GDPR Compliance in Bangladesh: Data, Digital Rights, AI and Marketing Law in 2026

GDPR compliance Bangladesh: the 2026 framework

GDPR compliance Bangladesh businesses face in 2026 is no longer a niche concern for a handful of software exporters. Any Bangladeshi company that sells to people in the European Union, tracks their behaviour online or processes personal data for European clients can find itself inside the General Data Protection Regulation, with EU-level fines and contractual liability attached. At the same time, Bangladesh now has its own general data protection statute, a rewritten telecom law that bans internet shutdowns, a cyber security law with tribunal-supervised blocking, a draft national AI policy and consumer rules that bite on online advertising.

This guide gives exporters, BPO and IT providers, platforms and marketers one view across those regimes. Where a sister TRW guide already covers a topic in depth, we link to it rather than repeat it.

Summary: The GDPR reaches a Bangladeshi business in three ways: by targeting goods or services at people in the EU, by monitoring their behaviour there, or by contract when a European controller engages it as a processor. Bangladesh has no EU adequacy decision, so most transfers to Bangladesh run on standard contractual clauses and a transfer impact assessment. Domestically, the Personal Data Protection Act 2026 adds its own consent, rights, transfer and audit duties, while telecom, cyber, AI and consumer rules shape how data-driven products may operate.

Key point: Being based in Dhaka is not a defence. A Bangladeshi company that targets EU customers or monitors their behaviour is directly subject to the GDPR under Article 3(2), must usually appoint a representative in the EU and faces fines of up to EUR 20 million or 4 per cent of worldwide turnover for the most serious breaches.

At a glance

Swipe or scroll →

Table of Contents

When GDPR compliance Bangladesh obligations arise

Article 3 of the GDPR sets out three routes into the regime, and a Bangladeshi business needs to know which, if any, applies to each product line and client.[1] The answer decides whether you need an EU representative, which contracts you sign and whether European regulators can fine you directly.

The establishment test under Article 3(1)

The GDPR applies to processing in the context of the activities of an establishment in the Union, whether or not the processing itself takes place in the Union.[1] A Bangladeshi group with a sales office, subsidiary or branch in Germany, Ireland or the Netherlands is therefore within the regime for processing linked to that European presence, even if the database is hosted in Dhaka. Group structures matter: personal data flowing from the EU subsidiary to the Bangladeshi parent is also a restricted transfer that needs a lawful transfer mechanism.

Targeting under Article 3(2)(a)

A business with no EU establishment is still caught if it offers goods or services to people in the Union. The European Data Protection Board treats this as a question of intention. Relevant signals include naming EU countries, paying for search or social campaigns aimed at EU audiences, EU domains or phone numbers, pricing in euros, using an EU language that is not common in the business's home country and delivering to EU addresses.[2] The mere accessibility of a website from Europe is not enough, and payment is not required for an offer to count.[2]

A garment brand selling direct to European consumers or an edtech platform with euro pricing is likely caught. A B2B software firm serving only EU companies is usually exposed as a processor instead.

Monitoring under Article 3(2)(b)

Article 3(2) also applies where a non-EU business monitors the behaviour of people in the Union, as far as that behaviour takes place there. Unlike targeting, no intention to target is needed. The EDPB's examples include behavioural advertising, geolocation for marketing, cookie and fingerprinting tracking, health analytics and profile-based market research.[2] Ad-tech, analytics, app and gaming businesses in Bangladesh with European users should assume Article 3(2)(b) is engaged unless they have deliberately designed tracking out of their product.

Processors serving EU clients

Many Bangladeshi IT and BPO firms process data on behalf of European controllers. The EDPB's position is that, where an EU controller uses a processor outside the Union, the controller must bind the processor by contract to GDPR standards, including the Article 28(3) terms, so the processor becomes indirectly subject to GDPR obligations.[2] Audit rights, security standards and breach deadlines then bind by contract.

