sovereignty, malware causing death or serious injury, attacks on essential services, and intrusion into protected data that could harm foreign relations or public order. A whistleblower acting in the wider public interest is expressly excluded from section 23(1)(d).[1]

Unauthorised e-transactions: section 24

Making an e-transaction from a bank, insurer, financial institution or mobile financial service without lawful authority, or one the government or Bangladesh Bank has declared illegal, carries up to one year and a fine of up to Tk 10 lakh.[1]

Sexual harassment, revenge pornography and sextortion: section 25

Section 25 is the provision most victims rely on. It applies to anyone who knowingly sends, publishes or spreads any image, video, audio or other content, including content created or edited by AI, for blackmail, sexual harassment, revenge pornography, child sexual abuse material or sextortion. Threatening to do so is also covered. The penalty is up to two years or Tk 10 lakh. Where the victim is a woman or a child under 18, it rises to five years or Tk 20 lakh.[1]

The definitions in section 2 are specific:

• Sexual harassment: repeatedly requesting nude images, proposing sexual relations by abusing a position of power, sending sexual images without being asked, sexualising a person's image with technology, or threatening someone into a sexual relationship.
• Revenge pornography: spreading a person's intimate images without consent and with intent to harm them.
• Sextortion: threatening to release intimate material to obtain money, a benefit or sex.[1]

Religious or ethnic hate speech: section 26

Publishing religious, communal or ethnic hate speech in cyberspace that causes violence or fear, or that directs disorder or crime, carries up to two years or Tk 10 lakh. The offence includes doing so under a false identity or through someone else's account.[1]

Abetment, false cases, compensation and forfeiture

Abetting any offence carries the same punishment as the offence itself (section 27). Filing a case or complaint under the Act with intent to harm, without knowing of any just or lawful ground, is punished as the principal offence would have been. The Tribunal can take up such a case on the aggrieved person's complaint or on its own motion (section 28).[1] The Tribunal may order an offender to pay compensation to the victim equal to the loss caused, out of the fine or in addition to it (section 30). It may also order confiscation of devices used in the offence, unless their owner was not responsible (section 47).[1]

What is no longer a cyber offence

Criticising the government, making "false" or "offensive" posts and online defamation are no longer offences under the Act, because those provisions were dropped in 2025 and not restored in 2026.[5] [1] That does not make defamatory content lawful. It can still be pursued under the general law, including the Penal Code's defamation provisions and civil claims. A legal notice is often the right first step.

Online harassment: what victims can do

Under cyber law in Bangladesh, a victim's sequence matters: preserve the evidence, report, then pursue takedown and prosecution.

Preserve the evidence first

Take screenshots that show the URL, date and the account's profile. Save the original files and message headers, and write down the platform's account identifiers. Under section 36, the Director General can order whoever controls the data to preserve it for up to 90 days, and the Tribunal can extend that to a total of 180 days. Platforms do not keep data indefinitely, so a request to the investigating officer to seek a preservation order should come early.[1]

Where to report

• The local police station: an FIR for a cognizable offence such as sections 21, 22 or 25, or a General Diary entry.
• Police Cyber Support for Women: a police unit launched in November 2020 in which all officers and investigators are women. It can be reached through its Facebook page, and the national emergency number 999 is free to call.[13]
• BGD e-GOV CIRT: run by the Bangladesh Computer Council. It takes incident reports through an online form and by phone and email.[14]
• The platform itself: report the content to the platform at the same time. Platform takedowns are usually faster than any legal route.

When the police will not register a case

Section 40(2) gives a direct remedy. If the police refuse to accept the complaint, the aggrieved person can file a written complaint with the Cyber Tribunal, supported by an affidavit stating that the police refused. If the Tribunal is satisfied after examining the complainant, it must direct a police officer to investigate. If not, it dismisses the complaint summarily.[1] Because the Tribunal cannot take cognizance without a police report (section 40(4)), this route leads to an investigation, not straight to a trial.

