Cybersecurity law & regulation in Bangladesh (2026)
Cybersecurity in Bangladesh: comprehensive law.
Bangladesh enacted the Cyber Security Ordinance, 2025, gazetted on 21 May 2025, repealing the Cyber Security Act, 2023 (which had itself replaced the Digital Security Act, 2018). The Ordinance constitutes a comprehensive statutory framework covering critical information infrastructure (CII) protection, cybercrime offences, incident response, and institutional governance under a newly structured NCSA. Civil-society concerns persist over vague definitions and residual speech-restricting provisions, but the law is in force and operative.
Legal framework
Cyber Security Ordinance, 2025 (Ordinance No. 25 of 2025), administered by the National Cyber Security Agency (NCSA) under a National Cyber Security Council (NCSC); operational response by BGD e-GOV CIRT
Key points: cybersecurity in Bangladesh
Legislative History
Bangladesh's cybersecurity law evolved from the Digital Security Act 2018 to the Cyber Security Act 2023 (Act No. 46 of 2023, passed 13 September 2023), and most recently to the Cyber Security Ordinance 2025, gazetted 21 May 2025 by the interim government. Each iteration replaced the prior law in full.
National Cyber Security Agency (NCSA)
The Ordinance establishes the NCSA as the primary regulatory authority empowered to designate Critical Information Infrastructure, issue mandatory security directions, conduct audits, prescribe technical standards, and coordinate with law enforcement. The apex policy body is the National Cyber Security Council (NCSC), which approves national cybersecurity policy and reviews NCSA performance.
Critical Information Infrastructure (CII)
The government retains sole authority to designate CII sectors (energy, banking, government systems, etc.). CII operators must deploy mandated security controls, localize sensitive data domestically, and establish security operations capabilities. Warrantless search, seizure, and arrest powers apply to CII-related cyber incidents.
Incident Reporting & BGD e-GOV CIRT
BGD e-GOV CIRT (Bangladesh Government Computer Incident Response Team) serves as the national operational incident response body; organizations are directed to report indicators of compromise and suspicious activity to BGD e-GOV CIRT/NCSA. The Ordinance mandates incident response protocols and emergency procedures, including digital forensics coordination.
Offences & Penalties
The Ordinance criminalises unauthorised access, hacking, cyberterrorism, cyber fraud, e-transaction crimes, incitement of religious/ethnic hatred, sexual harassment, blackmail, and online obscenity, with graded penalties. The 2025 reform made many offences (cyber fraud, sexual harassment, blackmail) bailable and removed 9 sections of its predecessor dealing with speech-based offences (defamation, 'offensive' content, false information).
Digital Rights & Ongoing Concerns
The 2025 Ordinance explicitly recognises internet access as a citizen's right, a first for Bangladesh. However, Article 19, Human Rights Watch, and local civil-society groups have flagged that vague and undefined terms in the Ordinance still risk chilling free expression and press freedom, and called for further revision.
Timeline of decisions
- LawCyber Protection Ordinance 2025 Gazetted, First South Asian Law to Reference AI-Facilitated Cybercrimes
The interim government gazetted the Cyber Protection Ordinance 2025, replacing the Cyber Security Act 2023. It is the first legal instrument in South Asia to explicitly name AI as a vector for cyberoffences, covering deepfakes, AI-generated disinformation, and autonomous hacking, and also introduces a legally recognized right to internet access; critics note it lacks a functional definition of AI and enforceable ethical safeguards.
The Daily Star
- Law · officialCyber Security Ordinance 2025 Promulgated, Replacing CSA 2023
The interim government gazetted Ordinance No. 25 of 2025, repealing the Cyber Security Act 2023 and dropping nine contentious provisions inherited from the Digital Security Act 2018. The ordinance is the first South Asian law to criminalise AI-facilitated offences explicitly, recognises internet access as a civic right, and grants BGD e-GOV CIRT statutory authority as the national CERT.
Bangladesh Government Press (Official Extraordinary Gazette)
- Decision · officialITU Global Cybersecurity Index 2024 Designates Bangladesh Tier 1
The ITU's 5th edition of the Global Cybersecurity Index placed Bangladesh in Tier 1 (Role Model) with a score of 96.96, citing capacity development and technical measures as areas of strength. The classification provided international validation of the country's cybersecurity institutional build-out, though the index evaluates the existence rather than quality of measures.
ITU (International Telecommunication Union)
- Law · officialCyber Security Act 2023 Enacted (Act No. 46 of 2023), Replacing Digital Security Act 2018
The Jatiya Sangsad passed the Cyber Security Act 2023, establishing a national Cyber Security Agency with investigatory and directive powers over public and private entities and designating Critical Information Infrastructure relevant to AI-driven public services; it removed some (but not all) speech-restriction provisions from the DSA 2018, drawing continued criticism from civil-society groups.
Bangladesh Legislative Division
- Law · officialCyber Security Act 2023 Enacted, Repealing Digital Security Act 2018
Passed by Parliament on 13 September 2023, the Cyber Security Act (Act No. 46/2023) replaced the widely criticised Digital Security Act 2018. It retained the consent-based identity-information protection from DSA Section 26, added critical information infrastructure (CII) provisions, and reorganised cybercrime offences, but civil-society groups noted it preserved many of the DSA's speech-suppression mechanisms under new numbering.
