TRW Insight / Bangladesh
Between May 2025 and June 2026 Bangladesh replaced its cyber law, enacted its first data protection and data governance statutes and amended its telecom regime. Every technology business now works from a new statute book.
Technology law Bangladesh: the 2026 framework
Technology law Bangladesh businesses must follow was rewritten between May 2025 and June 2026. The interim government replaced the Cyber Security Act 2023, issued the country's first personal data protection and national data governance ordinances, and amended the telecom statute. The elected Parliament then converted much of that work into Acts in April 2026, and has already amended the cyber security law once. Anyone building, buying, financing or regulating technology in Bangladesh now works from a new statute book, and much of the older commentary is out of date.
This guide brings the framework together in one place: the ICT Act 2006 and electronic signatures, the Cyber Security Act 2026, the Personal Data Protection Act 2026 and the National Data Management Act 2026, telecom regulation under the BTRC, digital commerce, fintech and mobile financial services, the draft national AI policy and the intellectual property rules that protect software and content. It explains the legal issues in technology that come up most often in practice, how technology has changed the way law is made and enforced, and how to build a compliance programme that will survive the rules still to come.
Summary: Technology law in Bangladesh now rests on five pillars: the ICT Act 2006 for electronic records and signatures; the Cyber Security Act 2026 for cyber offences and content blocking; the Personal Data Protection Act 2026 and National Data Management Act 2026 for personal data and data governance; the Bangladesh Telecommunication Act 2001 for networks and licensing; and Bangladesh Bank's payment rules for fintech. Digital commerce, AI and intellectual property sit on top of that base, and several implementing rules are still pending.
Key point: The 2025 ordinances were not simply carried forward. The Personal Data Protection Act 2026, the National Data Management Act 2026 and the Cyber Security Act 2026 are now the governing texts, each deemed to take effect from the date the original ordinance began, and the penalty and complaint provisions of the data protection law remain switched off until the government notifies them.
At a glance
Electronic transactions
The ICT Act 2006 gives legal recognition to electronic records and electronic signatures and licenses certifying authorities.
Cyber security
The Cyber Security Act 2026 replaced the 2025 ordinance, created a National Cyber Security Agency and was amended in June 2026.
Personal data
The Personal Data Protection Act 2026 sets lawful bases, data-subject rights and breach notification, with fines deferred.
Telecom and platforms
The BTRC licenses networks under the 2001 Act, while digital commerce relies on guidelines, DBID registration and consumer law.
Fintech and AI
Bangladesh Bank licenses payment services under the 2024 payments statute; AI is governed by policy, not yet by statute.
Table of Contents
What technology law Bangladesh covers in 2026
There is no single technology code in Bangladesh. Technology law Bangladesh practitioners work with is a cluster of statutes, regulations and policies, each with its own regulator. The core statutes are the Information and Communication Technology Act 2006, the Cyber Security Act 2026, the Personal Data Protection Act 2026, the National Data Management Act 2026 and the Bangladesh Telecommunication Act 2001. Around them sit Bangladesh Bank's payment and mobile financial services rules, the Ministry of Commerce's digital commerce guidelines, consumer protection law, tax law and the intellectual property statutes.
The practical consequence is that one product can engage four or five regimes at once. A consumer lending app, for example, collects personal data, processes payments, markets to consumers, runs on a licensed telecom network and may use automated credit scoring. Each of those features has a different legal owner. Technology regulation in Bangladesh therefore has to be mapped feature by feature, not by industry label.
Why the framework changed so quickly
The interim government that took office in August 2024 governed by ordinance, and technology was one of its priorities. In May 2025 it repealed the Cyber Security Act 2023 by ordinance.[6] It then issued ordinances on personal data protection and national data management, which took effect on 6 November 2025, and in February 2026 it promulgated a telecom amendment ordinance.[3] [4] [9] After the February 2026 election, the new Parliament worked through the interim government's ordinances in early April 2026, passing the National Data Management Bill 2026 and the Cyber Security Bill 2026 on 10 April by voice vote, without amendment proposals.[5]
The impact of technology on law in Bangladesh
The impact of technology on law in Bangladesh runs in both directions. Technology has forced new rules on data, platforms, payments and AI. It has also changed how law itself operates: statutes are now consulted online, government services run on shared data platforms, electronic records are admissible and signed electronically, and regulators increasingly enforce through technical means such as content blocking and digital forensics. Understanding the impact of technology law in Bangladesh means understanding both effects, because the state is now a large data controller and technology user in its own right.