EU representatives, processor contracts and SCCs

Three documents dominate GDPR compliance Bangladesh teams must manage: the representative mandate, the processor agreement and the transfer clauses.

Appointing an EU representative

Where Article 3(2) applies, the controller or processor must designate in writing a representative in the Union, established in one of the Member States where the affected individuals are.[1] The duty does not apply to processing that is occasional, does not involve large-scale special-category or criminal-offence data and is unlikely to result in a risk to individuals, or to public authorities.[1] Few consumer-facing businesses fit that exemption.

The representative can be a law firm or specialist provider, and one representative may act for several non-EU businesses. Its details must appear in privacy notices, and its appointment does not reduce the principal's own liability.[2] The EDPB considers the role incompatible with acting as the same entity's external data protection officer or as its processor.[2]

Article 28 processor agreements

Any EU controller engaging a Bangladeshi vendor must have a written contract that, among other things, limits processing to documented instructions, imposes confidentiality, requires appropriate security, controls sub-processors, supports data subject requests, returns or deletes data at the end and allows audits.[1] Negotiate these terms: unlimited audits, uncapped indemnities and 24-hour breach deadlines in client templates rarely match a vendor's insurance or capacity.

Standard contractual clauses and transfer impact assessments

The European Commission has not adopted an adequacy decision for Bangladesh; the countries and territories that benefit from one include Japan, the Republic of Korea, the United Kingdom, Switzerland and certified US organisations.[4] Transfers to Bangladesh therefore usually rely on the standard contractual clauses adopted by Implementing Decision (EU) 2021/914 on 4 June 2021, which come in four modules: controller to controller, controller to processor, processor to sub-processor and processor to controller.[3]

Clause 14 requires the parties to assess whether the laws and practices of the destination country could prevent the importer from complying, and to adopt supplementary measures if they could.[3] For Bangladesh, that assessment now has to address the lawful interception regime in the telecom statute, data-removal and investigation powers in the Cyber Security Act 2026 and the government's powers over data in the Personal Data Protection Act 2026. Encryption with keys held in the EU, minimisation and a documented process for handling government requests are the usual supplementary measures.

The Article 3(2) gap

A trap catches many exporters. The Commission's own guidance says the 2021 standard contractual clauses do not work for importers whose processing is already directly subject to the GDPR under Article 3, and that it is developing an additional set for that scenario.[3] A Bangladeshi app business that targets EU consumers and also receives data from an EU affiliate should take advice on how to document the transfer until those clauses appear, rather than assuming the standard set fits.

GDPR compliance Bangladesh for BPO and IT exporters

Bangladesh's outsourcing and IT services sector is where GDPR exposure concentrates. Call centres, development teams on live databases and annotation teams handling identity documents or medical claims all carry risk that European clients push down the supply chain.

What EU clients will ask for

Expect a due diligence questionnaire, a data processing agreement, the right module of the standard contractual clauses, evidence of security controls, a sub-processor list, a breach response plan and a transfer impact assessment questionnaire about Bangladeshi law. GDPR compliance Bangladesh vendors win or lose contracts on the quality of those answers; generic text copied from other jurisdictions is quickly spotted.

Controls, sub-processors and group arrangements

Auditors look for role-based access, no-device floors for sensitive work, logging of production access, pseudonymised test data, training records and a tested incident playbook. The Personal Data Protection Act 2026 independently requires safeguards such as pseudonymisation, encryption and regular testing, and a processing register kept for at least five years.[5] Group companies, freelancers and cloud platforms are sub-processors the EU client must approve. Health-sector vendors should also read our analysis of patient data and cloud hosting in Bangladesh.

