If you collect or use personal data about individuals in Bangladesh, it very likely does. The Act applies to public and private bodies that process personal data, whether the processing happens on paper or electronically, and it can reach foreign organisations that offer goods or services to people in Bangladesh or process their data. Small businesses are not automatically exempt, although obligations should be applied proportionately. We review your activities, customer base and group structure to confirm how the law applies and which data protection obligations need attention first, so that effort goes where the risk is.

At a minimum, organisations need a lawful basis for each use of personal data, a clear privacy notice, appropriate security, limits on how long data is kept, and processes to respond when individuals ask to access, correct or delete their information. They must take care with sensitive data, children's data and transfers abroad, and they are expected to bind processors by contract. Accountability matters too: you should be able to show regulators how you comply, through records, policies and training. We help clients put these elements in place in a way that fits their operations rather than copying foreign templates.

Usually yes, but transfers need a legal basis and appropriate safeguards. The Act sets conditions on moving personal data outside Bangladesh, and some categories of data or regulated sectors may face stricter rules or expectations that certain records stay in the country. Implementing rules are still developing, so each transfer arrangement should be reviewed against the current position. We map where data goes, assess which conditions apply, prepare intra-group agreements and contract clauses, and help clients decide whether local hosting, mirrored storage or other controls are needed for particular systems. Group data protection policies should reflect the same analysis.

Consent is important under the Act, but it is not always the right or only basis. Where consent is used, it should be informed, specific and freely given, and individuals should be able to withdraw it. Other activities, such as performing a contract, meeting a legal obligation or certain legitimate business needs, may rest on different grounds depending on how the law and implementing rules treat them. Relying on consent for everything can backfire, because withdrawal then disrupts core services. We help clients choose the appropriate basis for each processing activity and record why it was chosen.

First, contain it and preserve evidence. Then assess what data was affected, how many people are involved and what harm could result. The Act requires notification to the authority where a breach is likely to cause significant harm, with timing and manner set by regulations, and sector regulators may have their own reporting requirements. Notices must be accurate and avoid speculation. We guide clients through the legal assessment, prepare notices, coordinate with forensic investigators and insurers, and document decisions. Our related cybersecurity incident response practice supports clients facing ransomware or system compromise alongside the data protection issues.

Employees have privacy rights at work, although employers have legitimate needs to manage staff, protect systems and comply with law. Monitoring email, devices, location or CCTV should be proportionate, explained in policy and limited to defined purposes. Health data, biometric attendance records and background checks need care. Retention periods should be set for personnel and recruitment records. When HR data is shared with a parent company abroad, transfer conditions apply. We prepare workplace policies, privacy notices for staff and monitoring guidelines that balance data protection duties with labour law and business needs. Managers need training on permitted use.

It is a strong starting point, but it is not automatically enough. The Bangladeshi Act shares many principles with the GDPR, so existing records, notices, contracts and security measures can often be adapted. Differences remain, for example in the treatment of cross-border transfers, children's data, local language requirements, regulator engagement and penalties, and implementing rules may add further local detail. We carry out a focused gap analysis that maps your GDPR programme against Bangladeshi requirements, so that local entities can comply without rebuilding the whole group framework. Local data protection counsel can then handle regulator contact.

The Act gives the authority powers to issue binding instructions, inspect, impose administrative fines and suspend unlawful processing or transfers. Amounts and procedures are set in the legislation and rules, and enforcement practice is still emerging, so we do not assume a particular outcome. Beyond formal penalties, organisations face reputational damage, loss of customer trust and contractual claims from business partners. Directors and senior managers may also face scrutiny where failures are serious. A documented compliance programme, regular audits and prompt response to problems are the best protection against enforcement and claims.