Data Protection Compliance in Bangladesh: A 2026 Readiness Checklist for the Personal Data Protection Act

Data protection compliance in Bangladesh: the October 2026 position

Data protection compliance in Bangladesh moved from a policy debate to a statutory obligation in less than a year. The interim government's Personal Data Protection Ordinance 2025 was approved on 9 October 2025 and took effect on 6 November 2025; the elected Parliament then replaced it with the Personal Data Protection Act 2026, Act No. 63 of 2026, which received presidential assent and was gazetted on 10 April 2026. Most of the Act is already treated as law from 6 November 2025. What remains switched off is the enforcement machinery: complaints, administrative fines, compensation and the Chief Data Officer requirement.

That gap is the readiness window. This alert gives general counsel, boards and foreign groups a working checklist for data protection compliance in Bangladesh: the confirmed legislative status, what is in force and what is deferred, fiduciary duties section by section, cross-border transfers, penalties and director exposure, and the points we could not confirm from official sources as at 26 October 2026.

Summary: The Personal Data Protection Act 2026 (Act No. 63 of 2026) replaced the 2025 Ordinance and its February 2026 amendment. It is deemed to have taken effect on 6 November 2025, except section 23 (Chief Data Officer) and sections 31 to 35 (complaints, administrative fines and compensation), which start only on a date the government fixes by gazette notification after an 18-month period. Consent, data subject rights, security, retention, records, breach notification and transfer rules already apply.

Key point: There is no fixed compliance deadline in the Act. Section 1(3) lets the government switch on the fines and complaints regime by gazette notification once 18 months have passed. Counted from the original Ordinance, that is 6 May 2027 at the earliest; counted from the Act's own date, 10 October 2027. Plan to the earlier date.

At a glance

Swipe or scroll →

Table of Contents

From Ordinance to Act: the legislative status confirmed

The Council of Advisers approved the Personal Data Protection Ordinance on 9 October 2025. At that stage it ran to 57 sections and was presented as treating personal data as belonging to the individual, with explicit consent as the default basis for processing.[4] The Law Ministry issued the gazette notifications for the data protection and national data governance ordinances in the first week of November 2025, and the Ordinance was recorded as Ordinance No. 61 of 2025, in force from 6 November 2025.[5] [6]

On 5 February 2026, days before the general election, the interim government promulgated the Personal Data Protection (Amendment) Ordinance 2026. It removed imprisonment from the offence provision, leaving fines only, and introduced a requirement that critical information infrastructure and restricted personal data hosted in the cloud keep at least one synchronised real-time copy inside Bangladesh.[9]

Parliament's Act No. 63 of 2026

The newly elected Parliament worked through the interim government's ordinances in April 2026. The Personal Data Protection Act 2026 received presidential assent on 10 April 2026 and was published in the Bangladesh Gazette Extraordinary the same day as Act No. 63 of 2026.[1] [2] Section 44 repeals both Ordinance No. 61 of 2025 and Ordinance No. 23 of 2026, and saves anything done or begun under them as if done under the Act.[1] Parliament passed the companion National Data Management Bill 2026 on 10 April 2026 by voice vote; no amendments were proposed.[10]

The enacted text differs materially from the Ordinance as first approved: 45 sections rather than 57, no criminal offences, and no in-country synchronised copy rule. Documents drafted against the Ordinance should be re-checked against the Act. Our overview of the Bangladesh data protection law in 2026 explains the wider framework; this alert concentrates on readiness.

What we could not confirm

As at 26 October 2026 we could not confirm from any official source: a gazette notification fixing the start date for section 23 and sections 31 to 35; any rules under section 41 or regulations under section 42; the publication of the Authentic English Text that section 45 requires; or the appointment of the National Data Management Authority's executive chairman and the start of its operations. Treat each of these as open until a gazette or official announcement appears.