The Personal Data Protection Act 2026 compared with the GDPR

Bangladesh's own regime matters to GDPR compliance Bangladesh planning because it applies in parallel. The interim government's Personal Data Protection Ordinance 2025 has been replaced by the Personal Data Protection Act 2026, Act No. 63 of 2026, dated 10 April 2026.[5] Parliament passed the Personal Data Protection Bill 2026 on 9 April 2026 among thirty-one bills dealing with interim-era ordinances.[6] The Act is deemed to have taken effect on 6 November 2025, except section 23 and sections 31 to 35, which start on a date the government notifies after eighteen months.[5]

Our guide to Bangladesh data protection law in 2026 covers the Act section by section; here we focus on differences from the GDPR.

Scope and territorial reach

Like the GDPR, the Act reaches beyond its borders. It covers processing within Bangladesh and processing outside Bangladesh connected with goods, services or monitoring of data subjects in Bangladesh, and section 4 treats certain cross-border violations as if committed in Bangladesh.[5] A European company serving Bangladeshi users is therefore in the mirror-image position of a Bangladeshi exporter under Article 3(2).

Lawful bases, consent and children

Section 5 makes consent the primary basis and requires it to be free, specific, clear and withdrawable, with disclosure of purpose, retention, transfer and withdrawal process; the data fiduciary bears the burden of proving it.[5] Non-consent grounds include contract, legal claims, vital interests, employment and social security law and data the subject has made public.[5] There is no general legitimate-interests ground of the GDPR kind, which is the single biggest adjustment for GDPR-trained teams. A child means a person under eighteen, and parental consent is needed.[5]

Rights, automated decisions and accountability

Data subjects have rights of access and portability, correction, withdrawal of consent, objection and erasure, and those rights cannot be waived by contract or notice.[5] The access right extends to the logic and significance of automated decisions, consent to automated decisions can be withdrawn, and automated processing may not occur without informing the data subject.[5] Processors act under contract, but the fiduciary remains liable for their processing.[5] Significant data fiduciaries must appoint a Chief Data Officer once section 23 is notified.[5]

Breach notification

The GDPR requires a controller to notify its supervisory authority within 72 hours of becoming aware of a notifiable breach.[1] Section 20 of the Bangladeshi Act requires notice to the Authority where a breach is likely to cause significant harm, in the form, manner and time to be set by regulation.[5] Until those regulations appear, a business already working to the 72-hour GDPR standard should apply it to Bangladeshi incidents too.

Cross-border transfers

Transfers are the sharpest divergence. Section 29 lets the government classify personal data as public, internal, confidential or restricted, and allows classified data to leave Bangladesh on the basis of consent, a contract with the data subject or activities linked to the subject's interests, such as business, education or migration, with consent.[5] Data may go only to places with storage technology specified by regulation, large-scale transfers of national identifiers, biometric, genetic and criminal-record data must be notified to the Authority, and the government may levy fees on profits derived from Bangladeshi citizens' data.[5] There is no equivalent of standard contractual clauses yet.

The comparison below summarises the main differences.

Digital rights in Bangladesh: privacy, expression and access

Digital rights determine what the state may demand of a platform, operator or data holder, and what users can challenge in court.

The constitutional baseline

Article 43 of the Constitution guarantees every citizen the right to be secured in their home against entry, search and seizure, and to the privacy of correspondence and other means of communication, subject to reasonable restrictions imposed by law in the interests of state security, public order, public morality or public health.[7] Article 39 guarantees freedom of thought and conscience, and of speech and the press, subject to reasonable restrictions for state security, friendly relations with foreign states, public order, decency or morality, contempt of court, defamation or incitement to an offence.[7] Any interception, blocking or disclosure regime must be justified against those tests, which is the ground on which constitutional writ challenges are argued.

The 2024 shutdowns and accountability

The nationwide internet shutdowns of July 2024 are now the subject of criminal proceedings. On 21 January 2026 the International Crimes Tribunal-1 indicted Sajeeb Wazed Joy and former ICT state minister Zunaid Ahmed Palak on three charges, including that Palak shut down internet services on Joy's instruction to conceal atrocities, rejected their discharge applications and fixed 18 February for opening statements.[9] The debate has shifted from whether shutdowns are lawful to who answers personally for ordering them.

