Monitoring of work systems is generally possible, but it should be lawful, proportionate and transparent. Employers should have a clear policy explaining what is monitored and why, limit access to authorised staff, avoid unnecessary review of personal communications and keep records secure. Under the Personal Data Protection Act 2026, the employer must identify a lawful basis and respect principles such as purpose limitation and data minimisation. Constitutional protection of the privacy of correspondence is also relevant. We help employers design monitoring policies that protect the business while respecting privacy, and that will hold up if employee data is later challenged.

Biometric attendance systems are widely used in Bangladesh, especially in factories, and can be lawful if properly managed. Biometric information is particularly sensitive, so employers should consider whether a less intrusive method would work, explain the system clearly, secure templates rather than raw images where possible, restrict access and set retention limits. The vendor contract should cover security, data location and deletion. We review biometric systems against the 2026 Act and labour law requirements and recommend practical changes, so that attendance records remain reliable evidence for wages, overtime and disciplinary matters. Check that the vendor cannot reuse the data.

AI screening tools can help manage large applicant volumes, but they carry risks of bias, error and unexplained rejection. Before deployment, employers should understand what data the tool uses, test it for discriminatory outcomes, tell applicants that automated tools are used and ensure a human reviews significant decisions. The applicant's employee data, including CVs and assessment results, must be handled in line with the Personal Data Protection Act 2026 and kept only as long as needed. We review vendor contracts, design human review steps and draft applicant notices for AI-assisted recruitment. Records of review help later.

Not always. Because of the imbalance of power in employment, consent may not be considered freely given, particularly where refusing would affect the job. Relying solely on consent can also be fragile, since consent may be withdrawn. Employers usually need to identify another lawful basis, such as the needs of the employment relationship or legal obligations, and still meet transparency and proportionality requirements. Consent remains useful for optional processing, such as wellness programmes. We advise on choosing and documenting the right basis for each category of employee data and each monitoring purpose in the workplace.

Monitoring evidence, such as CCTV footage, access logs or system records, can support disciplinary action if it was collected lawfully, is reliable and is handled properly. The employer must still follow the procedures in the Bangladesh Labour Act 2006, as amended, including show cause notice, inquiry and an opportunity to respond, or the applicable service rules. Evidence should be preserved with a clear chain of custody. We advise HR teams on investigations and represent employers in labour court proceedings where dismissals based on monitoring evidence are challenged by employees or unions. Log who accessed the evidence.

Cross-border transfers of employee data to group companies or foreign vendors are common, but the Personal Data Protection Act 2026 regulates transfers outside Bangladesh and may require specific safeguards, conditions or approvals depending on the data and destination. Employers should map what data leaves the country, for which purposes, and under which contracts. Intra-group data transfer agreements, vendor terms and employee notices should all be consistent. We advise multinational employers on transfer mechanisms, documentation and practical steps, and coordinate with foreign counsel so that the group's global HR systems also comply with Bangladesh requirements. Keep a register of each transfer.

Where monitoring or automated tools materially change working conditions, performance assessment or discipline, consultation with participation committees, collective bargaining agents or trade unions may be required or advisable, depending on the workplace and any collective agreements. Even where not strictly required, early consultation reduces disputes and helps explain the purpose and safeguards. We advise on consultation obligations under the Labour Act and EPZ labour law, and help prepare communications, so that new employee data practices are introduced with less resistance and a clear record of engagement with worker representatives. Record meetings and the points raised.

Act quickly. Contain the breach, assess what employee data is affected, preserve evidence and follow the notification requirements of the Personal Data Protection Act 2026 and any contractual obligations to group companies or clients. Affected employees may need to be informed, especially where identity documents, bank details or health information are exposed. Vendors should be required by contract to notify you promptly. We help employers prepare breach response plans in advance and advise during incidents, coordinating with our cybersecurity incident response team and forensic experts where needed. Lessons should feed back into policy.