Parallel remedies

Where intimate images are involved, the Pornography Control Act 2012 also applies. It punishes damaging someone's dignity with pornographic material, or extorting money or other benefits through it, with up to five years' rigorous imprisonment and a fine of up to Tk 2 lakh. It also punishes supplying pornography by internet or mobile phone. Child pornography offences carry up to ten years and Tk 5 lakh.[3]

Investigation, search and arrest

Who investigates and how fast

A police officer, or another officer designated under the Act, investigates. Police officers must be at least Sub-Inspector rank. The Tribunal may form a joint investigation team if one is needed.[1] The investigation must be finished within 90 days. The controlling officer can allow 15 more days, and the Tribunal a further 30 days on a written report. Where the delay is due to technical limitations, the Tribunal can allow a reasonable further period (section 32).[1]

The 24-hour screening rule

Section 31(3) and (4) contain the most important protection. When a case is filed under section 21, 25 or 26, the record, and the accused if arrested, must be placed before the magistrate of the trial court within 24 hours. Within 24 hours after that, the magistrate must consider the record, hear the aggrieved person, and either order an investigation or record reasons for dismissing the complaint and order the accused's immediate release.[1] Defence counsel should be ready to argue at this stage that the complaint has no basis.

Search, seizure and warrantless arrest

Under section 34, a police officer who records the grounds for believing an offence has been committed may obtain a warrant from the Tribunal, or from the Chief Judicial or Chief Metropolitan Magistrate. The warrant can authorise collection of traffic data from service providers and interception of communications.[1] Section 35 allows search, seizure and arrest without a warrant, but only where a cyber attack on critical information infrastructure or hacking threatens to destroy evidence. The officer must record reasons, report the search to the Tribunal, and produce any arrested person before a magistrate or the Tribunal within 24 hours, as article 33 of the Constitution requires.[1]

Investigators may seize devices and data, collect traffic data and use experts, and must promptly tell the court what they hold (section 33).[1] Arrest memos and remand are covered in our criminal law guide.

The Cyber Tribunal: filing, cognizance and trial

Offences under the 2026 Act can be tried only by the Tribunal (section 41(1)). That means the Cyber Tribunal constituted under section 68 of the ICT Act 2006.[1] A Cyber Tribunal is presided over by a Sessions Judge or Additional Sessions Judge appointed by the government in consultation with the Supreme Court, and it can be given jurisdiction over one or more sessions divisions.[2] The first tribunal sat in Dhaka from 2013. On 4 April 2021 the government created tribunals in seven other divisional towns, making eight in total.[12]

Who may file, and cognizance

Only the aggrieved person, someone they authorise in writing, or a member of a law enforcement agency may file a case (section 40(1)). This shuts out complaints by third parties who were not themselves harmed.[1] The Tribunal can take cognizance only on a written report from a police officer or a joint investigation team, whatever the Code of Criminal Procedure says (section 40(4)).[1] The High Court Division applied the same rule under the DSA. In 2024 it upheld the dismissal of a complaint filed directly with the Rajshahi Cyber Tribunal, holding that the Tribunal had no power to take cognizance without a police report.[11]

Trial procedure and time limits

The Tribunal follows the procedure for trials before a Court of Session in Chapter XXIII of the Code of Criminal Procedure and has all the powers of a Sessions Court (sections 40(5) and 42).[1] It must dispose of a case within 180 working days of framing the charge. It may extend that once by up to 90 working days, recording its reasons. After that it must report in writing to the High Court Division, but the trial carries on (section 45).[1] The deadlines guide the court, but missing them does not end the case.

Bail, compounding and appeals

Section 46 classifies each offence. Whether an offence is bailable determines whether the accused gets bail as of right under section 496 of the Code of Criminal Procedure or must apply for discretionary bail under section 497. Both routes are explained in our guide to bail and criminal defence.

• Non-bailable: section 17, section 18(1)(c) hacking, and sections 19, 22 and 23.[1]
• Bailable: sections 18(1)(a) and (b), 21, 24, 25 and 26. Section 20, now omitted, was also listed.[1]
• Cognizable: sections 17, 18(1)(c), 19, 21, 22, 23 and 25. All others are non-cognizable.[1]
• Compoundable with the court's consent: sections 18(1)(a) and (b), 19, 21, 22, 24 and 25.[1]

Section 25, the main harassment offence, is cognizable but bailable, and compoundable with the court's consent. A victim who mainly wants the content removed and an undertaking can therefore settle rather than run a full trial.

