Compare countries

Two or three countries, side by side, one row per question. Pick up to 3.

Countries

BangladeshChecked 18 August 2026

Depends on your industryWork: MediumEnforcement: Dormant

In one paragraph: Bangladesh passed a full privacy law in April 2026 and backdated it to November 2025. On paper you may send personal data abroad if the person agrees or a contract needs it. In practice nobody is policing this: the regulator named in the law has not been set up, and the sections that create complaints and fines have not started. The real walls are in banking and payments, where customer data must stay on servers in Bangladesh.
The catch: The relaxed general picture stops the moment you touch banking, finance companies or payment services. There, customer data must sit on locally hosted servers or a private cloud, and nothing may leave the country without the central bank's prior written approval. Government bodies also sit under a separate law that lets the state order their data into a national repository.
Does this apply to me?: Yes. The law reaches a company with no office and no staff in Bangladesh. It applies if you handle the data of people who live, work or are temporarily staying in Bangladesh, and it applies to processing done abroad when it is tied to selling goods or services to people in Bangladesh, or to watching or profiling them. There is no size or money threshold, so a small foreign start-up is caught on the same terms as a large group. There is no general duty to appoint a local representative yet.High confidence
Can the data leave the country?: It depends on your industry. Under the general privacy law personal data may go abroad if the person consented, or if it is needed for a contract that person is party to, or for their own business, study or migration matters. But the same section says data may only go to places or countries that the regulator has approved as having the right protective technology, and that approved list does not exist yet. Banking, finance companies and payment providers are the hard wall: their customer data must stay on servers in Bangladesh.Medium confidence
What do I have to do to send it abroad?: The model is an approved-destination list, and the list is empty. Before data leaves you need one of three things: the person's consent, a contract they are party to, or their consent for business, study or migration matters. On top of that the law only allows transfers to places the regulator has approved, and no approvals have been issued. If you are moving large volumes of identity numbers, fingerprints, face or iris data, DNA or criminal records, you must tell the regulator first.Medium confidence
Who enforces this — and are they actually working?: On paper the enforcer is the National Data Management Authority, a body attached to the Prime Minister's Office. It is not running. The law that creates it says the government must appoint an executive chairman and six members by official notice, and we found no sign that has happened - it is not on the Prime Minister's Office list of attached offices. The privacy fines cannot be issued yet anyway, because those sections have not started. By contrast the cyber security agency and the central bank are both working and issuing instructions.Medium confidence
How long must I keep it, and when must I delete it?: There is a floor and a ceiling, and the ceiling is blank. The floor: an organisation must keep a register of its personal data processing for at least five years, and mobile financial services must keep customer identity and transaction records for at least six years. The ceiling: the privacy law says you must not keep personal data longer than the period set by regulations, but no regulations have been made, so there is no fixed deletion date yet. Where two rules clash, the specific one wins - the five-year rule applies only when no other law says otherwise.High confidence
What happens when something goes wrong?: There are at least two clocks and neither is expressed in hours. Under the privacy law you must tell the regulator about a personal data breach that could seriously harm someone, but the form, method and timing are left to regulations that do not exist yet. Under the cyber security law any government, private or self-governing organisation that suffers a cyber incident must tell the national computer emergency response team without delay. Banks and payment firms have a third clock: they report to Bangladesh Bank and to the government computer incident response team under the central bank's framework.High confidence
What's the trap?: Five things bite. One: the law was backdated - it counts as being in force from 6 November 2025, months before it was printed in April 2026. Two: a 'data subject' includes dead people, so the duties do not end when a customer dies. Three: a child is anyone under 18 and a parent's consent covers them until their eighteenth birthday. Four: named directors, managing directors, officers and even ordinary employees can be fined personally. Five: banks, finance companies and payment providers must keep customer data on servers in Bangladesh.High confidence
What's about to change?: Three dated things. The privacy law's enforcement machinery - complaints, fines, compensation and the Chief Data Officer duty - starts on a date the government picks, and cannot start before about 10 October 2027. Banks must comply with the central bank's new cybersecurity framework by 31 December 2026. A further amendment to the cyber security law was with a cabinet committee in July 2026. The bigger risk is the switches the government can already flip without asking anyone.Medium confidence
Hardest industry wall: Finance — Guidelines on Electronic Know-Your-Customer (e-KYC)
Banking — Guidelines on Cloud Computing