The 18-month window: what is switched on and what is not

Section 1(3) is the most important provision for planning. It provides that, except for section 23 and sections 31 to 35, the Act is deemed to have taken effect on 6 November 2025, and that those excluded sections take effect on the date the government fixes by gazette notification after 18 months from the law's issue have passed.[1] [2]

Already in force

Everything outside the excluded sections applies now: the lawful bases for processing, sensitive data and children's data rules, every data subject right, the transparency, confidentiality, security, retention and record-keeping duties, breach notification, data audits, the data protection plan, the transfer rules and the Authority's functions and powers.[1] The Authority's power to issue directions, demand information, inspect premises and equipment, and order the suspension of data flows to a foreign state or international organisation is therefore available today, subject to the Authority actually being in operation.

Deferred until a gazette date

The deferred provisions are section 23 (Chief Data Officer for significant data fiduciaries), section 31 (complaints to the Authority), sections 32 and 33 (administrative fines), section 34 (factors for setting fines) and section 35 (compensation).[1] The practical effect is that there is no statutory complaints route and no fining power yet, but there is already a body of binding duties whose breach will be visible in records once enforcement begins.

When does the window end?

The Act does not name an end date, and the answer depends on the starting point. When the government defended the Ordinance in October 2025, it described an 18-month transition period running from the Ordinance.[8] On that reading the earliest possible switch-on date is 6 May 2027. Section 1(3) of the Act, however, refers to 18 months after the issue of this law, and the Act was issued on 10 April 2026, which points to 10 October 2027 at the earliest. Either way, nothing starts automatically: a gazette notification is required. Prudent data protection compliance in Bangladesh treats 6 May 2027 as the planning date.

Who must comply: scope and key definitions

Section 1(2) applies the Act to any person, data fiduciary or processor who processes personal data of Bangladeshi citizens, residents and people working or temporarily present in Bangladesh, who processes personal data inside Bangladesh, or who processes personal data outside Bangladesh in connection with supplying goods or services to, or monitoring, data subjects in Bangladesh.[1] Offshore platforms and group IT functions serving Bangladeshi customers or staff are within scope.

Data fiduciary, processor and data subject

A data fiduciary is any person who, alone or jointly, processes personal data for a specific purpose, supervises that processing or authorises another person to carry it out. A processor acts on a fiduciary's behalf. A data subject is a natural person to whom the data relates, identified or identifiable, and the definition expressly covers both living and deceased persons.[1] That matters for insurers, hospitals and banks handling estates.

Significant data fiduciaries

Regulations will designate significant data fiduciaries by reference to four factors: possible impact on state sovereignty; the volume of data and the financial stake in the processed data; risk to data subjects' rights; and possible threats to state security, public order, public safety, economic order and public health.[1] Banks, telecom operators, MFS providers, large platforms and hospitals should assume they are candidates.

Processing that predates the law

Section 40 lets a fiduciary continue processing personal data collected before the Act took effect, but only for the original purpose. Any change of purpose requires the data subject's prior consent in the manner regulations prescribe.[1] Legacy customer and employee databases are therefore not grandfathered for new analytics, marketing or AI uses.

Readiness checklist: lawful basis, consent and children's data

The first block of any programme for data protection compliance in Bangladesh is the lawful-basis map. Section 5 makes consent the primary basis: it must be voluntary, specific, clear and withdrawable, and the fiduciary must tell the data subject the purpose, retention period, transfer and withdrawal process before obtaining it. The burden of proving valid consent rests on the fiduciary.[1]

Processing without consent

Section 5(3) allows processing without consent where a legitimate ground exists, subject to utility, necessity, proportionality and purpose limitation, and to regulations. The grounds are performance of a contract with the data subject, steps at the data subject's request before contracting, establishing or defending legal claims, protecting vital interests, implementing employment, labour or social security rights, data the subject has voluntarily made public, and preventing harm to another person where consent is unreasonably withheld.[1] Section 6 permits further processing only where it is compatible with the original purpose.

Sensitive personal data

Section 7 limits processing of sensitive personal data to specific consent, contract, employment and social security obligations, medical duties by health professionals, legal duties, and data the subject has made public.[1] Health, financial, biometric and genetic data all need their own basis recorded, not a general privacy-notice tick box.

