Health Data Protection in Bangladesh 2026: Patient Data, Cloud Hosting and the New Act

Health data protection in Bangladesh: the 2026 position for patient data in the cloud

Health data protection in Bangladesh now rests on a statute, not on professional ethics and contract alone. The Personal Data Protection Act 2026, which received presidential assent on 10 April 2026, treats health-related data as sensitive personal data, makes a hospital answerable for every processor it hires, and sets rules on security, retention, breach reporting and transfers abroad.[1] For hospitals, diagnostic chains, clinics, insurers and healthtech platforms that keep patient data in the cloud, the question is no longer whether the law applies. It is which parts already bite, which are still waiting for regulations, and how to build a cloud arrangement that will survive both.

This guide sets out the position as at October 2026: the instrument in force and its unusual commencement clause, what counts as health data, when consent is needed, how responsibility is divided between a hospital and its cloud provider, hosting patient data outside Bangladesh, breach notification, and the sector rules alongside the Act. It is written for boards, general counsel, technology heads and investors who need to decide now.

Summary: The Personal Data Protection Act 2026 (Act No. 63 of 2026) replaced the 2025 ordinance and its February 2026 amendment. Most of it is deemed effective from 6 November 2025; only the Chief Data Officer duty and the complaints, fines and compensation provisions await a later gazette date. Health data is sensitive personal data. A hospital remains responsible for its cloud provider, cross-border hosting is permitted subject to conditions and future regulations, and breaches likely to cause significant harm must be reported to the National Data Management Authority.

Key point: There is no blanket rule that patient data must stay in Bangladesh. The Act allows classified personal data to go abroad on consent or contractual grounds, but only to places with the storage technology that regulations will prescribe, and it requires the Authority to be notified of bulk transfers of certain sensitive identifiers. A hospital that hosts offshore today should document its basis and expect the transfer regulations to tighten the picture.

At a glance

Swipe or scroll →

Table of Contents

Which law governs health data protection in Bangladesh in 2026

The governing statute is the Personal Data Protection Act 2026, Act No. 63 of 2026. Parliament passed it and the President assented on 10 April 2026, and it was published in the Bangladesh Gazette the same day.[1] It repealed the Personal Data Protection Ordinance 2025 (Ordinance No. 61 of 2025) and the Personal Data Protection (Amendment) Ordinance 2026 (Ordinance No. 23 of 2026), and treats anything done under those ordinances as done under the Act.[1]

The ordinance route matters for understanding the timeline. The interim government gazetted the 2025 ordinance together with a companion data governance ordinance in early November 2025.[5] A further amendment ordinance was promulgated on 5 February 2026, shortly before the general election, and a revised text was published in March 2026.[7] [10] The elected Parliament then enacted the Act in April 2026. Any hospital policy, vendor contract or privacy notice that still cites the ordinance should be updated to cite the Act.

The commencement clause: what is in force and what is not

Section 1(3) contains the most important practical point. Except for section 23 and sections 31 to 35, the Act is deemed to have taken effect on 6 November 2025. Those excluded sections take effect on a date that the Government fixes by gazette notification after 18 months from the issue of the law have passed.[1] Section 23 is the duty of significant data-fiduciaries to appoint Chief Data Officers. Sections 31 to 35 are the complaints route, the administrative fines and the compensation power.

The result is a law whose obligations are live but whose penalty machinery is not yet switched on; on a plain reading of section 1(3), that cannot happen before 2027. The core duties on lawful processing, sensitive data, processors, transparency, security, retention, records and breach notification already apply. A hospital that treats the Act as dormant until fines arrive is misreading it.