The ICT Act 2006: electronic records and electronic signatures
The Information and Communication Technology Act 2006 (Act No. 39 of 2006) remains the foundation of electronic transactions.[1] Its offence provisions have been progressively stripped out as cyber crime moved to separate statutes, but its civil architecture is intact and is relied on every day by banks, e-commerce platforms, government offices and contracting parties.
Legal recognition of electronic records
Chapter 2 of the Act allows a subscriber to authenticate an electronic record by electronic signature (section 5), gives legal recognition to electronic records (section 6) and to electronic signatures (section 7), and provides for their use in government offices, electronic retention of records and an electronic gazette.[1] Chapter 3 deals with attribution, acknowledgement of receipt and the time and place of dispatch and receipt, which are the rules that decide when an online contract is formed.[1] Section 11 is easily overlooked: no one can be compelled to accept a document in electronic form.[1]
Certifying authorities and digital signatures
Chapter 5 establishes the Controller of Certifying Authorities, provides for the recognition of foreign certifying authorities and requires a licence to issue electronic signature certificates, with rules on renewal, suspension, revocation and investigation.[1] Chapter 4 sets the standard for a secure electronic record and a secure electronic signature.[1] In practice, a simple click-to-accept or scanned signature may evidence agreement, but a certificate-based digital signature from a licensed certifying authority carries far stronger evidential weight. Treat any instrument that must be stamped, registered, attested or notarised as paper-first unless the relevant authority confirms it accepts an electronic version.
What remains of the ICT Act offences
Sections 54 to 57 and section 66 of the ICT Act are marked as repealed on the official text, including the notorious section 57 on online publication.[1] Other contraventions, the cyber tribunal provisions and the network service provider liability rules remain on the statute book. Older contracts, policies and terms of use that still cite the ICT Act for cyber offences should be updated to refer to the Cyber Security Act 2026.
The Cyber Security Act 2026
Bangladesh has had four cyber statutes in eight years: the Digital Security Act 2018, the Cyber Security Act 2023, the Cyber Security Ordinance 2025 and now the Cyber Security Act 2026. Knowing which one applies to past conduct, pending cases and current compliance is a basic requirement of technology law Bangladesh practice.
From the 2023 Act to the 2025 ordinance
The Cyber Security Ordinance 2025 was gazetted on 21 May 2025 and repealed the Cyber Security Act 2023.[6] It omitted sections 21, 24 to 29, 31 and 34 of the 2023 Act, which covered speech offences such as defamation, propaganda about the Liberation War and national symbols, impersonation and offensive or threatening information. Pending cases and investigations under those sections were annulled.[6] The ordinance also introduced offences targeting online sexual harassment of women and children, online gambling and crimes committed using artificial intelligence.[6]
Re-enactment by Parliament
The Cyber Security Act 2026 (Act No. 81 of 2026) repeals and re-enacts the 2025 ordinance and is deemed to have come into force on 21 May 2025.[2] It applies extraterritorially (section 4), establishes a National Cyber Security Agency under a Director General, administratively attached to the ICT Division (section 5), gives the authorities power to remove or block certain data (section 8), provides for a Computer Emergency Response Team and digital forensic laboratories (sections 9 to 11) and creates a National Cyber Security Council (section 12).[2] Its definitions now include revenge pornography and sextortion.[2]
The June 2026 amendment
On 30 June 2026 Parliament passed the Cyber Security (Amendment) Bill 2026, which removed section 20 on online gambling because a separate gambling prevention law had been adopted.[7] Opposition members warned against using the law to suppress dissent.[7] For platforms and publishers, the practical exposure lies in the blocking and data-removal powers, requests for user data and the content offences that remain. A documented process for handling government takedown and disclosure requests is now an essential control, not a nice-to-have.