Children and persons unable to consent

Under section 9, a child's data may be collected or processed only with the consent of a parent, legal guardian or authorised decision-maker, in the manner regulations prescribe, and with the child's rights and interests protected. That consent remains valid until the child turns 18.[1] Consumer, education and gaming apps should build guardian-consent capture now.

Checklist items: map each activity to a section 5, 6 or 7 basis, rewrite consent wording, keep consent evidence and flag sensitive and children's data.

Readiness checklist: data subject rights

Chapter 3 rights are exercised by written application to the fiduciary. Section 10(4) makes them universal, inherent, non-transferable and inalienable, and they cannot be waived or excluded by contract or notice.[1] Standard terms that purport to limit access or erasure will not work.

Access and portability

Section 11 gives a right of access and, where applicable, portability through federated interoperable ecosystems. The response must be concise and intelligible and, as regulations prescribe, cover the categories, purposes, recipients, retention, source, safeguards for cross-border transfers and the logic and significance of automated decisions, together with a list of everyone with whom the data was shared.[1] Where disclosure could harm national security, public order or third-party rights, the fiduciary must inform the Authority in writing and follow its decision. Response times and request limits will come from regulations.

Correction, withdrawal and erasure

Section 12 requires a fiduciary that corrects, completes or updates data on request to inform the data subject and every relevant recipient within 30 days; a refusal must be reasoned in writing, and a dissatisfied data subject can ask for the data to be flagged and the Authority informed.[1] Section 13 allows withdrawal of consent at any time and requires erasure where the purpose has ended, consent is withdrawn, the subject objects, processing is unlawful or a legal duty requires it. Erasure may be refused for identity data, archival material, data held under legal obligation, and confidential or restricted data.[1]

Checklist items: one logged intake channel, section 11 response templates, a 30-day correction workflow and erasure rules aligned with retention duties.

Data fiduciary duties: the operational core

Chapter 4 is where most of the work in data protection compliance in Bangladesh lies, and all of it is already in force. Section 15 makes fiduciaries and processors responsible for compliance and requires transparent notice of the categories and collection methods, the general purposes, higher-risk categories, how to exercise rights, how to complain to the Authority, any transfer elsewhere, and the fiduciary's identity and contact details.[1] Section 16 bars disclosure for any purpose other than the one for which the data was collected, without consent.

Security standards

Section 17 requires appropriate technical and organisational measures against unauthorised destruction, loss, misuse, alteration, disclosure or access, calibrated to volume and sensitivity, likely harm, scope, retention and the cost of available tools. Measures must include pseudonymisation, encryption, confidentiality, integrity, availability and resilience of systems, timely restoration after an incident, periodic risk assessment of transmission, regular testing and continuous updating. The Authority may set standards by regulation, and processors are directly responsible for meeting them.[1]

Retention and five-year records

Section 18 prohibits keeping personal data beyond the period regulations prescribe for the purpose, subject to public interest, research and statistical exceptions. Section 19 pulls the other way on records: the fiduciary must keep all records relating to the personal data it processes in a register for at least five years, and maintain up-to-date records of processing, retention, structuring, combination, storage, alteration and portability.[1] The answer is to delete the data when its purpose ends but keep the processing record. Our guide to cyber law compliance in Bangladesh reconciles these duties with cyber security retention rules.

Breach notification

Under section 20, where a personal data breach is likely to cause significant harm to the data subject, the fiduciary must notify the Authority in the form, manner and time regulations prescribe. The Authority will consider the nature of the breach, the categories and approximate number of data subjects and records affected, the fiduciary's contact point, and the measures taken or planned to mitigate harm.[1] No deadline is yet fixed, so build a playbook that can produce those four elements within days.