The two companion statutes

Two other 2026 Acts complete the framework. The National Data Management Act 2026 (Act No. 80 of 2026), also deemed effective from 6 November 2025, establishes the National Data Management Authority as a statutory body attached to the Prime Minister's Office, under a policy board chaired by the Prime Minister on which the health minister sits.[2] The Personal Data Protection Act defines "the Authority" by reference to that body.[1] The Cyber Security Act 2026 (Act No. 81 of 2026), deemed effective from 21 May 2025, governs cyber incidents, critical information infrastructure and cyber offences.[3] It has already been amended once, by the Cyber Security (Amendment) Act 2026.[4]

Both companion Acts were passed by voice vote in April 2026.[9] For the general regime, see our guide to Bangladesh data protection law in 2026; this article concentrates on health data protection in Bangladesh where the data is clinical and the infrastructure is someone else's cloud.

What counts as health data under the Act

Section 2 lists health-related data as a category of sensitive personal data, alongside genetic data, biometric data, data on sexual orientation, data on criminal proceedings and real-time location data.[1] The definition of health-related data is deliberately wide. It covers data on a person's physical or mental condition, records of their past, present or future health, other data ancillary to the provision of healthcare, and personal data collected during registration, payment or the delivery of health services.[1]

That last limb is the one most organisations miss. A billing database, an appointment app, a pharmacy delivery history and an insurer's claims file all contain health data, even with no diagnosis field. The data subject is defined to include a person who is identified or identifiable, whether living or dead, so the archive of a deceased patient is not outside the Act.[1]

Genetic, biometric and location data in clinical systems

Clinical systems routinely hold other sensitive categories. Genetic data covers inherited characteristics derived from a biological sample or body fluid, and biometric data expressly includes DNA, blood group, fingerprints, facial images, iris scans, voice prints and gait.[1] A laboratory system, a reception identity check and an ambulance tool tracking live location can each process sensitive data under more than one heading.

Pseudonymised data is still personal data

The Act defines pseudonymised data as personal data that cannot identify the data subject without separately held additional information.[1] That definition confirms the data remains personal: the key exists. Pseudonymisation is listed as a security measure rather than an exit from the Act.[1] A research dataset, an analytics warehouse or an AI training set built from hospital records should therefore be treated as sensitive personal data unless it has been genuinely anonymised.

Consent and the other lawful grounds for processing patient data

The Act starts from consent. Under section 5, consent must be voluntary, specific, clear and withdrawable, and the data subject must be told the purpose of processing, the retention period, any transfer and how to withdraw. The fiduciary bears the burden of proving that consent was properly given.[1] Consent itself is defined as an informed, clear, specific and freely given affirmative indication.[1]

Section 5(3) then permits processing without consent where a recognised basis exists, subject to necessity, proportionality and purpose limitation. The bases include performance of a contract to which the data subject is party, steps requested before a contract, establishing or defending legal claims, vital interests in protecting life or health, employment and social-protection rights, information made public by the data subject, and harm to another caused by consent being unreasonably withheld.[1]

The stricter test for sensitive health data

Section 7 adds conditions for sensitive personal data. A fiduciary may process it on the data subject's specific consent; under a contract to which the data subject is party; to perform obligations under employment or social-protection law; for the discharge of treatment duties by a health worker and emergency treatment duties connected with a risk to life or health; to perform a duty imposed by law; or where the data subject has voluntarily made the data public.[1]

The healthcare ground supports treatment. It does not obviously support marketing, selling de-identified datasets, group-company product development or training a commercial model. Those uses need their own basis, usually specific consent, and a separate notice. A single "I agree" box at registration that bundles treatment, research, marketing and partner sharing is the weakest possible evidence of specific consent, and the Act puts the burden of proof on the hospital.

Exemptions are from consent, not from the Act

Section 24 exempts certain processing from the consent requirement, including public health, medical or medical public-interest purposes such as responding to an emergency threatening life or health, statistics and scientific or historical research, court orders, crime prevention and national security.[1] Section 24(2) is explicit that this exemption from consent does not exempt the processing, storage, retention or disclosure from the Act's other rules.[1] An emergency department may act without consent; it still needs access controls, confidentiality, security and a lawful retention decision.