Personal data under technology law Bangladesh
For most businesses, the largest change in technology law Bangladesh has seen in a decade is the arrival of a general data protection statute. Two Acts work together: the Personal Data Protection Act 2026 sets the rules for processing, and the National Data Management Act 2026 creates the regulator and the national data architecture. Our detailed guide to Bangladesh data protection law in 2026 covers the provisions section by section.
Personal Data Protection Act 2026
The Personal Data Protection Act 2026 (Act No. 63 of 2026) is deemed to have taken effect on 6 November 2025, except section 23 and sections 31 to 35, which take effect on a date the government fixes by gazette notification after eighteen months from promulgation.[3] The Act applies extraterritorially (section 4) and reaches processing outside Bangladesh connected with goods or services offered to people in Bangladesh.[3] Lawful bases for processing are in section 5, further processing in section 6 and sensitive personal data in section 7.[3]
Data subjects have rights of access and portability, correction, withdrawal of consent and objection, and the Act requires corrections and erasures to propagate through connected systems (sections 10 to 14).[3] Data fiduciaries carry accountability and transparency duties (section 15), confidentiality (section 16), security standards (section 17), retention limits (section 18), record-keeping (section 19), data audits (section 21) and data protection planning (section 22).[3] Children's data and data of people unable to consent receive special treatment under section 9.[3]
Breach notification
Section 20 requires a data fiduciary to notify the Authority of a personal data breach likely to cause significant harm to the data subject, in the form, manner and time set by regulation.[3] No fixed hour count is yet in force. That is not a reason to wait: an incident-response plan that can produce a notice within days, with facts, affected categories of personal data and remedial steps, will be needed the moment regulations issue.
National Data Management Act 2026
The National Data Management Act 2026 (Act No. 80 of 2026) is also deemed effective from 6 November 2025.[4] It creates a policy board chaired by the Prime Minister (section 5) and a National Data Management Authority attached to the Prime Minister's Office, with an Executive Chairman and six members (sections 8 and 9).[4] The Authority's functions include data-sharing and interoperability across government, private and autonomous bodies, the NRDEX data exchange platform, national data governance standards and certification, a national code repository for government software and accountability of data fiduciaries and processors (section 23).[4]
The Act also classifies data into tiers (section 29) and contains special provisions on the exchange of state-sensitive data (section 31).[4] For cloud providers, outsourcing vendors and multinational groups, those classification rules matter as much as the Personal Data Protection Act's own transfer provisions, because they determine where some categories of data can be held. Health platforms should also read our analysis of patient data and cloud hosting in Bangladesh.
Telecom regulation: the BTRC and the 2001 Act
The oldest pillar of technology law Bangladesh is telecom. Networks, spectrum, internet gateways and internet service providers are regulated under the Bangladesh Telecommunication Act 2001 (Act No. 18 of 2001), dated 16 April 2001.[8] The Bangladesh Telecommunication Regulatory Commission (BTRC) licenses operators, approves tariffs and enforces licence conditions, with the Posts and Telecommunications Division retaining a policy role.
The 2026 telecom amendment ordinance
On 5 February 2026 the interim government promulgated the Bangladesh Telecommunication Regulation (Amendment) Ordinance 2026 as Ordinance No. 25 of 2026.[9] When its final draft was approved in December 2025, the government said it would bar the suspension of internet services, establish a council led by the law adviser to authorise lawful interception for state security or public order, create a technical platform called the Centre for Information Support, strengthen the BTRC's authority and add a Transparency and Accountability Committee to oversee it.[10]
The ordinance was not among the technology bills reported passed on 10 April 2026, the final day of Parliament's ordinance-conversion exercise.[5] Before relying on any provision of the 2026 amendment, confirm on the official legislative database whether it has been re-enacted, and in what form. Operators, ISPs and over-the-top platforms should treat interception, lawful-access and shutdown rules as a live area and keep their compliance manuals flexible.
Licensing for technology businesses
Most software, SaaS and platform businesses do not need a BTRC licence, because they ride on licensed networks rather than operate them. The position changes for businesses that provide connectivity, run data centres with network services, resell bandwidth, offer voice services or operate as virtual network operators. Check the licence category before launch, not after the regulator asks.