Audits and the data protection plan

Section 21 subjects prescribed classes of fiduciary to audit by an independent data auditor, and lets the Authority order an audit where processing looks harmful. Section 22 requires every fiduciary to plan its technical systems to prevent harm to data subjects.[1]

Processors and vendors

Section 8 treats processing by a processor on a fiduciary's behalf as processing by the fiduciary, which remains liable for it, and requires the fiduciary to take reasonable steps to ensure the processor complies.[1] Every cloud, payroll, CRM, call-centre and analytics contract needs data processing terms: instructions, security, sub-processing, audit, breach reporting, return and deletion.

Significant data fiduciaries and the Chief Data Officer

Section 23 requires every significant data fiduciary to appoint as many qualified Chief Data Officers as necessary, working from the location the Authority specifies. The Chief Data Officer represents the fiduciary before the Authority, reports significant matters to the Authority and the fiduciary, acts as the contact point for data subjects, and acknowledges and resolves complaints about misuse or mishandling of sensitive personal data within the prescribed time.[1]

Section 23 is deferred, but the appointment should not be improvised when the gazette appears: candidates need authority, budget and a board reporting line. Boards should also note that section 26 allows the Authority to set fees or levies for significant fiduciaries and processors by regulation.[1] For board-level duties generally, see our note on corporate governance and directors in Bangladesh.

Cross-border transfers and data localisation

Cross-border transfers are where the drafting history causes most confusion. In October 2025 the government publicly denied that the final Ordinance imposed blanket localisation, describing a cloud-first approach with overseas storage permitted if platforms remained accountable to Bangladeshi jurisdiction.[8] The February 2026 amendment then added the in-country synchronised copy rule for critical information infrastructure and restricted data.[9] The Act as enacted does not contain that rule.

Classification under section 29 and the Schedule

Section 29 lets the government classify personal data, using the Schedule's criteria, as public or open, internal, confidential or restricted. Confidential data includes sensitive data whose disclosure could cause significant harm, discrimination or loss of privacy, among them financial, health, biometric and real-time location data. Restricted data covers data whose processing or transfer could affect national security, public order, defence, critical infrastructure or fundamental rights, and can include classified datasets and critical health or security data.[1]

When transfer abroad is permitted

Classified personal data may be transferred abroad where the data subject consents, where the transfer is part of a contract with the data subject for goods or services, or where, with consent, it concerns the subject's business, education, travel, immigration or similar interests. Transfers may go only to places or countries that have the technology and equipment regulations prescribe as adequate for protecting personal data.[1] Until those regulations exist, document an adequacy assessment for each cross-border destination and vendor.

Bulk sensitive identifiers and the profit levy

Section 29(6) requires mandatory notification to the Authority of bulk cross-border transfers of sensitive personally identifiable data: government unique identifiers such as NID, passport and TIN numbers, biometric identifiers, genetic or DNA data, and criminal records.[1] Section 29(5) also allows the government, by gazette notification, to set a fee or charge on the annual business or commercial profit of any institution arising from use of Bangladeshi citizens' personal data. Foreign platforms should model that exposure now.

Sector rules still apply

The Act does not displace sector regulation. Bangladesh Bank's Guidelines on Cloud Computing bar regulated institutions from hosting customers' financial and other sensitive data in cross-border public or hybrid cloud except, in exceptional cases, with Bangladesh Bank's prior approval.[12] Hospitals should read our analysis of patient data in the cloud, and EU-facing businesses our guide to GDPR compliance in Bangladesh.

Penalties, compensation and director exposure

The penalty regime is administrative and deferred, which is why data protection compliance in Bangladesh is still widely, and wrongly, treated as optional. Once switched on, section 32 allows an administrative fine of up to Tk 25 lakh for failure to comply with a data subject right, up to Tk 50 lakh where the violator is a significant data fiduciary, and an additional fine for a second or repeated violation. Section 33 allows a fine of up to Tk 25 lakh for failure to provide proper security for personal data in line with the Act, rules, regulations or SOPs.[1]

How fines will be set

Section 34 directs the Authority to consider the nature, extent, gravity, duration and repetition of the failure, the likely harm to data subjects and the likely gain to the fiduciary, whether the fiduciary informed the Authority promptly, and the steps taken after the breach came to light.[1] Prompt self-reporting and documented remediation are therefore direct mitigation. Section 35 lets the Authority fix compensation for a complaining data subject, on its own assessment or as claimed, in addition to any fine.