AlgeriaChecked 18 August 2026

Yes, with paperworkWork: HighEnforcement: Waking up

In one paragraph: Data can leave Algeria, but not freely. Every transfer abroad needs the national data protection authority's permission unless a listed exception applies, and breaking that rule is a crime carrying prison. Since July 2025 every organisation must have a data protection officer, a processing register and an automatic log of every operation. The regulator is staffed but has issued no known decisions.
The catch: The national rule is already strict, and three areas are stricter still. Online shops must run their site on servers inside Algeria under a .com.dz address. Electronic trust services, such as digital signatures and electronic identity, must host all the data they collect inside Algeria. Public bodies must exchange data only over a state-run network that is deliberately kept separate from the internet. Banking, insurance and securities have no storage rule that we could find, but the central bank's own website could not be reached, so treat that as unchecked rather than settled.
Does this apply to me?: Yes, it can reach a company with no office in Algeria, but the trigger is equipment, not customers. You are covered if you are set up in Algeria, or if you use any means of processing located in Algeria, such as servers or devices. In that second case you must tell the regulator the name of a representative based in Algeria, and that person takes on your rights and duties. There is no size or revenue threshold to fall below.High confidence
Can the data leave the country?: Yes, with permission or a listed excuse. The starting rule is that you may only send personal data to another country if the national data protection authority allows it and that country protects privacy well enough. There is a short list of exceptions that most businesses will rely on instead, such as the person's express consent or a transfer that is needed to carry out their contract. Two things are banned outright: transfers that could harm public safety or the state's vital interests, and any processing of sensitive data such as health, religion, politics or trade union membership unless a narrow exception applies.High confidence
What do I have to do to send it abroad?: The model is case by case. Before data goes abroad you need the national data protection authority to authorise it, and the destination country must protect privacy well enough in the authority's judgement. There is no published list of approved countries and no official standard contract you can sign instead. In practice most companies rely on the written exceptions: the person's express consent, a transfer needed for their contract, a court claim, saving someone's life, an important public interest, an international mutual legal assistance request, medical care, or a treaty Algeria has signed.High confidence
Who enforces this — and are they actually working?: The national data protection authority, and it does exist in real life. Fifteen members, including a president, were appointed by presidential decree on 18 May 2022 for five years, a new president was appointed in October 2023, and the authority has its own staff, pay scales, an executive secretariat, an official bulletin and internal committees. Its president was still signing published decisions in August 2025. What is missing is enforcement: in four years the official gazette shows only housekeeping texts from the authority, and no fine, order or filing procedure. Treat it as awake but not yet biting.High confidence
How long must I keep it, and when must I delete it?: There is a floor and a ceiling, and the floor is the one people miss. Accounting books and the paperwork behind them must be kept for ten years after the end of each financial year. Telephone and internet providers must keep the data that identifies users and their connections for one year. Online sellers must keep records of every transaction and send them to the national trade register centre. The ceiling is that personal data must not be kept in a form that identifies people for longer than the purpose needs, and keeping it too long is a crime.High confidence
What happens when something goes wrong?: There is no seventy-two hour clock here, and the five-day deadline people quote is not for ordinary businesses. If you provide a service over a public electronic communications network and data is destroyed, lost, altered, disclosed or accessed without permission, you must warn the authority and the affected person straight away, with no fixed number of hours. Failing to do that is a crime punishable by one to three years in prison. The five-day deadline added in July 2025 applies to police, prosecutors, courts and prison services, not to a normal company.High confidence
What's the trap?: Five things that cost people their weekend. One: this is a criminal regime. Sending data abroad in breach of the rule is punished by one to five years in prison and a fine of up to one million dinars, roughly seven thousand seven hundred US dollars, and prison can attach to individuals. Two: since 24 July 2025 every organisation must appoint a data protection officer, keep a written register of processing and keep an automatic log recording every collection, consultation, disclosure and deletion, with no exemption for small companies. Three: sensitive data is banned by default, and consent must be express, so silence or a pre-ticked box is worth nothing. Four: anything to do with national defence and security now sits completely outside the law, so there is no privacy protection to point to there. Five: a 2021 ordinance makes it a crime to disclose classified administrative documents, it reaches acts committed outside Algeria against the Algerian state, and it can force any person to hand over stored data.High confidence
What's about to change?: Three things to watch in the next twelve months. The five-year terms of the data protection authority's members, appointed on 18 May 2022, run out in May 2027, so appointments are due. The regional inspection and audit units created for the authority in July 2025 still need an implementing regulation before inspectors can appear at your door. And the rules that switch on the new government data framework, two reference documents on classifying data and cataloguing data sources, can be published by a single decision of the High Commission for Digitalisation, at which point every public body and every company running a public service must classify and catalogue its data.High confidence
Hardest industry wall: Telecoms — Loi n° 26-02 fixant les regles generales relatives aux services de confiance pour les transactions electroniques et a l'identification electronique
E-commerce — Loi n° 18-05 relative au commerce electronique
Government — Decret presidentiel n° 25-320 portant mise en place d'un dispositif national de gouvernance des donnees

