The Act addresses the transfer of personal data outside Bangladesh and the storage of certain categories of data, and it gives the responsible authority a role in setting conditions through rules and guidance. The detailed operating rules are still developing, so organisations should analyse their transfers against the Act's text, any rules already issued and sector requirements, and document the basis on which each transfer is made. In practice, cross-border data transfers involving sensitive data, such as health or financial information, deserve the most careful review. We track developments and update clients as the regime and enforcement practice take shape.

Potentially, but subject to Bangladesh Bank requirements. Banks and financial institutions must follow Bangladesh Bank guidelines on ICT security, outsourcing and cloud, which include expectations about where certain data and systems are hosted, risk assessments, contractual protections and approval or notification for particular arrangements. Core banking data and some customer information face stricter localisation expectations than other data. The Personal Data Protection Act 2026 also applies. We review the proposed use case, help prepare the regulatory submission and negotiate cloud terms that meet the regulator's expectations for cross-border data transfers in the financial sector. Timelines should allow for regulator review.

European clients sending personal data to Bangladesh usually rely on the EU standard contractual clauses, because there is no adequacy decision for Bangladesh. They must assess whether Bangladeshi law and practice allow the clauses to be respected, particularly regarding government access to data, and may ask for supplementary measures such as encryption, access controls and transparency commitments. You will be asked to sign the clauses, answer questionnaires and maintain request-handling procedures. We help providers respond accurately, avoid commitments they cannot meet and present a credible picture of Bangladeshi law to support continued cross-border data transfers. Consistent answers across clients matter.

Data localisation means requirements that certain data be stored or processed within the country, or that a copy remain there. In Bangladesh, the most significant requirements come from sector regulators, particularly Bangladesh Bank for banks, financial institutions and payment providers, and the Bangladesh Telecommunication Regulatory Commission for telecom operators. Government data, health records and critical information infrastructure may also be subject to restrictions. The Personal Data Protection Act 2026 adds rules for certain categories of personal data. We map the requirements that apply to each client's data before infrastructure decisions are made. Planning early avoids costly migrations.

First, verify that the request is genuine and comes from an authority with power to make it. Check the legal basis, scope, format and deadline, and whether a court order or other authorisation is required. Consider confidentiality obligations to customers and whether you may notify them. Disclose only what is legally required, and keep a full record of the request and response. Where the request seems excessive or unlawful, seek advice on narrowing or challenging it. We help organisations set up request procedures and advise on live requests, including those affecting cross-border data transfers held by group companies abroad.

Yes, in some circumstances. Providers subject to foreign jurisdiction, such as global cloud and technology companies, may be required by their home laws to disclose data they control, even when it is stored outside that country. Data stored abroad is also subject to local law where it sits. Organisations should understand which providers and jurisdictions are involved, what contractual commitments providers make on government requests, and whether encryption or other measures reduce exposure. We help clients assess this risk as part of planning cross-border data transfers and selecting cloud and outsourcing providers. Provider transparency reports can help.

Yes. Sharing data between group companies in different countries is still a transfer, and each entity needs a lawful basis and appropriate safeguards. Many groups use an intra-group data transfer agreement that incorporates relevant standard clauses and sets out roles, security measures and responsibilities. Bangladeshi subsidiaries should ensure that group arrangements reflect the Personal Data Protection Act 2026 and any sector rules, not only the parent's home law. We prepare or adapt intra-group agreements so that cross-border data transfers within the group are documented consistently and can be shown to regulators on request. Roles must be clearly defined.

Consequences depend on the regime and the facts. Regulators may issue directions, require remediation or migration, impose penalties or take action against licences in regulated sectors. The Personal Data Protection Act 2026 provides for enforcement measures and sanctions. Contractual consequences can also follow, such as customer termination rights or indemnity claims. Early identification and remediation of gaps usually reduces exposure. We help clients investigate potential breaches, engage with regulators and implement remediation plans that bring cross-border data transfers back into compliance efficiently. Prompt notification, a clear account of events and documented fixes usually strengthen a company's position.