Digital commerce and platform regulation
Within technology law Bangladesh, digital commerce is regulated mainly through policy instruments, guidelines and general statutes rather than a dedicated Act. Our guide to e-commerce law in Bangladesh sets out the full list. The headline instruments are the National Digital Commerce Policy, the Digital Commerce Operational Guidelines, the Digital Business Identification (DBID) registration guidelines of 2022 and Bangladesh Bank's Merchant Acquiring and Escrow Service Policy, under which a buyer's payment reaches the seller only after receipt of the goods or services is confirmed.[11]
The legacy of the e-commerce collapses
Regulation is still shaped by the failures of platforms such as Evaly and E-orange. In August 2026 the Commerce Minister told Parliament that 58,720 complaints had been filed with the consumer rights directorate against e-commerce platforms, claiming about Tk 3,869 crore, and that Tk 472 crore had been returned to consumers.[11] Only 1,902 entities held a DBID at that time.[11]
What is coming
The government has said it plans a Digital Commerce Regulatory Authority, although setting it up will take time, and is considering amending consumer rights legislation to give the directorate more power.[11] Platforms selling to consumers should already operate as if an e-commerce regulator existed: clear pricing and delivery terms, escrow-compatible payment flows, responsive complaint handling and honest advertising. Consumer exposure under the Consumers' Right Protection Act 2009 is the most common enforcement risk today, and our consumer protection practice handles both compliance reviews and directorate complaints.
Fintech, mobile financial services and digital payments
Fintech is the most tightly regulated corner of technology law Bangladesh has. Bangladesh Bank is the gatekeeper, and almost every payment innovation needs its approval before launch.
The Payment and Settlement Systems Act 2024
Parliament passed the Payment and Settlement Systems Bill on 2 July 2024 to bring bank and non-bank payment services under a legal framework for the first time.[12] As reported on passage, the law prohibits operating a payment system, providing electronic-money payment services or issuing, buying or selling prepaid payment instruments without Bangladesh Bank approval, and makes unauthorised activity punishable by up to five years' imprisonment, a fine of up to Tk 50 lakh, or both. Supplying false information in a statement or report attracts up to three years and up to Tk 30 lakh.[12]
Mobile financial services and other licences
Mobile financial services operate under Bangladesh Bank's MFS regulations, alongside separate regimes for payment service providers, payment system operators, digital banks and agent banking. The licensing route depends on what the business actually does with customer money: holding it, moving it, switching transactions or simply providing technology to a licensed bank. Many fintech founders lose months by applying for the wrong licence, or by launching a wallet feature that converts a technology service into a regulated payment service. Our banking regulations guide and banking and finance practice cover the regulatory perimeter.
Fintech and data
Fintech firms sit at the intersection of Bangladesh Bank's confidentiality and outsourcing rules and the new personal data framework. Credit-scoring models, KYC data and transaction histories are personal data, and some will be sensitive. Product design should anticipate the data subject rights in sections 10 to 14 of the Personal Data Protection Act 2026, especially correction and objection, which bite on automated credit decisions.[3]
Artificial intelligence: policy before statute
For artificial intelligence, technology law Bangladesh still works through policy rather than statute. In January 2026 the interim government published a Draft National AI Policy Bangladesh 2026 to 2030, which followed an earlier 2024 draft that was never finalised.[13] The draft sorts AI systems into prohibited, high-risk, limited-risk and low-risk tiers. Prohibited uses include social scoring, indiscriminate biometric surveillance and election-disrupting deepfakes; high-risk uses such as healthcare, law enforcement and credit assessment would require algorithmic impact assessments and strict human oversight.[13]
The draft proposes an independent oversight committee to be created by an Act of Parliament, liability for deployers of high-risk AI regardless of intent and a permanent AI Act to replace the policy by 2030.[13] In July 2026 the Posts, Telecommunications and ICT Minister, Faqir Mahbub Anam, said the elected government was formulating a human-centric national AI policy and drafting guidelines for AI use in the public sector.[14]
What applies to AI today
Absent an AI statute, existing law does the work. The Personal Data Protection Act 2026 governs training and inference on personal data. The Cyber Security Act 2026 addresses crimes committed using AI, and now defines revenge pornography and sextortion.[6] [2] Consumer law catches misleading AI claims, sectoral regulators apply their own rules to AI used in banking or health, and contract law allocates risk between developers and deployers. Our analysis of AI health apps and medical advice shows how these rules combine in one sector.