Children and patients who cannot consent

The Act defines a child as a person under 18, or under such other age as the Government sets.[1] Section 9 requires consent from a parent, legal guardian or authorised decision-maker for a child or a person unable to consent, and requires processing to protect that person's rights and interests. That consent remains valid until the child turns 18 or the person regains capacity.[1] Paediatric portals and family accounts need a design that records who consented, on whose behalf, and when that authority ends.

Hospital as data-fiduciary, cloud provider as processor

The Act uses its own vocabulary. A data-fiduciary is a person who, alone or jointly, processes or supervises the processing of personal data for a specific purpose or authorises another to process it. A processor is a person who processes personal data on the fiduciary's behalf.[1] A hospital that decides why patient records are collected and how they are used is the fiduciary. A cloud provider hosting the electronic medical record on the hospital's instructions is ordinarily a processor.

The label is a question of fact, not drafting. A provider that uses hospital data for its own analytics or model training acts for its own purposes and may be a fiduciary for that activity. A healthtech booking platform is usually a fiduciary for its account data even when doctors are fiduciaries for their clinical notes, and group hospitals sharing one platform may be joint fiduciaries.

Section 8 makes the hospital answer for its vendors

Section 8 is the provision that should shape every cloud contract. Where a processor processes personal data on a fiduciary's behalf, that processing is deemed to have been done by the fiduciary, and the fiduciary is liable for it under the Act. Each fiduciary must take reasonable measures to ensure its processors follow the Act and its regulations, and remains responsible for the processor's acts.[1] Section 17(5) separately makes the processor responsible for meeting the security standards prescribed under the Act.[1]

A hospital therefore cannot answer a patient, the Authority or its board by blaming the vendor. It must show careful selection, documented instructions, appropriate controls, compliance checks and the ability to act on an incident.

What a cloud contract for patient data should cover

Global providers' standard terms rarely map neatly onto Bangladesh law. The hospital's data processing schedule should take precedence over generic terms and should deal with each of the following:

• the categories of patient data that may be uploaded and a prohibition on using them for the provider's own purposes;
• the regions hosting production data, backups, logs and disaster-recovery copies, and a requirement for approval before any change;
• the countries from which support staff and subcontractors may access the environment, and the approval process for new subprocessors;
• encryption at rest and in transit, key management, identity and privileged-access controls, logging and vulnerability management;
• an incident notice period measured in hours, with cooperation on investigation, evidence preservation and notification decisions;
• assistance with access, correction, portability and erasure requests, including propagation to backups and replicas;
• audit evidence such as independent assurance reports, targeted audit rights and post-incident inspection;
• return, migration and certified deletion on expiry, termination or insolvency.

Check the schedule against the architecture: a 30-day deletion promise is worthless if immutable backups persist for 90 days. Our technology law in Bangladesh guide covers the wider commercial terms for software and cloud contracts.

Cloud hosting abroad, data localisation and cross-border transfer

The question boards ask first is whether patient data may be hosted outside Bangladesh. The short answer is yes, subject to conditions, and the detailed answer depends on regulations that have not yet been made. Health data protection in Bangladesh does not currently impose a statutory requirement that every patient record stay onshore.

How the transfer rules in section 29 work

Section 29 empowers the Government to classify personal data as public, internal, confidential or restricted, by reference to characteristics in the Act's schedule.[1] The schedule describes confidential personal data as including financial, health, biometric and real-time location data whose unprotected disclosure could cause significant harm, discrimination or loss of privacy. It describes restricted personal data as data whose processing or transfer could affect national security, public order, defence, critical infrastructure or fundamental rights, and says it may include critical health or security-related data.[1]

Classified personal data may be transferred abroad if the data subject consents, if the transfer forms part of a contract for goods or services to which the data subject is party, or if it relates, with consent, to business, education, emigration or immigration matters in the data subject's interest. Transferable data may go only to places or countries that have the technology and equipment for proper storage prescribed by regulation.[1]

Bulk transfers of sensitive identifiers must be notified

Section 29(6) requires the Authority to be notified of cross-border transfers of large volumes of sensitive personally identifiable data. The explanation limits that phrase to government identifiers such as national ID, passport and taxpayer numbers, biometric identifiers, genetic or DNA data, and criminal records, where bulk transfer could threaten sovereignty, national security or financial stability.[1] Health data is not on that list as such, but a hospital database almost always contains national ID numbers, and many hold biometric or genetic data. A large offshore migration of a patient master index may therefore trigger the notice requirement.

