TRW & Co · Contracts, IP and technology
Data Protection Law in Bangladesh: What Businesses Must Do
The data protection law Bangladesh now has is the Personal Data Protection Act 2026, passed by Parliament in April 2026 to replace the November 2025 ordinance. It requires consent before personal data is collected or used, gives individuals rights over their data and limits transfers abroad. This guide sets out what Chattogram businesses must do now, step by step.
Key pointThe Act is in force, but its rules and enforcement machinery are still being built. Businesses that map their data, fix vendor contracts and check where cloud-hosted data sits now will avoid rushed and costly changes when the authority begins enforcing.
At a glance
Act passed April 2026
Parliament passed the Personal Data Protection Bill 2026 in April 2026, replacing the ordinance gazetted on 6 November 2025 and its early-2026 amendment.
Consent comes first
Personal data may be collected, stored, transferred or used only with specific, informed and withdrawable consent or another basis the Act recognises, with the burden on the business.
Rights for individuals
People can access their data, seek correction or deletion in defined cases, withdraw consent and object to certain automated decisions made about them.
Regulator under the PMO
A data protection authority attached to the Prime Minister's Office, set up under the companion data governance law, oversees compliance and penalties.
Transfers abroad restricted
The law classifies data and restricts cross-border transfers of more sensitive categories, so cloud and group hosting arrangements need checking against the current text and rules.
Swipe or scroll →
The data protection law Bangladesh now has is the Personal Data Protection Act 2026, which Parliament passed in April 2026 to replace the ordinance gazetted in November 2025. It treats individuals as the owners of their personal data, requires consent before collection and use, gives people rights over their data and places duties on businesses that collect it. As of October 2026, this guide explains what Chattogram businesses must do now.
The short answer
Any business that collects personal data about people in Bangladesh, whether customers, employees, patients, students or app users, now has a statutory framework to comply with. In practice that means knowing what personal data you hold and why, getting valid consent or another lawful basis, telling people how their data is used, keeping it secure, respecting their rights, controlling what leaves the country and being able to prove all of this to the regulator.
The law is new and its supporting rules and enforcement machinery are still being built. That is not a reason to wait. The core duties apply now, contracts signed today will run for years, and customers, foreign partners and banks are already asking for evidence of compliance. A practical programme, scaled to the size of the business, is the sensible response to the data protection law Bangladesh has adopted.
How the law developed
Bangladesh discussed a data protection bill for several years before acting. On 6 November 2025 the government issued two ordinances, the Personal Data Protection Ordinance 2025 and a companion national data governance ordinance, which The Business Standard reported were approved by the Council of Advisers in October 2025. An amending ordinance followed in early 2026.
After the February 2026 election, the new Parliament reviewed the ordinances issued by the interim government. The Personal Data Protection Bill 2026 was among the bills passed in April 2026, and The Daily Star reports that the ordinance became the Personal Data Protection Act on 15 April 2026. The regulator, a data protection authority attached to the Prime Minister's Office, was established under the separate data governance law.
Other laws continue to apply alongside it. The Information and Communication Technology Act 2006 governs electronic records and signatures, the Cyber Security Act 2026 deals with cyber offences and critical information infrastructure, and sector regulators such as Bangladesh Bank impose their own data and security rules. Policy for the digital economy is led by the ICT Division.
What the data protection law Bangladesh enacted requires
The Act follows familiar international principles, adapted to Bangladesh. The headline obligations for businesses are these.
Consent and lawful processing
Consent must be obtained before personal data is collected, stored, transferred or used, and it must be specific, informed and capable of being withdrawn. The business carries the burden of showing that consent was given. The Act also recognises other grounds in defined circumstances, such as performance of a contract and legal obligations, so map each processing activity to its basis rather than relying on blanket consent.
Transparency
People must be told what data is collected, why, who it is shared with, where it is stored and how to exercise their rights. A privacy notice in clear Bangla and English is the usual vehicle.
Rights of individuals
Individuals have rights to access their data, have it corrected or deleted in defined circumstances, withdraw consent and object to certain automated decisions. Businesses need a way to receive, verify and answer requests within the time the law and rules allow.
