Data protection & privacy law in Bangladesh (2026)

Bangladesh's first standalone, comprehensive data-protection law was gazetted on 6 November 2025, having been approved by the interim Council of Advisers on 9 October 2025. It recognises citizens as owners of their personal data, mandates explicit consent before any collection or processing, imposes strict rules on sensitive data and cross-border transfers, and has extra-territorial reach over foreign entities handling Bangladeshi citizens' data; most operative sections take effect 18 months after gazette.

The Cabinet approved in principle the proposed Personal Data Protection Act 2023 on 27 November 2023, following iterative drafts since 2022 and inter-ministerial consultations. The bill was never put to a parliamentary vote before Parliament was dissolved in August 2024, but it directly informed the content of the eventual 2025 Ordinances.

Passed by Parliament on 13 September 2023, the Cyber Security Act (Act No. 46/2023) replaced the widely criticised Digital Security Act 2018. It retained the consent-based identity-information protection from DSA Section 26, added critical information infrastructure (CII) provisions, and reorganised cybercrime offences, but civil-society groups noted it preserved many of the DSA's speech-suppression mechanisms under new numbering.

Security researcher Viktor Markopoulos discovered that an unsecured Bangladesh government website had inadvertently exposed names, addresses, phone numbers, and national ID numbers of over 50 million citizens, data indexable via Google. The government took the records offline by 10 July 2023, but leaked NID data subsequently circulated on Telegram channels. The incident became the single strongest political catalyst for dedicated data-protection legislation.

The ICT Division published the first publicly circulated working draft of a standalone Data Protection Bill (Version 13, dated 16 July 2022), launching formal civil-society and expert consultation. The draft proposed a Data Protection Office, cross-border transfer restrictions, and consent requirements, Bangladesh's first structured attempt to create a GDPR-influenced data-privacy framework.

Gazetted on 8 October 2018 as Act No. 46/2018, the DSA was Bangladesh's dominant digital-security law for five years. Section 26 introduced the country's first statutory data-protection provision: collecting, storing, selling, supplying, or using anyone's 'identity information' without their explicit consent was criminalised. The Act was simultaneously condemned for enabling suppression of online speech through vague criminal provisions, driving its eventual repeal in 2023.

A 2013 amendment to the ICT Act increased the maximum sentence under Section 57 (publishing 'fake, obscene or defamatory' digital content) from 10 to 14 years and eliminated the need for arrest warrants or prior prosecutorial permission. While not a data-protection measure per se, the amendment established the template of broad governmental authority over citizens' digital information that shaped all subsequent privacy and cybercrime debates.

Bangladesh's RTI Act came into force on 1 July 2009, guaranteeing citizens access to government-held information. Sections 7(h), 7(i), and 7(r) carved out exemptions protecting personal privacy, the first statutory recognition of a privacy interest in state-held data. The Act's supremacy clause (Section 3) now creates legal tension with the PDPO 2025, which asserts its own precedence over all existing laws.