Data protection & privacy law in Bangladesh (2026)

Legal framework

Personal Data Protection Ordinance, 2025 (Ordinance No. 61/2025), gazetted 6 November 2025; enforced by the National Data Governance Authority (NDGA) established under the companion National Data Governance Ordinance, 2025

Key points: data & privacy in Bangladesh

1. 01Enactment & legal force

   The Ordinance (No. 61/2025) was approved 9 October 2025 and officially gazetted by the Law, Justice and Parliamentary Affairs Ministry on 6 November 2025, replacing the earlier draft Data Protection Acts of 2022-2024 that never passed parliament. Most provisions took immediate effect; obligations requiring organisational readiness apply 18 months after gazette (~May 2027).

   en.prothomalo.com tbsnews.net thedailystar.net

2. 02Supervisory authority

   The National Data Governance Authority (NDGA), created under the companion National Data Governance Ordinance 2025 (also gazetted 6 November 2025), serves as the primary enforcement body. It registers and classifies data fiduciaries, conducts audits, issues guidelines, investigates complaints, and imposes penalties.

   en.prothomalo.com dataguidance.com

3. 03Data subject rights

   Individuals have rights to access and data portability (receive data in intelligible format), correction of inaccurate data, withdrawal of consent, and erasure under specified conditions. Citizens are legally recognised as the owners of their personal data.

   thedailystar.net juralacuity.com

4. 04Data classification & cross-border transfers

   Personal data is classified into four tiers: public/open, internal, confidential, and restricted. Confidential and restricted data must be stored within Bangladesh. Internal and confidential data may be transferred abroad only with data-subject consent or for contractual purposes and only to jurisdictions with adequate protections.

   thedailystar.net dpo-india.com

5. 05Organisational obligations

   Significant data fiduciaries must appoint a qualified Chief Data Officer responsible for regulatory liaison, reporting, and handling data-subject complaints. All controllers must implement appropriate technical and organisational security measures proportionate to data volume, sensitivity, and processing scope.

   juralacuity.com mahbub-law.com

6. 06Penalties

   Administrative fines range from 1-2% of annual turnover for general violations and 2-5% for significant data fiduciaries. Criminal penalties for serious violations can reach 5-7 years imprisonment and fines up to 20 lakh taka (~USD 18,000). Civil society has raised concerns about unchecked executive powers in the enforcement structure.

   thedailystar.net en.prothomalo.com

Timeline of decisions

1. 6 Nov 2025Law · official
   Personal Data Protection Ordinance 2025 Gazetted (Ordinance No. 61/2025)

   Bangladesh's first standalone, comprehensive data-protection law was gazetted on 6 November 2025, having been approved by the interim Council of Advisers on 9 October 2025. It recognises citizens as owners of their personal data, mandates explicit consent before any collection or processing, imposes strict rules on sensitive data and cross-border transfers, and has extra-territorial reach over foreign entities handling Bangladeshi citizens' data; most operative sections take effect 18 months after gazette.

   Bangladesh Sangbad Sangstha (BSS – official state news agency)

2. 27 Nov 2023Decision · official
   Draft Personal Data Protection Act 2023 Receives Cabinet In-Principle Approval

   The Cabinet approved in principle the proposed Personal Data Protection Act 2023 on 27 November 2023, following iterative drafts since 2022 and inter-ministerial consultations. The bill was never put to a parliamentary vote before Parliament was dissolved in August 2024, but it directly informed the content of the eventual 2025 Ordinances.

   Bangladesh Sangbad Sangstha (BSS – official state news agency)

3. 7 Jul 2023Incident
   Government Website Data Breach Exposes Personal Data of 50+ Million Bangladeshis

   Security researcher Viktor Markopoulos discovered that an unsecured Bangladesh government website had inadvertently exposed names, addresses, phone numbers, and national ID numbers of over 50 million citizens, data indexable via Google. The government took the records offline by 10 July 2023, but leaked NID data subsequently circulated on Telegram channels. The incident became the single strongest political catalyst for dedicated data-protection legislation.

   TechCrunch

4. 16 Jul 2022Guidance · official
   ICT Division Publishes First Unofficial Working Draft of Data Protection Bill

   The ICT Division published the first publicly circulated working draft of a standalone Data Protection Bill (Version 13, dated 16 July 2022), launching formal civil-society and expert consultation. The draft proposed a Data Protection Office, cross-border transfer restrictions, and consent requirements, Bangladesh's first structured attempt to create a GDPR-influenced data-privacy framework.

   ICT Division, Government of Bangladesh

5. 8 Oct 2018Law
   Digital Security Act 2018 Gazetted, First Statutory Personal-Data Consent Rule

   Gazetted on 8 October 2018 as Act No. 46/2018, the DSA was Bangladesh's dominant digital-security law for five years. Section 26 introduced the country's first statutory data-protection provision: collecting, storing, selling, supplying, or using anyone's 'identity information' without their explicit consent was criminalised. The Act was simultaneously condemned for enabling suppression of online speech through vague criminal provisions, driving its eventual repeal in 2023.

   ICNL (hosts official Parliament Act No. 46/2018 text)

Sources

1. 1.en.prothomalo.com/bangladesh/government/teeopu4dfv
2. 2.tbsnews.net/bangladesh/govt-issues-gazettes-2-landmark-ordinances-data-protection
3. 3.thedailystar.net/tech-startup/news/bangladeshs-personal-data-protection-ordinance-2025
4. 4.dpo-india.com/Resources/Privacy_Regulations_in_Asia_Pacific_Countries/Bangladesh-Pe
5. 5.dataguidance.com/news/bangladesh-data-protection-ordinance-enters-effect
6. 6.juralacuity.com/personal-data-protection-ordinance/
7. 7.en.prothomalo.com/bangladesh/ikh9acxpg5
8. 8.mahbub-law.com/key-highlights-of-the-personal-data-protection-ordinance-2025-for-bus
9. 9.bssnews.net/news-flash/330104