Sensitive data and children
Financial, health, genetic and biometric data receive enhanced protection. For children, consent must come from a parent or guardian, and the 2025 ordinance prohibited profiling, behavioural tracking and targeted advertising directed at minors. Schools, hospitals, fintech and consumer apps should review these areas first.
Security, retention and records
Data must be protected by appropriate technical and organisational measures, kept no longer than necessary and documented. Expect the regulator to ask for records of processing, security policies and evidence of staff training.
Who is affected in Chattogram
The data protection law Bangladesh introduced applies across sectors. In Chattogram, the most exposed businesses include:
Port, shipping and logistics
Freight forwarders, C&F agents, shipping lines and terminals hold crew, driver and consignee data, often shared across borders with principals and carriers.
Manufacturers and EPZ factories
Large workforces mean payroll, biometric attendance, medical and grievance records. Foreign buyers' audits increasingly ask how worker data is protected.
Retail, e-commerce and fintech
Loyalty schemes, delivery apps and mobile financial services hold purchase histories, locations and payment data at scale.
Hospitals, clinics and schools
Health and children's data attract the strictest treatment, and many institutions still keep records on unsecured systems.
Sector rules that sit alongside the Act
The data protection law Bangladesh adopted in 2026 is a general law. Regulated businesses must also meet sector rules, which are often more detailed and are already being enforced. The table summarises the main overlaps for Chattogram businesses.
| Area | Main source | What it adds |
|---|---|---|
| Banks and financial institutions | Bangladesh Bank's Guideline on ICT Security (version 4.0, April 2023) | Information security governance, incident handling, data classification, encryption and controls over cloud service providers |
| Cyber offences and critical infrastructure | Cyber Security Act 2026 | Offences for unauthorised access and data theft, and duties for critical information infrastructure |
| Electronic records and signatures | Information and Communication Technology Act 2006 | Legal recognition of electronic records and digital signatures used in consent and contracts |
| Employment | Bangladesh Labour Act 2006 and service rules | Records employers must keep, which shapes retention periods for worker data |
| Contracts with foreign partners | Buyer codes, group policies and foreign laws such as the GDPR | Audit rights, transfer clauses and breach notice deadlines imposed by contract |
Where the rules overlap, comply with the stricter requirement. A bank in Agrabad, for example, cannot rely on a gap in the Act to avoid the incident-handling expectations in the Bangladesh Bank guideline, and a factory supplying a European buyer will usually find that the buyer's contract sets a shorter breach notice period than any Bangladeshi rule.
Documents a business should be able to produce
When the authority, a buyer or an investor asks how you comply with the data protection law Bangladesh now applies, the answer is a short set of documents rather than a general assurance. Most businesses should be able to produce:
- a record of processing activities, showing each system, the data it holds, its purpose, its legal basis, its location and who it is shared with;
- privacy notices for customers, employees and website or app users, with the date each version took effect;
- consent records and the forms used to collect them;
- data processing agreements with vendors and group companies, including transfer terms;
- impact assessments for high-risk processing, such as biometrics and large customer databases;
- information security and retention policies, and evidence of staff training;
- an incident response plan and a log of incidents and data requests handled.
These documents also make the programme easier to run. When staff change, a new manager can see what was decided and why, rather than rebuilding the analysis from scratch.
Cross-border transfers and cloud hosting
Cross-border flows are where the data protection law Bangladesh enacted bites hardest in practice. Many Chattogram businesses use foreign cloud services, group systems hosted abroad or overseas payroll and CRM providers. The Act and its companion data governance law classify data and restrict transfers of more sensitive categories abroad, and they contemplate keeping certain categories within Bangladesh. The detail has shifted between the ordinance, its amendment and the Act, and rules are still being made.
Before moving or renewing a cloud contract, identify which categories of data the system holds, whether any of it falls within the restricted categories, and whether a copy must remain in Bangladesh. Then make sure the contract with the provider gives you the transfer, security and audit terms you need. Our article on software, SaaS and cloud contracts explains the contract terms.