The 2026 telecom amendment

The legislative answer came in the telecom amendment approved by the interim Advisory Council on 23 December 2025. Under the amended section 97, internet and telecom services can no longer be suspended by administrative order; the National Telecommunication Monitoring Centre is dissolved and replaced by a Centre for Information Support under the Home Ministry; and lawful interception requires approval from a quasi-judicial council chaired by the Law Minister.[8] The amendment also made misuse of SIM or device registration data to surveil or harass someone an offence, and requires an annual parliamentary report on lawful interception.[8]

Parliament passed the Bangladesh Telecommunications (Amendment) Bill 2026 on 9 April 2026 among the bills that kept interim-era ordinance provisions unchanged.[6] The detail of interception safeguards, licensing and penalties is analysed in our guide to telecommunications law in Bangladesh.

Freedom of expression online

Online offences now sit in the Cyber Security Act 2026, covered with the Cyber Tribunal and victims' remedies in our guide to cyber law in Bangladesh. For a business the point is narrower: platforms and publishers receive removal and disclosure requests, and need a documented process for testing each one against the statute before acting.

Internet governance in Bangladesh: institutions and content control

Internet governance in Bangladesh is spread across several bodies rather than one internet regulator.

The BTRC and ISP licensing

The Bangladesh Telecommunication Regulatory Commission licenses networks and services, including internet service providers, assigns spectrum and enforces licence conditions. The 2026 amendment moved away from the 2010 model of ministerial control and returned most licensing authority to the BTRC, with the ministry keeping approval only for certain nationally significant licences and with shorter processing timelines.[8] A new accountability committee chaired by the head of the parliamentary standing committee oversees regulatory performance.[8] ISPs and hosting businesses should treat their BTRC licence terms, including data retention and lawful-access conditions, as part of their data protection map.

Content takedown rules

Section 8 of the Cyber Security Act 2026 is the core blocking power. The Director General of the National Cyber Security Agency may remove or block information that threatens cyber security, and law enforcement agencies may seek removal of content that undermines national integrity, security, defence or public order, contains hate speech that could incite violence, or promotes disorder or instructs criminal activity.[10] The BTRC or the relevant body under the ICT Division then asks technology companies to act.[10]

Two safeguards are new and important. Within three days of removal or blocking, the authority must obtain the permission of the Cyber Tribunal, and if it does not, or permission is refused, the content must be restored; and the government must publish a list of blocked content.[10] Platforms should log every request, the legal ground cited and the tribunal outcome, because those records are what a court or an EU client will ask for.

For GDPR compliance Bangladesh exporters, these records double as transfer impact assessment evidence: the NTMC's replacement by a support centre that does not intercept on its own initiative, and council approval for interception, answer the question EU clients ask most.[8] Our guide to technology law in Bangladesh maps the remaining regulators.

AI liability in Bangladesh: policy, contract and automated decisions

Bangladesh has no AI statute, so AI liability turns on policy direction, existing law and contract, and GDPR compliance Bangladesh teams should treat AI governance as part of the same programme.

The National AI Policy: 2024 draft, 2026 draft and the elected government

A draft National AI Policy prepared in 2024 was never finalised. In January 2026 the interim government published a Draft National AI Policy 2026 to 2030 that sorts AI systems into prohibited, high-risk, limited-risk and low-risk tiers; bans social scoring, indiscriminate biometric surveillance and election-disrupting deepfakes; requires algorithmic impact assessments and strict human oversight for high-risk uses such as healthcare, law enforcement and credit assessment; and applies strict liability to deployers of high-risk AI.[11] It proposes an independent oversight committee created by Act of Parliament and a permanent AI Act by 2030.[11]

In July 2026 the Posts, Telecommunications and ICT Minister, Faqir Mahbub Anam, said the elected government was formulating a human-centric National AI Policy, alongside guidelines for AI use in the public sector and responsible data management standards.[12] As of October 2026 no final policy has been adopted, so the draft is the best guide to direction but not binding law.