From localisation mandate to cloud-first

In October 2025 the government publicly denied that the final ordinance imposed mandatory localisation, describing a cloud-first approach under which data may be stored and processed abroad if platforms stay legally accountable in Bangladesh, with restrictions focused on a narrow class of restricted data.[6] Industry commentary on the March 2026 revision likewise reported that localisation mandates had been removed, while criticising section 29(4) for giving no criteria to assess whether a foreign jurisdiction's infrastructure is adequate.[8]

That gap is the live risk. Until the Authority issues transfer regulations and the standard operating procedures that section 27 contemplates for transfers outside Bangladesh, nobody can say which destinations qualify.[1] The Authority also has power to order that supply of personal data to a foreign state or international organisation be stopped or suspended.[1] Section 29(5) lets the Government levy a fee or charge on annual business profits arising from use of Bangladeshi citizens' personal data, which foreign platforms have opposed.[1] [8]

Policy pressure towards onshore health data

Health policy points in a different direction from the cloud-first message. The Ministry of Health and Family Welfare's Bangladesh Digital Health Strategy 2023–2027 lists, as an activity, facilitating mandatory localisation of health data within Bangladesh's territorial jurisdiction, alongside a framework for cross-border data exchange for health security and research.[12] A strategy is not law, but public hospitals, government programmes and vendors bidding for them should expect procurement terms that require onshore hosting.

Remote access is a transfer question too

A database hosted in Dhaka can still leave Bangladesh in practice. A foreign support engineer opening a production record, a ticketing tool copying screenshots abroad, or logs streamed to an overseas security centre each moves data across the border. A defensible transfer map records storage and access locations separately, for production, backups, logs, telemetry, analytics and support.

Security, retention and records duties

Section 17 requires every fiduciary and processor to take appropriate technical and organisational measures to protect the security, accuracy and confidentiality of personal data and to prevent its accidental or unlawful destruction, loss, misuse, alteration, disclosure or access.[1] In choosing measures, they must consider the volume and sensitivity of the data, the likely harm from misuse, the scope of processing, the retention period, and the availability and cost of technology.[1]

The measures must include pseudonymisation; encryption; ensuring the confidentiality, integrity, availability and resilience of processing systems; timely restoration of availability and access after a physical or technical incident; periodic risk assessment; regular testing and evaluation of effectiveness; and regular updating.[1] The Authority may prescribe standards by regulation. Section 22 adds a duty on every fiduciary to plan technical and organisational safeguards against harm to data subjects and to process transparently.[1]

What that means for a hospital environment

For patient data, "encrypted" is a starting point, not an answer. A credible programme tests key management, multi-factor authentication, privileged and break-glass access, bulk export controls, segregation of test data and backup restoration. Restoration matters because the Act names timely recovery of availability as a security measure; a ransomware attack that leaves wards without records is a data protection failure as well as an operational one.

Retention and the five-year register

Section 18 forbids keeping personal data beyond the period prescribed by regulation for the purpose of processing, with an exception for public interest, scientific, historical or statistical purposes while safeguards are in place.[1] Section 19 requires each fiduciary to keep all records relating to its processing in a register for at least five years unless another law provides otherwise.[1] The register is evidence of what the hospital did; the patient record is the data itself. Both need owners.