Commentators have noted that the Act does not fix a breach-notification deadline in the way many foreign laws do, leaving detail to rules. Do not read that as permission to stay silent. Plan to notify the regulator and affected people promptly, and check sector rules and your contracts, which often impose their own deadlines. Our guide to data breach response sets out a workable plan.
Building a compliance programme: step by step
A proportionate programme for a mid-sized Chattogram business usually follows this sequence.
- Map your data. List what personal data you hold, where it comes from, where it is stored, who can access it and who it is shared with, including foreign group companies and vendors.
- Classify and assess risk. Identify sensitive data, children's data and data that may fall into restricted categories for transfer. Carry out an impact assessment for high-risk processing such as biometrics, profiling and large customer databases.
- Fix the legal basis. Decide the basis for each activity, redesign consent forms where needed and remove processing you cannot justify.
- Publish notices. Issue privacy notices for customers, employees and website or app users, in Bangla and English.
- Put contracts in place. Sign data processing terms with vendors, cloud providers, payroll bureaus and group companies, covering security, sub-processing, transfers, breach notice and deletion.
- Secure and retain. Apply access controls, encryption and logging; set retention periods and delete what is no longer needed.
- Handle rights and incidents. Set up a channel for data requests and an incident response plan, and train staff to recognise both.
- Assign responsibility. Appoint a senior person accountable for data protection and report to the board periodically.
The cheapest time to comply is before the regulator, a foreign buyer or a breach asks the question for you.
An illustrative scenario
This example is illustrative only and does not describe any real business.
A Chattogram garment group with several thousand workers uses fingerprint attendance, a payroll system hosted by an overseas vendor and a mobile app for worker grievances. A European buyer's audit asks how the group complies with the new law.
The data map shows biometric templates stored indefinitely, payroll data copied to the vendor's servers abroad without a processing agreement, and grievance records visible to line supervisors. The group sets retention periods for biometric data, signs processing terms with the payroll vendor and checks whether any data must also be held in Bangladesh, restricts grievance access to the welfare team, and issues a Bangla worker privacy notice. It also updates employment documents, working with our employment contracts team, so that the changes reach new joiners.
Risks and common mistakes
Treating consent as a tick-box
Pre-ticked boxes, consent buried in terms and conditions, and a single consent covering every possible use are unlikely to satisfy a law that requires specific, informed and withdrawable consent, with the burden of proof on the business. Separate consents for different purposes, especially marketing and sharing with third parties, and keep records showing when and how each consent was given. Where another legal basis applies, such as performing a contract with the customer, rely on it instead of asking for consent you do not need.
Ignoring employee data
Businesses often focus on customers and forget their own workforce. Payroll, NID copies, medical records, biometric attendance, CCTV and disciplinary files are all personal data. Workers have the same rights as customers, and employee data is frequently shared with group companies, auditors and buyers abroad. Review employment contracts, handbooks and HR systems as part of the programme.
No contract with vendors
Cloud providers, call centres, delivery partners and marketing agencies process data on the business's behalf. Without a written agreement, the business cannot show that the vendor keeps data secure, uses it only on instructions, informs it of breaches and deletes it at the end. Vendor contracts are also where cross-border transfer terms belong.
Waiting for the rules
Some businesses assume nothing is required until every rule is issued and the regulator is fully staffed. The Act is in force, individuals can already ask questions, and enforcement capacity will grow. Buyers, investors and lenders also apply their own standards in contracts and due diligence; our due diligence practice sees data compliance raised in transactions more often each year.
Enforcement, penalties and disputes
The Act gives the authority powers to issue directions, investigate and impose administrative penalties. Commentators note that the penalty structure is built around institutional data controllers and their turnover, and that the government may give the authority directions on national security and public order grounds. Some enforcement provisions depend on rules and government notifications, so the timing of enforcement should be checked as it develops.
Data misuse can also trigger other liability. Unauthorised access and data theft may be offences under the Cyber Security Act 2026, handled in Chattogram through the police, the national incident response team and the Cyber Tribunal. Our cyber crime practice covers that side. Contract claims between businesses over data failures are heard in the civil and commercial courts or in arbitration.
What to do next
- Nominate a senior person responsible for data protection and brief the board.