Directors and officers

Section 36 provides that where a data subject alleges a violation by a company, the Authority may impose an administrative fine, in accordance with the provisions, on any board member, managing director, officer connected with management, or employee engaged in day-to-day operations who is involved in the violation.[1] Section 36 is not on the deferred list, but it operates through the complaints and fines machinery that is. Its message is clear: liability is personal for those involved.

The criminal offences have gone

Commentary on the Ordinance as approved in October 2025 described criminal offences carrying up to seven years' imprisonment and fines up to Tk 20 lakh, with directors presumed liable unless they proved due diligence.[7] Imprisonment was removed in February 2026, and the Act contains no criminal offence provisions at all.[9] [1] Policies and training decks still citing jail terms should be corrected. Criminal exposure for hacking, unauthorised access and similar conduct sits in the cyber security law, not here.

Under section 37, a person aggrieved by an administrative fine or compensation order may appeal within 30 days to the tribunal established under section 68 of the Information and Communication Technology Act 2006.[1]

The regulator: National Data Management Authority

The Authority under the Act is the National Data Management Authority established by section 8 of the National Data Management Act 2026, a statutory body attached to the Prime Minister's Office.[1] [3] Policy sits with a National Data Management Policy Board chaired by the Prime Minister, whose members include the Ministers for Finance, Home Affairs, Law, Health, Education, Agriculture, Planning and Posts and Telecommunications, the Bangladesh Bank Governor and the Authority's executive chairman.[3]

Functions, powers and SOPs

Section 26 lets the Authority give directions, require personal data needed for its work, issue notices, enter and inspect premises and equipment, warn, impose administrative fines by regulation, order suspension of data supplies to a foreign state or international organisation, and set fees for significant fiduciaries.[1] Section 27 allows it to issue SOPs, with government approval, including on impact assessments and cross-border transfer methods.

Independence and government directions

Section 38 lets the government give the Authority binding directions on sovereignty, state security, foreign relations or public order.[1] Experts criticised the absence of an independent regulator when the draft Ordinance was approved.[11] Expect policy-led enforcement priorities.

Exemptions: narrower than they look

Section 24 removes the consent requirement for processing needed for national security, defence, public order or public interest, court orders, crime prevention and prosecution, tax evasion, public health emergencies, investigating misuse of public funds, household use, statistics and research, and public-interest journalism, archives, education, art and literature. Section 24(2) is the qualification that matters: the exemption covers consent only, not the Act's other duties on processing, protection, storage, retention and disclosure.[1] A bank answering a tax or police request still owes security, record-keeping and confidentiality.

A six-month plan for data protection compliance in Bangladesh

The sequence below is how we structure data protection compliance in Bangladesh for clients that want to be demonstrably ready before the fines and complaints regime is switched on. It assumes the earlier planning date of 6 May 2027.

Swipe or scroll →

Keep evidence of each step: section 34 rewards prompt reporting and remediation, and evidence is what turns data protection compliance in Bangladesh from a policy into a defence.

What is in force now and what is deferred

The table maps the main obligations against their status as at 26 October 2026. On a phone, scroll it sideways.

Sector overlays for banks, health and e-commerce

For regulated sectors, data protection compliance in Bangladesh means two rulebooks at once: the Act sits on top of sector rules rather than replacing them. Regulated financial institutions must also follow Bangladesh Bank's Cybersecurity Framework, which requires a qualified CISO and the reporting of any critical cyber incident to internal stakeholders and to external stakeholders including BGD e-GOV CIRT and Bangladesh Bank within 72 hours of occurrence.[13] A single incident may therefore trigger a 72-hour sector report and a section 20 notification, and the two must say the same thing.