A retention schedule should be set by record type: discharge summaries, imaging, pathology, prescriptions, consent records, access logs, billing, call recordings and research extracts. Each needs a trigger, a deletion method, a backup rule and a legal-hold exception. Section 40 allows processing of data collected before the Act to continue for its original purpose, but a change of purpose needs the data subject's prior consent.[1]

Audits and the data protection plan

Section 21 requires prescribed classes of fiduciary to have their processing audited by an independent data auditor, and lets the Authority order an audit where processing may harm data subjects.[1] Large hospital groups and national platforms are obvious candidates once the classes are prescribed.

Breach notification for patient data

Section 20 requires a fiduciary to notify the Authority of a personal data breach that is likely to cause significant harm to the data subject, in the form, manner and time prescribed by regulation.[1] The Act defines a breach broadly: unauthorised access, unlawful transfer, disclosure or alteration, and accidental destruction, loss or exposure, including where the equipment needed for proper processing and storage is absent.[1]

The regulations will set the threshold and content, taking into account the nature of the breach, the categories and approximate number of data subjects and records affected, the fiduciary's contact details, and the measures taken or proposed to mitigate adverse effects.[1] No statutory deadline in hours or days has yet been prescribed. That is not a reason to wait. Health data is sensitive by definition, so most breaches of identifiable clinical records will be candidates for significant harm.

Building the response before the clock exists

A hospital's incident playbook should name clinical, legal, security, communications and vendor leads. It should preserve logs before containment destroys them, identify affected records, assess patient-safety impact, coordinate with the cloud provider and record each decision with reasons. Contracts should require the provider to report a suspected incident within hours, not days, so that the hospital can judge whether the significant-harm threshold is met.

Where the Cyber Security Act adds duties

The Cyber Security Act 2026 defines critical information infrastructure as infrastructure declared by the Government whose damage could harm public safety, economic security or public health, and national security, integrity or sovereignty.[3] The Government declares it by gazette and must update the list at least annually. Declared infrastructure must maintain its own emergency or incident response team and security operations centre, file quarterly reports and submit an annual audit report.[3] A private hospital is not critical infrastructure merely because it holds health records, but national health platforms and systems connected to them should check their status. Our guide to cyber law compliance in Bangladesh covers those duties in detail.

Patient rights that cloud systems must support

Health data protection in Bangladesh gives patients enforceable rights, and section 10(4) says those rights cannot be excluded or varied by contract or notice.[1] Requests are made in writing to the fiduciary, and the procedures and timelines will be set by regulation.[1]

Access and portability

Under section 11, a patient may obtain the personal data a fiduciary processes about them, in a concise and intelligible form, with information on purposes, categories, recipients, retention, source, safeguards for cross-border transfers and the logic and significance of automated decisions. The copy must identify every person, fiduciary or processor with whom the data has been shared. Where appropriate, the fiduciary may arrange direct transfer to another fiduciary through a federated interoperable system.[1]

Correction, withdrawal and erasure

Section 12 gives a right to correct, complete and update data, and requires a fiduciary that makes a correction to inform the data subject and everyone concerned within 30 days.[1] Section 13 lets a patient withdraw consent to storage, processing or automated decisions, in whole or part, and requires erasure where the purpose has ended, consent is withdrawn, the patient objects, processing was unlawful or erasure is legally required.[1]

Section 13(3) is helpful to hospitals: a fiduciary may refuse erasure where the data is kept for archival purposes, to comply with a legal obligation, or is confidential or restricted personal data.[1] Because the schedule describes health data as confidential personal data, clinical records will often fall within that refusal ground. A refusal still has to be reasoned and recorded.

System-wide propagation reaches backups

Section 14 introduces systematic propagation of approved corrections and erasures. The originating fiduciary implements the change in its own systems and notifies the Authority, which may direct secondary fiduciaries and processors to apply it.[1] The propagation applies to copies held in mirrors, caches, backups, disaster-recovery systems, test environments and migration datasets.[1] Few hospital architectures can do that today, so the cloud contract should require targeted correction and suppression across replicas and document how immutable backups are handled until they expire.

