Contain the threat without destroying evidence. Isolate affected systems rather than wiping them, preserve logs, and stop staff discussing the incident on channels that may be compromised. Appoint a small response team with a clear lead, and involve counsel early so that forensic work and internal analysis can be structured to protect privilege where possible. Check insurance policies, because many require prompt notice and the use of approved vendors. Avoid public statements until the basic facts are known. The first hours of cybersecurity incident response often decide how well the organisation can explain itself later.

It depends on the data, the sector and the facts. The Personal Data Protection Act 2026 introduces obligations on organisations that process personal data, and implementing rules and regulator practice are still developing, so each incident needs a careful reading of the current position. Banks should look at Bangladesh Bank requirements on ICT incidents, telecom operators at BTRC licence conditions, and listed companies at price-sensitive information rules. Foreign law may apply too, for example where European or Indian customers are affected. We map these duties quickly and prepare notices that are accurate without saying more than the evidence supports.

There is no simple answer. Paying a ransom usually means sending funds or virtual assets abroad, which raises foreign exchange control issues under Bangladesh Bank rules, and Bangladesh Bank has warned against dealing in virtual currencies. There may also be sanctions risk if the attackers are linked to a listed group, anti-money laundering reporting duties for regulated businesses, and insurance conditions to satisfy. Directors must also consider whether payment would actually restore systems or prevent publication. We advise boards on these risks, help them record their reasoning and coordinate with law enforcement and insurers before any decision is made.

Financial institutions face closer supervision and tighter expectations. Bangladesh Bank's ICT security guidance expects banks to maintain incident management procedures, report significant events and protect customer funds and data. Payment service providers and mobile financial services operators may also have licence conditions on outages and fraud. Customer losses can lead to complaints and claims, and fraudulent transfers may require urgent requests to freeze funds at receiving banks here and abroad. Cybersecurity incident response in this sector therefore runs on two tracks at once: regulatory reporting and rapid recovery of money before it disappears. Freeze requests should go out within hours.

Possibly, but privilege must be planned rather than assumed. Bangladeshi law protects confidential communications between a client and its lawyer, and reports prepared for legal advice or anticipated litigation have a stronger claim to protection. If the forensic firm is engaged directly by the IT team for business purposes, the report may be harder to protect. Practical steps include engaging investigators through counsel, limiting distribution, separating remediation updates from legal analysis and labelling documents accurately. Where a regulator or court abroad may demand the report, we also take that jurisdiction's rules into account. Labels alone do not create privilege.

Responsibility usually depends on the contract. Many service agreements contain security standards, notification deadlines, audit rights, liability caps and exclusions for indirect loss. We review these terms quickly, send notices that preserve your rights, request the incident information the supplier is bound to provide and consider whether a claim, set-off or termination is justified. Under data protection law, the organisation that decides how personal data is used generally remains answerable to individuals and regulators even if a processor caused the breach, so supplier recovery runs alongside your own compliance steps. We also check insurance terms.

Often yes, but timing and content need care. Reporting can support insurance claims, help trace funds and identify attackers, and may be expected by regulators. Bangladesh has specialist cyber crime units within the police, and offences under cyber security legislation can be heard by the cyber tribunal. A complaint will, however, place facts on a public record and may lead investigators to request devices or documents. We prepare complaints that are accurate and focused, coordinate with the forensic team so that evidence is handed over properly, and manage the interaction between the criminal process and civil recovery.

A plan converts difficult decisions into agreed procedures before pressure arrives. It should name decision-makers, set escalation thresholds, list regulators and counterparties that may need notice, identify forensic and communications partners, and explain how evidence and privilege will be protected. Directors who have approved and tested a realistic plan are better placed to show they acted with care. We review cybersecurity incident response plans against Bangladeshi law, sector guidance and key contracts, and test them through tabletop exercises using scenarios relevant to the business, such as ransomware at a factory or fraud on a payment system.