- Complete a data map for your main systems within the next quarter.
- Prioritise sensitive data, children's data and any data hosted abroad.
- Update privacy notices, consent forms and employment documents.
- Sign data processing terms with key vendors and group companies.
- Adopt an incident response plan and test it.
- Track rules and notifications under the Act and update the programme.
The data protection law Bangladesh enacted will develop through rules, guidance and enforcement over the next few years. TRW & Co's Chattogram office advises on data mapping, notices, contracts and incident response, working with our intellectual property and technology practice and our Dhaka and overseas offices on cross-border data flows. The Chattogram office hub lists our other services. To discuss your programme, contact us at info@trw.co or +880 1779 127165.
Frequently asked questions
01Is there a data protection law in Bangladesh now?
Yes. The Personal Data Protection Ordinance was gazetted on 6 November 2025 and amended in early 2026. Parliament then passed the Personal Data Protection Bill 2026 in April 2026, and it became the Personal Data Protection Act. The Act sets out consent requirements, individual rights, security duties and restrictions on transfers abroad, and it is supervised by a data protection authority. Supporting rules are still being issued, so check the latest position before relying on any particular procedure or deadline.
02Does the law apply to small businesses in Chattogram?
The Act applies to those who collect and process personal data, and it does not exempt a business simply because it is small. In practice, the effort required depends on the volume and sensitivity of the data. A small shop with a customer phone list needs a short notice, sensible consent and basic security. A clinic, school, fintech or large employer holds sensitive data and needs a fuller programme, including vendor contracts and an incident plan. Start with a simple data map to see where you stand.
03Can we store customer data on foreign cloud servers?
Often yes, but not without checking. The law classifies data and restricts transfers abroad of more sensitive categories, and it contemplates keeping certain categories within Bangladesh. The position changed between the 2025 ordinance, its 2026 amendment and the Act, and rules are still being made. Identify which data the cloud system holds, confirm whether any falls within the restricted categories, and make sure the cloud contract covers security, transfers, audit and breach notice. Sector regulators such as Bangladesh Bank have their own requirements.
04Do we need a data protection officer?
Reports on the Act indicate that significant data handlers will need to appoint a responsible officer, with the detail and timing left partly to government notification and rules. Whatever the formal requirement, every business processing meaningful volumes of personal data should name a senior person accountable for the programme, give them authority over notices, vendor contracts and incident response, and have them report to the board. That person becomes the regulator's and the public's point of contact.
05What happens if we breach the data protection law?
The authority can issue directions, investigate and impose administrative penalties under the Act, and commentators note that penalties are designed around institutional controllers and their turnover. Some enforcement provisions depend on rules and notifications, so the timing should be checked. Separately, unauthorised access and data theft can be offences under the Cyber Security Act 2026, and contract partners may claim damages if a data failure breaches their agreement. Reputational harm with customers and foreign buyers is often the most immediate consequence.
06Does the law protect employee data?
Yes. Employees are individuals whose personal data is protected in the same way as customers' data. Payroll and bank details, NID copies, medical and biometric records, CCTV footage and disciplinary files are all covered. Employers should issue a privacy notice to staff, limit access to HR data, set retention periods and sign processing terms with payroll and HR system providers. Large Chattogram factories using biometric attendance should review how long templates are kept and who can access them.
Sources and official materials
- The Business Standard: Govt issues gazettes of 2 landmark ordinances on data protection, governance — November 2025 ordinances and their key provisions
- Daily Sun: Parliament passes 31 bills in a single day (April 2026) — Passage of the Personal Data Protection Bill 2026
- The Daily Star: Why Bangladesh's new data protection law may fail to protect your data — Act in force from April 2026; regulator and breach notification commentary
- ICT Division, Government of Bangladesh — Digital economy and data policy
- BGD e-GOV CIRT — National incident response, advisories and incident reporting
General information only, current as at 27 October 2026. It is not legal advice and does not create an advocate–client relationship. It reflects the law of Bangladesh unless stated otherwise, and the law, court practice and official fees change frequently. Check current official sources and take advice on the facts of your matter.