Banks and payment providers should treat Bangladesh Bank's cloud localisation position as stricter than the Act.[12] Online sellers face consumer protection and digital commerce requirements as well, which our guide to e-commerce law in Bangladesh covers. For the wider statutory map, see our overview of technology law in Bangladesh.

Data protection compliance in Bangladesh: mistakes to avoid

• Waiting for the fines: the duties have applied since 6 November 2025; only the enforcement tools are deferred.
• Relying on Ordinance-era documents: criminal penalties, the 57-section structure and the February 2026 localisation copy rule are not in the Act.
• Assuming a fixed deadline: the switch-on date requires a gazette notification, and the counting point is uncertain.
• Repurposing legacy data: section 40 limits pre-Act data to its original purpose without fresh consent.
• Contracting away rights: section 10(4) voids attempts to exclude data subject rights by contract or notice.
• Ignoring processors: the fiduciary is liable for its vendors under section 8.
• Treating directors as insulated: section 36 reaches board members and officers involved in a violation.
• Forgetting sector regulators: Bangladesh Bank cloud and cyber incident rules apply in parallel.

What to watch through 2027

Four developments will define data protection compliance in Bangladesh over the next year. First, the gazette notification under section 1(3) fixing the start date for complaints, fines, compensation and Chief Data Officers. Second, the rules and regulations under sections 41 and 42, which must be published in draft for public comment on a website and in at least one Bangla and one English daily before they are finalised.[1] Third, the designation of significant data fiduciaries and the adequacy criteria for transfers. Fourth, the Authentic English Text under section 45; until it appears, the Bangla text governs and prevails in any conflict.

Use the consultation windows: draft regulations will settle response times, breach deadlines, consent formats and transfer adequacy. Our corporate governance and compliance practice runs gap assessments against the Act and prepares consultation responses; to discuss either, contact TRW.

Frequently asked questions

Is the Personal Data Protection Ordinance 2025 still in force?

No. Section 44 of the Personal Data Protection Act 2026 (Act No. 63 of 2026) repealed Ordinance No. 61 of 2025 and amendment Ordinance No. 23 of 2026, saving actions taken under them.[1]

When did the Personal Data Protection Act 2026 take effect?

It received assent and was gazetted on 10 April 2026, and is deemed to have taken effect on 6 November 2025, except section 23 and sections 31 to 35.[1] [2]

When does the 18-month compliance window end?

There is no fixed date. The deferred sections start on a date the government notifies after 18 months. Counted from the Ordinance that is no earlier than 6 May 2027; counted from the Act, 10 October 2027. No notification had been confirmed as at 26 October 2026.[1] [8]

What are the penalties under the Act?

Administrative fines of up to Tk 25 lakh for rights or security failures, up to Tk 50 lakh for a significant data fiduciary, additional fines for repeat violations, and compensation orders. These provisions are deferred.[1]

Can directors be personally liable?

Yes. Section 36 allows administrative fines on board members, managing directors, officers and employees involved in a company's violation. The Act has no criminal offences.[1]

Who regulates personal data in Bangladesh?

The National Data Management Authority, established under section 8 of the National Data Management Act 2026 and attached to the Prime Minister's Office.[3]

Does the Act require data localisation?

Not generally. Transfers abroad are allowed on consent or contract grounds to destinations meeting prescribed adequacy standards, with mandatory notification of bulk transfers of sensitive identifiers. Sector rules, such as Bangladesh Bank's cloud guidelines, can be stricter.[1] [12]

Do we have to notify data breaches now?

Section 20 is in force: breaches likely to cause significant harm must be notified to the Authority in the form, manner and time regulations prescribe. Until regulations set a deadline, prepare to notify promptly.[1]

Does the Act apply to foreign companies?

Yes, where they process personal data outside Bangladesh in connection with supplying goods or services to, or monitoring, data subjects in Bangladesh.[1]

Is a Data Protection Officer mandatory?

The Act uses the title Chief Data Officer and requires one only for significant data fiduciaries, under section 23, which is deferred. Appointing a data protection lead now is still sensible.[1]