The same eight topics answered for each selected country
Question	BangladeshChecked 18 August 2026	AlgeriaChecked 18 August 2026
The three ratings	Depends on your industry Work: Medium Enforcement: Dormant	Yes, with paperwork Work: High Enforcement: Waking up
In one paragraph	Bangladesh passed a full privacy law in April 2026 and backdated it to November 2025. On paper you may send personal data abroad if the person agrees or a contract needs it. In practice nobody is policing this: the regulator named in the law has not been set up, and the sections that create complaints and fines have not started. The real walls are in banking and payments, where customer data must stay on servers in Bangladesh.	Data can leave Algeria, but not freely. Every transfer abroad needs the national data protection authority's permission unless a listed exception applies, and breaking that rule is a crime carrying prison. Since July 2025 every organisation must have a data protection officer, a processing register and an automatic log of every operation. The regulator is staffed but has issued no known decisions.
The catch	The relaxed general picture stops the moment you touch banking, finance companies or payment services. There, customer data must sit on locally hosted servers or a private cloud, and nothing may leave the country without the central bank's prior written approval. Government bodies also sit under a separate law that lets the state order their data into a national repository.	The national rule is already strict, and three areas are stricter still. Online shops must run their site on servers inside Algeria under a .com.dz address. Electronic trust services, such as digital signatures and electronic identity, must host all the data they collect inside Algeria. Public bodies must exchange data only over a state-run network that is deliberately kept separate from the internet. Banking, insurance and securities have no storage rule that we could find, but the central bank's own website could not be reached, so treat that as unchecked rather than settled.
Does this apply to me?	Yes. The law reaches a company with no office and no staff in Bangladesh. It applies if you handle the data of people who live, work or are temporarily staying in Bangladesh, and it applies to processing done abroad when it is tied to selling goods or services to people in Bangladesh, or to watching or profiling them. There is no size or money threshold, so a small foreign start-up is caught on the same terms as a large group. There is no general duty to appoint a local representative yet.High confidence	Yes, it can reach a company with no office in Algeria, but the trigger is equipment, not customers. You are covered if you are set up in Algeria, or if you use any means of processing located in Algeria, such as servers or devices. In that second case you must tell the regulator the name of a representative based in Algeria, and that person takes on your rights and duties. There is no size or revenue threshold to fall below.High confidence
Can the data leave the country?	It depends on your industry. Under the general privacy law personal data may go abroad if the person consented, or if it is needed for a contract that person is party to, or for their own business, study or migration matters. But the same section says data may only go to places or countries that the regulator has approved as having the right protective technology, and that approved list does not exist yet. Banking, finance companies and payment providers are the hard wall: their customer data must stay on servers in Bangladesh.Medium confidence	Yes, with permission or a listed excuse. The starting rule is that you may only send personal data to another country if the national data protection authority allows it and that country protects privacy well enough. There is a short list of exceptions that most businesses will rely on instead, such as the person's express consent or a transfer that is needed to carry out their contract. Two things are banned outright: transfers that could harm public safety or the state's vital interests, and any processing of sensitive data such as health, religion, politics or trade union membership unless a narrow exception applies.High confidence
What do I have to do to send it abroad?	The model is an approved-destination list, and the list is empty. Before data leaves you need one of three things: the person's consent, a contract they are party to, or their consent for business, study or migration matters. On top of that the law only allows transfers to places the regulator has approved, and no approvals have been issued. If you are moving large volumes of identity numbers, fingerprints, face or iris data, DNA or criminal records, you must tell the regulator first.Medium confidence	The model is case by case. Before data goes abroad you need the national data protection authority to authorise it, and the destination country must protect privacy well enough in the authority's judgement. There is no published list of approved countries and no official standard contract you can sign instead. In practice most companies rely on the written exceptions: the person's express consent, a transfer needed for their contract, a court claim, saving someone's life, an important public interest, an international mutual legal assistance request, medical care, or a treaty Algeria has signed.High confidence