Intellectual property for technology businesses
Intellectual property is the area founders most often neglect. Technology companies are built on intangible assets, and the IP statutes have been substantially modernised. The Copyright Act 2023 replaced the Copyright Act 2000 and treats software as a category of information-technology-based digital work; our copyright registration guide explains registration and ownership of commissioned works. The Bangladesh Patent Act 2023 replaced the earlier patent legislation, and trade marks are registered under the Trade Marks Act 2009 through the Department of Patents, Designs and Trademarks, as explained in our trademark registration guide.
Three practical points recur. First, ownership of code written by contractors and freelancers must be assigned in writing; do not assume the employer-ownership rule covers everyone who touched the product. Second, register the brand in Bangladesh before launch, because domain names and app store listings do not protect a mark. Third, keep an open-source licence inventory, because investors and acquirers will ask for it during due diligence.
Regulators and institutions
A recurring question is which body actually enforces technology law Bangladesh rules. The answer depends on the activity.
Controller of Certifying Authorities
Licenses certifying authorities and oversees electronic signature certificates under the ICT Act 2006.
National Cyber Security Agency
Agency under the Cyber Security Act 2026, attached to the ICT Division, with CERT and forensic functions.
National Data Management Authority
Statutory body under the Prime Minister's Office responsible for data governance, interoperability and accountability.
BTRC
Licenses telecom networks, gateways and ISPs and enforces licence conditions under the 2001 Act.
Bangladesh Bank
Approves payment systems, electronic money, prepaid instruments, MFS and digital banking.
Consumer rights directorate
Receives complaints against e-commerce platforms and enforces consumer protection law.
Overlap is normal. A data breach at a payment app may involve the National Data Management Authority, Bangladesh Bank, the cyber security agency and, if consumers are harmed, the consumer rights directorate. Agree in advance who in the business speaks to which regulator, and keep the message consistent.
Legal issues in technology: the risks we see most often
The legal aspects of technology use in Bangladesh are rarely exotic, and most disputes start with an ordinary compliance gap. The same issues appear across fintech, health, e-commerce, outsourcing and media.
Outdated legal references
Privacy policies, terms of use and employment handbooks still cite the Digital Security Act 2018 or the Cyber Security Act 2023. Both are gone. Under the new statutes, citing the wrong law in a consent notice or incident policy is more than a drafting slip; it suggests the underlying process has not been reviewed either.
Consent that will not survive scrutiny
Bundled, pre-ticked or buried consent is common in Bangladeshi apps. Section 5 of the Personal Data Protection Act 2026 sets out lawful bases for processing, and the rights in sections 10 to 14 cannot be designed away.[3] Rebuild consent flows now, while the penalty provisions are still deferred, rather than after enforcement begins.
Cross-border data and cloud hosting
Group IT systems, offshore support centres and foreign cloud services all move personal data across borders. The data-tier classification in the National Data Management Act 2026 and the transfer rules in the data protection law have to be mapped against the actual data flows, not the architecture diagram.[4]
Platform content and government requests
Platforms and publishers need a written process for content removal and user-data requests under the Cyber Security Act 2026: who receives the request, how its legal basis is checked, what is logged and when the user is told.[2] The June 2026 debate shows that the scope of these powers remains politically contested.[7]
Regulatory perimeter in fintech
Adding a wallet, a stored-value balance or a payment-initiation feature can move a technology product inside the Payment and Settlement Systems Act's licensing perimeter, with criminal exposure for unauthorised activity.[12] Run every new feature past the regulatory map before it ships.
Tech regulation and compliance: a step-by-step programme
Tech regulation and compliance in Bangladesh is best handled as a programme with a fixed sequence rather than a series of reactions to new rules. The following steps reflect how we structure technology law Bangladesh compliance reviews for clients.
Map the product
List every feature, data flow, payment flow and network dependency, and identify the regime each one engages.
Update the legal references
Replace citations to the Digital Security Act 2018, the Cyber Security Act 2023 and the 2025 ordinances with the 2026 Acts.
Inventory personal data
Record categories, lawful bases, sensitive data, retention periods, processors and cross-border transfers.