Sector rules that sit alongside the Act

The Act is the general law, and section 3 gives it effect notwithstanding anything in other laws.[1] It does not displace the professional duties that already bind doctors, and those duties often go further.

Medical confidentiality under the BMDC code

The Bangladesh Medical and Dental Council's Code of Professional Conduct, Etiquette and Ethics requires doctors to protect patients' privacy and confidentiality unless disclosure is required by law, and extends that duty to everything learned in practice and beyond the patient's death.[11] The code defines a medical record to include electronic records and audio-visual recordings, places responsibility for storage of hospital records on the hospital authority, and bars publishing identifiable photographs or case reports without permission.[11] Improper disclosure of confidential information may amount to serious professional misconduct.[11]

A cloud arrangement that satisfies the Act can still expose doctors to disciplinary risk if unauthorised staff or vendors can read clinical notes, so health data protection in Bangladesh has a professional dimension as well as a statutory one.

Digital health strategy and the shared health record

The Digital Health Strategy 2023–2027 commits to patient information rights, privacy, security and confidentiality, calls for a dedicated Digital Health Act, and plans a shared electronic health record in which patients decide who may access their record, supported by a consent management system.[12] It also calls for an interoperable population health database linked to a national ID.[12] Private providers connecting to government platforms should expect those conditions to follow.

National data platforms

The National Data Management Act requires scheduled government databases to connect to a national interoperability platform within a reasonable period and lets ministries build sectoral gateways that must link to it technically.[2] The current schedule lists national ID, passport, address, taxpayer identification, birth and death registration and driving licence databases, plus any others the Government designates; health databases are not yet named.[2] A future designation of health registries would change the integration landscape for public and private providers alike.

Related issues covered elsewhere

Telemedicine raises distinct questions, covered in our article on launching a telemedicine platform in Bangladesh. AI-driven health advice is discussed in our analysis of health apps and medical advice. Where a data failure causes clinical harm, see our guide to medical negligence in Bangladesh.

Enforcement, fines and compensation once sections 31 to 35 start

When the deferred provisions commence, a data subject or any person who believes the Act has been breached may complain to the Authority.[1] Failure to honour a data subject's rights will attract an administrative fine of up to Tk 25 lakh, rising to up to Tk 50 lakh for a significant data-fiduciary, with additional fines for repeat breaches. Failure to provide the security required by the Act, its rules, regulations or standard operating procedures will attract a fine of up to Tk 25 lakh.[1]

In setting fines, the Authority may weigh the nature, extent, gravity and duration of the failure, likely harm to data subjects and gain to the fiduciary, prompt notification to the Authority, and remedial action.[1] It may also award compensation to the data subject in addition to the fine.[1]

Personal exposure for officers and the appeal route

Section 36 lets the Authority impose administrative fines on any director, managing director, officer or employee involved in a company's violation of a data subject's rights.[1] A person aggrieved by a fine or compensation order may appeal within 30 days to the tribunal established under section 68 of the Information and Communication Technology Act 2006.[1]

Chief Data Officers for significant fiduciaries

Section 23, also deferred, requires every significant data-fiduciary to appoint qualified Chief Data Officers to represent it before the Authority, act as the contact point for data subjects and handle complaints about misuse of sensitive personal data within set timeframes.[1] Significant status will be fixed by regulation by reference to factors including the volume of data processed, risk to data subjects' rights and potential threats to public health.[1] Large hospital networks and national health platforms should assume they may be designated and appoint an accountable data lead now.

What remains uncertain in October 2026

Health data protection in Bangladesh has a settled statutory core and an unsettled implementing layer. Five points need monitoring. First, the regulations on breach thresholds and timing, retention periods, request procedures and security standards. Second, the transfer regulations and standard operating procedures that will say which foreign destinations meet section 29(4). Third, the Government's classification of personal data under section 29 and whether specific health datasets are labelled restricted. Fourth, the regulation defining significant data-fiduciaries. Fifth, the gazette notification that brings sections 23 and 31 to 35 into force.