Appeals

Anyone aggrieved by a Tribunal judgment may appeal to the Appellate Tribunal, which means the Cyber Appellate Tribunal under section 82 of the ICT Act (section 41(2)).[1] Section 84 of the ICT Act provides that until a Cyber Appellate Tribunal is constituted, appeals go to the High Court Division.[2]

In Md Abdur Rahim Rasel v State (30 May 2024), the High Court Division treated an appeal from the Rangpur Cyber Tribunal as lying under section 84. Because the ICT Act sets no time limit, it applied the 60-day period in article 155 of the Limitation Act 1908. It also held that section 5 of the Limitation Act, which allows delay to be condoned, applies to appeals under the ICT Act, the DSA and the 2023 Act, and it condoned a 213-day delay.[11] The safe course is to file within 60 days of the judgment.

A prosecution that is an abuse of process, such as a case filed by someone with no standing under section 40 or a case under a cancelled section, can be challenged before trial. Our section 561A quashment practice handles these applications.

Takedowns and blocking: section 8 in practice

Section 8 is the provision platforms and publishers deal with most. The Director General may remove or block content that threatens cyber security, or ask the BTRC to do so. Law enforcement agencies may seek removal, through the Director General or the BTRC, of content that threatens the country's integrity, security, defence or public order, contains religious, communal or ethnic hate speech that raises fears of violence, or gives instructions for disorder or crime.[1] The BTRC or the ICT Division then asks the technology company to act and informs the government. The government must publish information about blocked content in the interest of transparency.[1]

The main safeguard is section 8(4). Every removal, transfer or block needs the relevant Tribunal's permission within three days. If permission is not obtained in that time, or is refused, the content must be restored.[1] A person whose content is blocked should ask whether permission was obtained; if not, seek restoration, and a writ petition may be available where the authorities act outside their powers.

Victims usually want the reverse. Section 8 is a state power, so a private person can only ask the investigating police to seek action through the Director General or the BTRC; platform reporting and a lawyer's notice are usually faster.

Corporate obligations under cyber law in Bangladesh

For businesses, cyber law in Bangladesh means positive duties as well as prosecution risk, and liability reaches individuals.

Liability of directors and officers

Where a company commits an offence, every owner, chief executive, director, manager, secretary, partner, officer, employee or representative directly involved is deemed to have committed it. The exception is a person who proves the offence happened without their knowledge or that they made every possible effort to prevent it. The company itself can be prosecuted in the same case but can only be fined. "Company" includes firms, associations, societies and organisations (section 29).[1] The defence depends on evidence: written policies, training records, access logs and documented responses to warnings. Our corporate governance and compliance practice builds these controls.

Positive duties

• Incident reporting: any cyber incident at a government, private or autonomous body must be reported immediately to the National CERT (section 9(4)).[1]
• Assistance and confidentiality: any person, entity or service provider must help the investigating officer when asked, including by providing information (section 38). Information given for an investigation cannot lead to a civil or criminal claim against the provider, but confidentiality must be kept. A breach is punishable by up to two years or Tk 1 lakh. Providers must also send the Council a list of what they disclosed every six months (section 39).[1]
• Data preservation: comply with Director General orders to preserve data for up to 90 days, extendable to 180 (section 36).[1]
• Critical information infrastructure: systems the government declares by gazette as critical information infrastructure must carry out annual internal and external audits, report to the Council, accept monitoring by the Director General, run their own CIRT and name a focal point (sections 15, 16 and 48).[1]

These duties sit alongside data protection breach notification and sector rules, so one incident can trigger several reports. Plan them in advance.

Swipe or scroll →

Guidelines, official texts and resources

For a reliable cyber law in Bangladesh PDF, use only official sources.

• Laws of Bangladesh (bdlaws.minlaw.gov.bd): the Legislative and Parliamentary Affairs Division's database. It carries the current Bangla text of the Cyber Security Act 2026 with the 2026 amendment footnoted, and gives each section its own page.[1] The ICT Act 2006 and the 2025 amendment ordinance are also there.[2] [4]
• English text: section 52 provides for an authentic English translation to be published. Until it is, the Bangla text is the law, and older English PDFs of the DSA or the 2023 Act should not be relied on.[1]
• BGD e-GOV CIRT: publishes advisories, alerts, guidelines and policy documents, and takes incident reports.[14]
• Rules: many operational details, including the Agency's functions and the takedown procedure, are left to rules (sections 5, 8 and 49). Check whether rules have been notified before advising on procedure.[1]

Guidance written before May 2025, including much published as "cyber law guidelines" or a "computer crime act", cites offences and section numbers that no longer exist. Check every reference against the 2026 Act.