Product liability and agentic systems

Bangladesh has no dedicated product liability statute. Claims for harm caused by an AI product run through contract, negligence, the implied conditions of quality and fitness in sale of goods law and consumer protection law. Agentic systems that book, pay or send messages for a user raise the hardest questions: who authorised the act, whether it binds the principal and who bears loss when the agent errs. The platform terms and commercial contract usually decide.

Allocating AI risk by contract

AI contracts should allocate responsibility explicitly: warranties on training-data provenance and lawful basis, accuracy specifications, human review for consequential decisions, logging and explainability, incident notice, ownership of outputs, liability caps and indemnities for fines and third-party claims. EU clients will write European standards in regardless of local law.

Automated decisions under both regimes

Article 22 of the GDPR gives individuals the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to defined exceptions and safeguards.[1] The Personal Data Protection Act 2026 takes a different route: transparency about automated processing, access to its logic and significance, and the ability to withdraw consent to automated decisions.[5] A credit-scoring, hiring or fraud-detection model used on both EU and Bangladeshi customers should be designed to the stricter of the two, with a human review route built in.

Digital marketing law in Bangladesh

Marketing is where GDPR compliance Bangladesh work meets consumer and telecom law: an ad, an influencer post, a bulk SMS and a cookie banner can each break a different rule.

False and misleading advertising

Section 44 of the Consumers' Right Protection Act 2009 penalises deceiving buyers through false or untrue advertisement, with imprisonment of up to one year, a fine of up to Tk 2 lakh, or both.[13] Complainants receive 25 per cent of fines realised, which gives consumers a direct incentive to complain.[13] Discount, health and "limited stock" claims need evidence on file before launch. The consumer protection framework for online sellers is covered in our e-commerce law guide.

Digital Commerce Operation Guidelines

The Digital Commerce Operation Guidelines issued on 4 July 2021 require listings to show quantity, ingredients, price and delivery charges with images or video, and to state purchase and return conditions.[14] Platforms must obtain buyers' prior permission before collecting personal data and explain why it is collected and how it will be stored and used, with a check-box given as one method; ratings and reviews must be displayed and may not be erased by the platform; and complaints must be answered within 72 hours.[14] Suppressing negative reviews is therefore both a guideline breach and a misleading-advertising risk.

Influencer disclosure

Bangladesh has no influencer-specific disclosure code comparable to those in the UK or India. That does not make undisclosed paid promotion safe. Section 44 is aimed at whoever deceives buyers through false advertisement, and an endorsement that hides a commercial relationship or makes unsubstantiated claims can expose both the brand and the creator.[13] Require clear "ad" or "paid partnership" labels, approve claims in advance and keep the brief and substantiation on file.

Spam and promotional SMS

The BTRC regulates promotional messaging through operators. A 2023 BTRC directive capped promotional SMS at three per customer per day, operators offer Do Not Disturb services to block promotional messages, and in October 2024 the BTRC fined Grameenphone, Robi and Banglalink Tk 5 lakh each for exceeding the cap.[15] Brands buying bulk SMS should require aggregators to honour DND lists and the cap contractually, and keep consent records under the Personal Data Protection Act 2026.

Cookie consent and tracking

Bangladesh has no cookie-specific rule, but the Personal Data Protection Act 2026 defines consent as a clear, informed, specific and voluntary positive indication, which pre-ticked boxes and "by continuing to browse" banners do not meet.[5] For EU visitors, tracking cookies and pixels are both a consent question and, for a non-EU business, the trigger for the GDPR's monitoring limb.[2] A single consent management platform configured to the EU standard is usually the efficient answer.

A step-by-step GDPR compliance Bangladesh programme

The sequence below is how we build one programme that serves EU obligations, the Bangladeshi Act and the surrounding digital rules without duplicating effort.

Swipe or scroll →

Review the programme annually and whenever a new product, market, vendor or regulation appears.