We have not identified any published regulations or standard operating procedures under the Act as at the date of this article. The Bangla text prevails over any English translation, and section 45 requires the Government to publish an authorised English text; until then, check compliance work against the Bangla gazette.[1]

A compliance programme for health data protection in Bangladesh

A hospital, diagnostic group or healthtech business does not need to wait for every regulation. The sequence below turns the live duties of health data protection in Bangladesh into an operating model that can absorb the detail when it arrives.

Swipe or scroll →

Two points deserve emphasis. Contracts should follow the architecture, so lawyers and engineers should negotiate the cloud schedule together. And the evidence trail matters as much as the controls. Under section 5 the hospital must prove consent, under section 19 it must keep a five-year register, and under section 34 prompt notification and remediation reduce fines.[1]

Who regulates and advises

For organisations that also handle data of patients in the European Union, such as medical tourism facilitators or clinical research organisations, the GDPR may apply in parallel; see our guide to GDPR compliance in Bangladesh. TRW's corporate governance and compliance practice advises hospitals, healthtech platforms and investors on data protection programmes, vendor contracts and incident response.

Frequently asked questions

Is the Personal Data Protection Act 2026 actually in force?

Yes, except section 23 and sections 31 to 35. The rest is deemed effective from 6 November 2025. The excluded provisions, covering Chief Data Officers, complaints, fines and compensation, start on a date the Government fixes by gazette after 18 months from the law's issue.[1]

Is health data treated as sensitive personal data?

Yes. Health-related data is expressly listed as sensitive personal data, and the definition covers physical and mental health, health records, care-related data and data collected during registration, payment or treatment.[1]

Can a hospital store patient records with a cloud provider outside Bangladesh?

The Act does not impose a blanket ban. Classified data may be transferred abroad on consent, contractual or certain consent-based grounds, but only to places with the storage technology prescribed by regulation, and bulk transfers of sensitive identifiers must be notified to the Authority. The transfer regulations are still awaited.[1]

Does a hospital always need patient consent to process health data?

No. Section 7 allows processing for treatment by a health worker and for emergency care, among other grounds, and section 24 exempts public health and medical emergencies from consent. Secondary uses such as marketing or commercial research usually need specific consent.[1]

Who is liable if the cloud provider suffers a breach?

The hospital remains responsible. Section 8 treats processing by a processor on the fiduciary's behalf as processing by the fiduciary, which must take reasonable measures to ensure the processor complies. The processor is separately responsible for meeting security standards.[1]

How quickly must a health data breach be reported?

The Act requires notice to the Authority of breaches likely to cause significant harm, in the form, manner and time set by regulation. No deadline has yet been prescribed, so contracts and playbooks should provide for escalation within hours.[1]

Can a patient insist that a hospital delete their medical records?

Not always. A fiduciary may refuse erasure of data kept for archival purposes or legal obligations, or of confidential or restricted personal data, which the Act's schedule describes as including health data. The refusal should be reasoned and recorded.[1]

What fines apply for breaching health data rules?

Once sections 32 and 33 commence, up to Tk 25 lakh for failing to honour data subject rights or to provide required security, and up to Tk 50 lakh for a significant data-fiduciary, with further fines for repeat breaches and possible compensation.[1]

Who is the regulator for health data protection in Bangladesh?

The National Data Management Authority, established under the National Data Management Act 2026 as a statutory body attached to the Prime Minister's Office. Doctors remain subject to the Bangladesh Medical and Dental Council's confidentiality rules.[2] [11]

Does the Act apply to a foreign healthtech company serving patients in Bangladesh?

It can. The Act applies to processing outside Bangladesh connected with providing goods or services to, or monitoring or profiling, data subjects in Bangladesh, and section 4 extends it to violations committed from abroad into Bangladesh.[1]