When to instruct a cyber law lawyer in Bangladesh

Outcomes in cyber law in Bangladesh are often decided in the first 48 hours: when the complaint is drafted, at the magistrate's 24-hour review, at the first bail hearing, or when a takedown request is sent. Instruct an IT lawyer or cyber law consultancy in these situations:

• Victims: to frame the complaint under the right sections, preserve evidence, use section 40(2) if the police refuse, pursue compensation under section 30 and coordinate takedowns.
• Accused persons: to check whether the complainant has standing, whether the section relied on still exists, and whether the 24-hour review and warrant requirements were met. And to seek bail, discharge or quashment.
• Companies: for incident response, police and regulator requests, CII designation, director liability and terms that cite repealed laws.
• Publishers and platforms: for section 8 blocking orders, user-data requests and pre-publication review of sensitive content.

Good counsel combines trial experience with enough technical knowledge to test a forensic report.

What to watch: the proposed second amendment

The biggest open question for cyber law in Bangladesh is a second amendment drafted in mid-2026. As reported in July 2026, it would add a section 26A making it an offence to publish rumours or disinformation online, punishable by up to ten years or Tk 40 lakh. It would also rewrite section 25 to restore defamation and "derogatory" content offences, defined by reference to section 499 of the Penal Code, with higher penalties where the victim is a woman or child.[9] Critics, including digital rights groups, said it would revive the DSA.[9]

At a consultation on 26 September 2026, the Prime Minister's information and broadcasting adviser confirmed the draft had not been passed and could still change. He said a provision allowing reasons for a block to be given up to three days afterwards had been dropped and an appeal mechanism added. Editors and BLAST objected to criminal defamation and warrantless arrest.[10] Until a bill is passed and published, the Act as amended in June 2026 is the law. If enacted, it would reshape cyber law in Bangladesh for online speech and takedowns.

Frequently asked questions

What is the main cyber law in Bangladesh in 2026?

The Cyber Security Act 2026 (Act No. 81 of 2026), passed on 10 April 2026 and deemed in force from 21 May 2025. It was amended by Act No. 99 of 2026, which removed the online gambling section. The ICT Act 2006 still governs electronic records and the Cyber Tribunals.[1] [2]

Is the Digital Security Act 2018 still in force?

No. It was replaced by the Cyber Security Act 2023, which was itself repealed in May 2025. Pending cases under sections 21, 24 to 29 and 31 of the DSA, and sentences passed under them, are cancelled by section 50(5) of the 2026 Act.[1]

Is online defamation a crime under cyber law in Bangladesh?

Not under the Cyber Security Act 2026 as it stands. Defamation was dropped in 2025 and not restored. A draft amendment would bring it back, but as at late September 2026 it had not been passed. Defamation can still be pursued under the general law.[5] [10]

What is the punishment for revenge pornography or sextortion?

Under section 25, up to two years' imprisonment or a fine of up to Tk 10 lakh, or both. Where the victim is a woman or a child under 18, the maximum is five years or Tk 20 lakh. The Pornography Control Act 2012 may also apply.[1] [3]

Who can file a case under the Cyber Security Act 2026?

Only the aggrieved person, a person they authorise in writing, or a member of a law enforcement agency (section 40(1)). If the police refuse to register the complaint, the aggrieved person can file directly with the Cyber Tribunal with an affidavit.[1]

Are Cyber Security Act offences bailable?

Some are. Hacking, critical infrastructure attacks, malware and damage, cyber fraud and cyber terrorism are non-bailable. Forgery, unauthorised e-transactions, sexual harassment and hate speech offences are bailable (section 46).[1]

Where are cyber crime cases tried?

Before the Cyber Tribunals constituted under section 68 of the ICT Act 2006. There have been eight since April 2021, one in each division. The Tribunal must try the case within 180 working days of charge, extendable by 90 working days.[1] [12]

How long do I have to appeal a Cyber Tribunal judgment?

The ICT Act sets no period, so in 2024 the High Court Division applied the 60-day limit in article 155 of the Limitation Act to an appeal under section 84. It held that delay can be condoned under section 5, but it is safer to file within 60 days.[11]

Can the government block my post or website?

Yes, under section 8, for cyber security threats, threats to public order or security, and religious or ethnic hate speech. Each block needs Cyber Tribunal permission within three days, or the content must be restored.[1]

Must companies report cyber incidents?

Yes. Section 9(4) requires any incident at a government, private or autonomous body to be reported immediately to the National CERT. Directors directly involved in an offence can be personally liable under section 29.[1]