Fix consent and notices
Rebuild consent flows and privacy notices around section 5 lawful bases and the data-subject rights in sections 10 to 14.
Check licences
Confirm whether BTRC, Bangladesh Bank, DBID or sectoral approvals are required before launch or before a new feature ships.
Prepare for incidents
Adopt a breach-response plan and a written process for government content-removal and data requests.
Paper the contracts
Align vendor, cloud, outsourcing and development agreements with security, data and IP ownership requirements.
Monitor and train
Track pending rules and notifications, keep a dated law register and refresh staff training each year.
Two disciplines apply throughout. Keep a dated register of every law, rule and guideline relied on, because the statute book is still moving; and assign a named owner for each regulator relationship.
Technology regulation in Bangladesh compared
The table summarises the main regimes of technology law Bangladesh, their regulators and the point that matters most in 2026. On a phone, scroll it sideways.
| Area | Main law | Regulator | 2026 status | Key point |
|---|---|---|---|---|
| Electronic transactions | ICT Act 2006 | Controller of Certifying Authorities | In force; offence sections 54 to 57 and 66 repealed | No one can be compelled to accept electronic documents |
| Cyber security | Cyber Security Act 2026 (Act 81 of 2026) | National Cyber Security Agency | Deemed in force from 21 May 2025; amended June 2026 | Blocking and data-removal powers |
| Personal data | Personal Data Protection Act 2026 (Act 63 of 2026) | National Data Management Authority | Deemed in force from 6 November 2025; ss 23 and 31 to 35 deferred | Fines not yet operative; rights already apply |
| Data governance | National Data Management Act 2026 (Act 80 of 2026) | National Data Management Authority | Deemed in force from 6 November 2025 | Data tiers and NRDEX data exchange |
| Telecom | Bangladesh Telecommunication Act 2001 | BTRC | 2026 amendment ordinance: confirm re-enactment | Licence needed for network services |
| Payments and fintech | Payment and Settlement Systems Act 2024 | Bangladesh Bank | In force | Unauthorised payment services are criminal |
| Digital commerce | Guidelines, DBID rules and consumer law | Ministry of Commerce and consumer directorate | Regulatory authority planned | Escrow-based payment flows |
| AI | Draft National AI Policy 2026 to 2030 | ICT Division | Policy stage | Existing laws apply meanwhile |
For a new product, read down the table and ask whether each regime is engaged. Most products engage at least three. Our corporate and commercial advisory practice coordinates multi-regime reviews, and our venture capital practice advises technology start-ups and their investors.
Working with technology lawyers in Bangladesh
Technology lawyers in Bangladesh are most useful before a product launches, a contract is signed or an incident happens, not after. The work divides into four streams: regulatory mapping and licensing; data protection and cyber security compliance; commercial contracts such as SaaS, outsourcing, licensing, cloud and development agreements; and disputes and investigations, including regulator enquiries, consumer complaints and cyber crime matters. Good technology counsel combines legal analysis with enough technical understanding to ask where the data actually goes.
Technology and law workshops
Many organisations now run technology and law workshops for boards, product teams and compliance staff. The most effective sessions in Bangladesh share a common structure: a briefing on the 2026 statutes and what changed from the 2025 ordinances; a walk-through of the organisation's own data flows; a tabletop exercise on a breach or a government content request; and a short action list with owners and deadlines. One focused workshop each year, refreshed when rules are notified, is a cheap way to keep the whole organisation aligned with technology law Bangladesh developments.
What to ask your advisers
- Currency: are they working from the 2026 Acts, and do they track pending rules and notifications?
- Breadth: can they cover data, cyber, telecom, payments, consumer and IP issues together, or will you need several firms?
- Regulator experience: have they dealt with Bangladesh Bank, the BTRC and the consumer rights directorate on live matters?
- Cross-border reach: can they align Bangladesh requirements with group policies written for other jurisdictions?
