Fixed-fee review · Data protection
Data protection readiness review under the 2026 Act
A fixed-fee data protection compliance review that maps your personal data, measures it against the Personal Data Protection Act 2026 and gives you a prioritised plan before the fines and complaints provisions commence.
The Legal 500 · Bangladesh: Tier 2 Intellectual property · Tier 2 Tax · Tier 3 Dispute resolution
Who this is for
Why it matters now
Data protection compliance
Data protection compliance in Bangladesh moved from draft to statute in under a year. The Personal Data Protection Ordinance 2025 was gazetted in November 2025 [2] and has since been carried forward by Parliament as the Personal Data Protection Act 2026, Act No. 63 of 2026 dated 10 April 2026, which has its own repeal and savings section [1][4]. The Act is deemed to have taken effect on 6 November 2025, except for section 23 and sections 31 to 35, which start only on a date the government notifies in the Gazette after 18 months from the Act's issue [1].
That staggered start is the compliance window. Section 23 requires significant data fiduciaries to appoint Chief Data Officers, and sections 31 to 35 cover complaints, administrative fines for breaches of data subject rights and security failures, the factors for setting fines and compensation [1][4]. Section 36 separately deals with violations by companies [4]. Eighteen months from 10 April 2026 runs to October 2027, so the time to build records, notices and controls is now, before those provisions can be switched on.
Much of the Act is already in force. It reaches processing outside Bangladesh connected with goods or services offered to people in Bangladesh, or with monitoring or profiling them [1]. Data fiduciaries must keep processing records in a register for at least five years, notify the Authority of breaches likely to cause significant harm in the manner set by regulation, and undergo audits where directed [1]. Reported versions of the 2025 Ordinance also made directors and officers personally liable for company offences unless they could show due diligence [3], so boards should understand where they stand.
What is included
What our data protection compliance service includes
A structured assessment of your current practices against the Personal Data Protection Act 2026, separating duties already in force from those awaiting commencement or regulations, with each gap rated by risk and effort to fix.
Workshops with your business, HR and IT teams to map what personal data you hold, why, where it sits, who can access it and who receives it, producing a register you can keep up to date.
Review or redrafting of customer, employee and website notices and consent wording, so that purpose, retention, transfer and withdrawal information is clear and you can evidence what each person was told.
A review of overseas hosting, group sharing and remote access arrangements, identifying which datasets leave Bangladesh, the safeguards in place and what you would need to tell a data subject who asks about them.
A short, practical plan for assessing whether a breach is likely to cause significant harm, preserving evidence, notifying the Authority and affected people, and handling suppliers, customers and insurers.
Review of contracts with cloud, payroll, marketing and support providers, with a standard data processing schedule you can use for new suppliers, reflecting that the data fiduciary remains responsible for its processors.
A written briefing and a session with the board or senior management on accountability, Chief Data Officer readiness and how exposure for the company and its officers should be monitored as enforcement provisions commence.
How it works
Data protection compliance, step by step
- Scoping and document requestBefore work starts
We agree which entities, systems and data subjects are in scope, confirm the fixed fee in writing and send a single document request covering policies, contracts, notices, system lists and any past incidents.
- Data mapping workshopsStage 1
We run short workshops with each business function, HR and IT to map data flows, access rights, retention periods and transfers, and record the results in a processing register your team can maintain after the review.
- Data protection compliance gap assessmentStage 2
We test the register, notices, contracts and controls against the Act, separate obligations already in force from those awaiting commencement or regulations, and rate each gap by risk and by the effort needed to close it.
- Documents and plansStage 3
We prepare or revise privacy notices, consent wording, the processor schedule and the breach response plan, so the most urgent gaps are closed by the end of the review rather than left as recommendations.
- Report and board briefingOn delivery
You receive a written report with a prioritised roadmap, and we brief the board or senior management on accountability, Chief Data Officer readiness and what to monitor as regulations and commencement notices are published.
The review is priced as a fixed fee. The fee depends on the number of entities and business lines in scope, the volume and sensitivity of the data, the number of systems and processors, and whether cross-border transfers are involved. The scope and fee are confirmed in writing before work starts, and any official fees are passed through at cost.
We confirm the fee in writing before any work starts. Government fees, court fees and stamp duty are passed through at cost.Questions
Data protection compliance: questions
Is the Personal Data Protection Ordinance 2025 still in force?
It has been overtaken. The Ordinance was approved by the council of advisers on 9 October 2025 [5] and gazetted in November 2025 [2]. Parliament then enacted the Personal Data Protection Act 2026, Act No. 63 of 2026 dated 10 April 2026, which contains a repeal and savings section [1][4] and is deemed to have taken effect on 6 November 2025 for most purposes [1]. References to the Ordinance in contracts, policies and notices should be updated to refer to the Act.
When do fines and the Chief Data Officer duty start?
Section 23, on Chief Data Officers, and sections 31 to 35, covering complaints, administrative fines and compensation, take effect only on a date the government fixes by Gazette notice after 18 months from the Act's issue [1]. Since the Act is dated 10 April 2026, that cannot happen before October 2027. Until then, those duties should not be described as live, but the records, notices and controls they depend on take time to build.
Does the Act apply to a foreign company?
It can. Section 1(2) applies the Act to processing of personal data in Bangladesh and to processing outside Bangladesh connected with goods or services offered to data subjects in Bangladesh, or with monitoring or profiling them [1]. A foreign platform, an overseas group service centre or an offshore support provider handling data about people in Bangladesh should therefore be assessed. Our data protection compliance review covers these arrangements as well as local operations.
Is there a fixed deadline for reporting a data breach?
Section 20 requires a data fiduciary to notify the Authority of a personal data breach likely to cause significant harm to a data subject, in the form, manner and time prescribed by regulation [1]. The section itself does not set a number of hours. That makes an internal plan important: you need to be able to assess harm quickly, preserve evidence and meet whatever timeframe the regulations fix, as well as any contractual or sector-specific notice duties.
Can directors be personally liable?
Reporting on the 2025 Ordinance described personal liability for directors, managers and responsible officers when a company commits an offence, unless they prove due diligence [3]. The 2026 Act has its own section 36 on remedies for violations by companies, within the enforcement part of the Act [4]. How that applies to individual directors, and when it can be enforced, has to be read against the gazetted text and the commencement provisions [1]. The board briefing sets out that analysis for your organisation.
What does the data protection compliance review deliver?
You receive a processing register, a gap assessment rated by risk, revised privacy notices and consent wording, a processor schedule, a breach response plan and a written report with a prioritised roadmap. We also brief the board or senior management. The review is designed so that the most urgent gaps are closed during the engagement, and so that your team can maintain the register and documents as regulations are published.
Sources
- Personal Data Protection Act 2026 (Act No. 63 of 2026), Laws of Bangladesh
- Prothom Alo: Govt issues gazettes of 2 landmark ordinances on data protection, governance (9 November 2025)
- The Daily Star via Asia News Network: Bangladesh's Personal Data Protection Ordinance 2025: key takeaways (24 October 2025)
- Personal Data Protection Act 2026: table of sections (Bangla), Laws of Bangladesh
- The Daily Star: Personal Data Protection Ordinance 2025 topic page
Related
Start with a consultation
Tell us the facts and deadlines. We will confirm scope, fee and timeline in writing before we begin.
General information on the law of Bangladesh, not legal advice. Sending an enquiry does not create a lawyer-client relationship.