Legislative Division, Ministry of Law, Justice and Parliamentary Affairs, Bangladesh
- Law · officialCyber Security Act 2023 Passed, Replacing Digital Security Act 2018
Parliament passed a new law replacing the Digital Security Act 2018, reducing some prison terms for defamation-related offences and removing non-bailable provisions, but preserving most substantive prohibitions. Civil-society organisations criticised it as a cosmetic rebrand; the law was repealed less than two years later by the Cyber Security Ordinance 2025.
Laws of Bangladesh (Ministry of Law, Justice and Parliamentary Affairs)
- IncidentGovernment Website Exposes Personal Data of ~50 Million Citizens
Security researcher Viktor Markopoulos discovered that a Bangladesh Registration Office government website leaked names, addresses, phone numbers, and national ID numbers of tens of millions of citizens through a misconfigured API, not an active intrusion. The site was taken down on 10 July 2023 after TechCrunch reported it; leaked NID data subsequently circulated on Telegram, exposing persistent gaps in public-sector data governance.
TechCrunch
- Guidance · officialNational Cybersecurity Strategy 2021-2025 Adopted
BGD e-GOV CIRT published Bangladesh's first structured national cybersecurity strategy, built on four pillars, Digital Government, Human Resource Development, IT Industry Promotion, and Connectivity & Infrastructure, with 28 activities across 10 strategic themes. The strategy provided the coordinating framework for aligning all government ministries and agencies on cybersecurity responsibilities.
BGD e-GOV CIRT (Bangladesh Computer Council)
- Law · officialDigital Security Act 2018 Gazetted (Act No. 46 of 2018)
The president signed the Digital Security Act into law, creating broad criminal offences for online content deemed defamatory, anti-state, or religiously offensive, with penalties up to life imprisonment for attacks on liberation-war ideology. The law absorbed and expanded Section 57 of the ICT Act and was widely condemned by journalists, the UN OHCHR, and civil-society groups for enabling political and press-freedom prosecutions.
Laws of Bangladesh (Ministry of Law, Justice and Parliamentary Affairs)
- IncidentBangladesh Bank SWIFT Heist, $81 Million Stolen by North Korean Hackers
Actors later attributed by CISA to North Korea's Reconnaissance General Bureau (BeagleBoyz) used malware to impersonate Bangladesh Bank on the SWIFT messaging network, issuing 35 fraudulent transfer instructions totalling ~$1 billion to the Federal Reserve Bank of New York; $101M was transferred before a spelling error triggered a hold. $81M reached the Philippines and was largely laundered through casinos, making this the largest cyber-enabled central-bank theft on record and prompting SWIFT-wide security reforms.
Wikipedia (aggregating Bangladesh Bank, FBI, and SWIFT official statements)
- Decision · officialBGD e-GOV CIRT Begins Operations as National CERT
The Bangladesh Computer Council activated the e-Government Computer Incident Response Team under the LICT (Leveraging ICT for Growth, Employment and Governance) project; the Bank heist occurring the same month catalysed its formal government mandate and resourcing. BGD e-GOV CIRT subsequently gained full FIRST membership, establishing Bangladesh's first institutionalised cyber-incident response capability.
BGD e-GOV CIRT (Bangladesh Computer Council)
- Law · officialInformation and Communication Technology Act 2006 Enacted, Foundational Internet Law
Bangladesh's Parliament passed the ICT Act 2006, establishing the country's first comprehensive legal framework for electronic commerce, digital signatures, and cybercrime. Section 57 of the Act broadly criminalised electronic publications deemed 'offensive', 'defamatory', or likely to 'prejudice the image of the state', creating cyber tribunals as the adjudicating forum. The Act, and especially Section 57, formed the legal basis for all subsequent internet content enforcement until its provisions were carried over into the Digital Security Act 2018.
Laws of Bangladesh (Ministry of Law, Justice and Parliamentary Affairs)
Sources
- tbsnews.net/bangladesh/govt-issues-gazette-cyber-security-ordinance-1149021
- dhakatribune.com/bangladesh/381943/govt-issues-gazette-of-cyber-security-ordinance
- en.wikipedia.org/wiki/Cyber_Security_Act,_2023
- papers.ssrn.com/sol3/papers.cfm?abstract_id=5424414
- cirt.gov.bd/
- mondaq.com/new-technology/1659100/cyber-security-ordinance-2025-implications-for
- article19.org/resources/bangladesh-draft-cyber-protection-ordinance/
- hrw.org/news/2025/02/25/joint-statement-emerging-digital-laws-bangladesh
- en.wikipedia.org/wiki/Cyber_Security_Agency_(Bangladesh)
- rsisinternational.org/journals/ijriss/articles/cyber-security-governance-under-the-cyber-la
- cirt.gov.bd/alerts/cii-energy-banks-2025-07
- tbsnews.net/bangladesh/govt-approves-cyber-security-ordinance-2025-repeals-9-sect
- dhakatribune.com/bangladesh/government-affairs/391881/cyber-law-2025-online-gamblers-t
- techglobalinstitute.com/announcements/press-release/joint-statement-cyber-security-ordinance-
Next for Bangladesh: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026