Bangladesh Personal Data Protection Act, 2026

Prepared by Shubhank Suman · Last reviewed 20 September 2026

CURRENT / IN FORCE (deemed from 6 November 2025; ss. 23 and 31–35 commence later by notification)

Legal character: Statute
Region: Asia-Pacific
Enacted: 10 April 2026

What it covers

The Act (published in Bengali) is Bangladesh's comprehensive data-protection law. It replaces the 2025 Personal Data Protection Ordinance and its 2026 amendment. It applies to citizens, residents and visitors in Bangladesh, to processing inside Bangladesh, and to processing outside Bangladesh connected with offering goods or services to, or monitoring, people in Bangladesh. It uses the terms data fiduciary (data trustee) and processor, defines categories such as financial data, and regulates lawful processing, data-principal rights, cross-border transfers and penalties.

Why it matters

It brings Bangladesh into the group of jurisdictions with an extraterritorial, GDPR-style data-protection statute, relevant to any business serving or monitoring people in Bangladesh.

Refer to it when

Use it when processing personal data of people in Bangladesh, offering services into Bangladesh, transferring ID, biometric, genetic or criminal-record data abroad, or assessing penalties and the staged commencement of enforcement provisions.

AI, privacy and cybersecurity relevance

AI: Low
Privacy: Very High
Cyber: Moderate

LOW RELEVANCE

No AI-specific regime; applies to AI systems only where they process personal data.

Privacy

VERY HIGH RELEVANCE

Core comprehensive data-protection statute for Bangladesh.

Cybersecurity

MODERATE RELEVANCE

Includes data-security and transfer-control duties.

Applicability

Data fiduciaries and processors processing personal data in Bangladesh or about people in Bangladesh, including from abroad.

Current validity

CURRENT. Deemed in force from 6 November 2025; complaints and penalty sections (ss. 23, 31–35) await Government notification. The supplied text is in Bengali. Read the official PDF on this page for the operative text.

Read first

Section 1 (scope and commencement) → Section 2 (definitions) → processing and rights provisions → cross-border transfer rules → penalties (ss. 31–35).

Provisions / sections covered

Section 1 – Title, scope and commencement

Sets the extraterritorial scope and the commencement scheme: the Act is deemed in force from 6 November 2025, except sections 23 and 31–35, which start on a date the Government notifies after an 18-month period.

Section 2 – Definitions

Defines personal data, financial data, data fiduciary (data trustee), processor and related terms.

Cross-border transfers

Large-scale transfers abroad of national ID numbers, biometric, genetic or criminal-record data must be reported to the national data authority.

Penalties

Fines up to 25 lakh taka, rising to 50 lakh taka for significant data fiduciaries.

Subject-matter tags

Lawful basis
Cross-border transfers
Controller and processor
Biometrics
Enforcement and penalties
Surveillance

Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.

Document page in the Knowledge Base - full text or PDF where it is available for this record.

This library locates primary and official sources. It does not interpret the law and it is not legal advice.