Mistakes to avoid

• Assuming location is a defence: GDPR compliance Bangladesh exporters ignore because they have no EU office is the most common and most expensive misjudgement.[1]
• Using the wrong transfer tool: the 2021 standard contractual clauses do not fit Article 3(2) importers already directly subject to the GDPR.[3]
• Relying on legitimate interests in Bangladesh: the Bangladeshi Act has no general legitimate-interests basis, so GDPR-style analyses must be redone.[5]
• Treating takedown requests informally: the three-day tribunal permission rule means unrecorded removals can be challenged.[10]
• Over-promising in vendor contracts: uncapped indemnities, unrealistic breach deadlines and unallocated AI risk turn a minor incident into a commercial dispute.
• Bundled marketing consent: consent hidden in terms, pre-ticked boxes and unlabelled influencer content fail both regimes.[5] [13]

What to watch in late 2026 and 2027

Four developments will shape GDPR compliance Bangladesh businesses must deliver over the next year. First, the regulations under the Personal Data Protection Act 2026 on breach timing, transfer destinations and audits, and the notification switching on sections 23 and 31 to 35.[5] Second, the European Commission's additional standard contractual clauses for importers already subject to the GDPR.[3] Third, the elected government's final National AI Policy and any move toward an AI statute.[12] Fourth, the rules giving practical effect to interception safeguards and the tribunal-supervised blocking regime.[8] [10]

TRW advises exporters, platforms and investors across all of these regimes through our corporate and commercial advisory practice, our consumer protection practice and, where state action is challenged, our constitutional and writ litigation practice. To scope a GDPR and Bangladeshi data protection review, contact TRW.

Frequently asked questions

Does the GDPR apply to a company based only in Bangladesh?

It can. Under Article 3(2) the GDPR applies to a non-EU business that offers goods or services to people in the EU or monitors their behaviour there, wherever the business and its servers are located.[1] [2]

Is having a website that Europeans can visit enough to trigger the GDPR?

No. Mere accessibility is not enough. Regulators look for intention to target, such as euro pricing, EU delivery, EU-specific campaigns or EU domains, or for behavioural monitoring such as tracking cookies.[2]

Does a Bangladeshi company need an EU representative?

If Article 3(2) applies, usually yes. The exemption covers only occasional, low-risk processing that does not involve large-scale sensitive or criminal-offence data, and public authorities.[1]

Is Bangladesh an adequate country under the GDPR?

No. Bangladesh does not have an EU adequacy decision, so transfers from the EU to Bangladesh normally rely on the 2021 standard contractual clauses and a transfer impact assessment.[3] [4]

What is Bangladesh's data protection law in 2026?

The Personal Data Protection Act 2026, Act No. 63 of 2026, which replaced the 2025 ordinance and is deemed effective from 6 November 2025, with sections 23 and 31 to 35 to start later by notification.[5]

Can GDPR compliance satisfy the Bangladeshi Act too?

Largely, but not entirely. The Bangladeshi Act has no general legitimate-interests basis, its own transfer conditions in section 29 and notification of large-scale transfers of identifiers and biometric data.[5]

Can the government shut down the internet in Bangladesh?

The amended section 97 of the telecom statute bars suspension of internet and telecom services by administrative order, and Parliament kept that amendment unchanged in April 2026.[6] [8]

How does content blocking work under the Cyber Security Act 2026?

The Director General or law enforcement agencies may seek removal or blocking on listed grounds, but the authority must obtain Cyber Tribunal permission within three days or restore the content.[10]

Is there an AI law in Bangladesh?

Not yet. A Draft National AI Policy 2026 to 2030 proposes risk tiers and strict liability for high-risk deployers, and the elected government said in July 2026 that it is formulating a final policy.[11] [12]

What is the penalty for false advertising in Bangladesh?

Under section 44 of the Consumers' Right Protection Act 2009, up to one year's imprisonment, a fine of up to Tk 2 lakh, or both.[13]