What to watch in late 2026 and 2027
Four developments will shape technology law Bangladesh over the next year. First, the implementing regulations under the Personal Data Protection Act 2026, including the breach-notification timetable, and the gazette notification that will switch on sections 23 and 31 to 35.[3] Second, the rules setting out the functions of the National Cyber Security Agency and the operation of its blocking powers.[2] Third, the final form of the telecom reforms, including interception safeguards and BTRC governance.[10] Fourth, the national AI policy and any move toward a Digital Commerce Regulatory Authority.[11] [14]
The businesses that adapt best treat technology regulation in Bangladesh as a continuing programme, not a one-off project. If you are launching a product, entering the market or reviewing your compliance after the 2026 Acts, contact TRW for a structured review.
Frequently asked questions
What does technology law Bangladesh cover?
It is the body of statutes, regulations and policies governing electronic transactions, cyber security, personal data, telecom, digital commerce, fintech, AI and intellectual property. The core statutes are the ICT Act 2006, the Cyber Security Act 2026, the Personal Data Protection Act 2026, the National Data Management Act 2026 and the Bangladesh Telecommunication Act 2001.[1] [2] [3] [4]
Is the Personal Data Protection Ordinance 2025 still in force?
It has been replaced by the Personal Data Protection Act 2026 (Act No. 63 of 2026), which is deemed effective from 6 November 2025. Sections 23 and 31 to 35 take effect only on a date the government notifies after eighteen months.[3]
What happened to the National Data Management Ordinance 2025?
Which cyber security law applies in Bangladesh in 2026?
Are electronic signatures legally valid in Bangladesh?
Yes. Sections 6 and 7 of the ICT Act 2006 recognise electronic records and electronic signatures, and certificate-based digital signatures are issued by certifying authorities licensed under the Act. No one can be compelled to accept an electronic document.[1]
Does a software or SaaS company need a BTRC licence?
Usually not, if it only provides software over licensed networks. A licence under the Bangladesh Telecommunication Act 2001 is needed for connectivity, network, voice and similar telecom services.[8]
Who regulates fintech and mobile financial services?
Bangladesh Bank. The Payment and Settlement Systems Act 2024 prohibits operating payment systems or issuing electronic money and prepaid instruments without its approval, with criminal penalties for breach.[12]
Is there an AI law in Bangladesh?
Does technology law Bangladesh require DBID registration for e-commerce?
The government's DBID registration guidelines of 2022 expect digital businesses to obtain a Digital Business Identification, issued through the RJSC. Only 1,902 entities held one as of August 2026.[11]
Source register
Primary legal and regulatory sources
Materials checked on 20 October 2026. Confirm the current official text before relying on any provision.
- Information and Communication Technology Act 2006 (Act No 39 of 2006) — Laws of Bangladesh
- Cyber Security Act 2026 (Act No 81 of 2026) — Laws of Bangladesh
- Personal Data Protection Act 2026 (Act No 63 of 2026) — Laws of Bangladesh
- National Data Management Act 2026 (Act No 80 of 2026) — Laws of Bangladesh
- Dhaka Tribune, 10 April 2026 — Parliament passes 20 bills, including the National Data Management and Cyber Security Bills
- Prothom Alo, 22 May 2025 — Government issues gazette of Cyber Security Ordinance
- The Financial Express, 30 June 2026 — Bangladesh amends cybersecurity law, drops online gambling clause
- Bangladesh Telecommunication Act 2001 (Act No 18 of 2001) — Laws of Bangladesh
- Bangladesh Gazette Extraordinary, 5 February 2026 — Bangladesh Telecommunication Regulation (Amendment) Ordinance 2026 (Ordinance No 25 of 2026)
- Dhaka Tribune, 24 December 2025 — 'No internet shutdown even for a minute': telecom amendment ordinance approved
- Dhaka Tribune, 31 August 2026 — Over 58,000 e-commerce complaints lodged
- The Financial Express, 2 July 2024 — Parliament passes Payment and Settlement System Bill 2024
- The Daily Star, 26 January 2026 — Draft AI policy targets innovation, better public services
- The Business Standard, 18 July 2026 — Bangladesh drafting human-centric national AI policy: Minister
Related TRW assistance
Move from information to a defined next step
TRW advises technology companies, platforms, fintechs and investors on data protection, cyber security, telecom licensing, payments regulation, digital commerce, AI governance and technology contracts in Bangladesh. Explore our corporate and commercial advisory practice or contact TRW to scope a compliance review.