Who enforces this — and are they actually working?	On paper the enforcer is the National Data Management Authority, a body attached to the Prime Minister's Office. It is not running. The law that creates it says the government must appoint an executive chairman and six members by official notice, and we found no sign that has happened - it is not on the Prime Minister's Office list of attached offices. The privacy fines cannot be issued yet anyway, because those sections have not started. By contrast the cyber security agency and the central bank are both working and issuing instructions.Medium confidence	The national data protection authority, and it does exist in real life. Fifteen members, including a president, were appointed by presidential decree on 18 May 2022 for five years, a new president was appointed in October 2023, and the authority has its own staff, pay scales, an executive secretariat, an official bulletin and internal committees. Its president was still signing published decisions in August 2025. What is missing is enforcement: in four years the official gazette shows only housekeeping texts from the authority, and no fine, order or filing procedure. Treat it as awake but not yet biting.High confidence
How long must I keep it, and when must I delete it?	There is a floor and a ceiling, and the ceiling is blank. The floor: an organisation must keep a register of its personal data processing for at least five years, and mobile financial services must keep customer identity and transaction records for at least six years. The ceiling: the privacy law says you must not keep personal data longer than the period set by regulations, but no regulations have been made, so there is no fixed deletion date yet. Where two rules clash, the specific one wins - the five-year rule applies only when no other law says otherwise.High confidence	There is a floor and a ceiling, and the floor is the one people miss. Accounting books and the paperwork behind them must be kept for ten years after the end of each financial year. Telephone and internet providers must keep the data that identifies users and their connections for one year. Online sellers must keep records of every transaction and send them to the national trade register centre. The ceiling is that personal data must not be kept in a form that identifies people for longer than the purpose needs, and keeping it too long is a crime.High confidence
What happens when something goes wrong?	There are at least two clocks and neither is expressed in hours. Under the privacy law you must tell the regulator about a personal data breach that could seriously harm someone, but the form, method and timing are left to regulations that do not exist yet. Under the cyber security law any government, private or self-governing organisation that suffers a cyber incident must tell the national computer emergency response team without delay. Banks and payment firms have a third clock: they report to Bangladesh Bank and to the government computer incident response team under the central bank's framework.High confidence	There is no seventy-two hour clock here, and the five-day deadline people quote is not for ordinary businesses. If you provide a service over a public electronic communications network and data is destroyed, lost, altered, disclosed or accessed without permission, you must warn the authority and the affected person straight away, with no fixed number of hours. Failing to do that is a crime punishable by one to three years in prison. The five-day deadline added in July 2025 applies to police, prosecutors, courts and prison services, not to a normal company.High confidence
What's the trap?	Five things bite. One: the law was backdated - it counts as being in force from 6 November 2025, months before it was printed in April 2026. Two: a 'data subject' includes dead people, so the duties do not end when a customer dies. Three: a child is anyone under 18 and a parent's consent covers them until their eighteenth birthday. Four: named directors, managing directors, officers and even ordinary employees can be fined personally. Five: banks, finance companies and payment providers must keep customer data on servers in Bangladesh.High confidence	Five things that cost people their weekend. One: this is a criminal regime. Sending data abroad in breach of the rule is punished by one to five years in prison and a fine of up to one million dinars, roughly seven thousand seven hundred US dollars, and prison can attach to individuals. Two: since 24 July 2025 every organisation must appoint a data protection officer, keep a written register of processing and keep an automatic log recording every collection, consultation, disclosure and deletion, with no exemption for small companies. Three: sensitive data is banned by default, and consent must be express, so silence or a pre-ticked box is worth nothing. Four: anything to do with national defence and security now sits completely outside the law, so there is no privacy protection to point to there. Five: a 2021 ordinance makes it a crime to disclose classified administrative documents, it reaches acts committed outside Algeria against the Algerian state, and it can force any person to hand over stored data.High confidence
What's about to change?	Three dated things. The privacy law's enforcement machinery - complaints, fines, compensation and the Chief Data Officer duty - starts on a date the government picks, and cannot start before about 10 October 2027. Banks must comply with the central bank's new cybersecurity framework by 31 December 2026. A further amendment to the cyber security law was with a cabinet committee in July 2026. The bigger risk is the switches the government can already flip without asking anyone.Medium confidence	Three things to watch in the next twelve months. The five-year terms of the data protection authority's members, appointed on 18 May 2022, run out in May 2027, so appointments are due. The regional inspection and audit units created for the authority in July 2025 still need an implementing regulation before inspectors can appear at your door. And the rules that switch on the new government data framework, two reference documents on classifying data and cataloguing data sources, can be published by a single decision of the High Commission for Digitalisation, at which point every public body and every company running a public service must classify and catalogue its data.High confidence
Hardest industry wall	Finance — Guidelines on Electronic Know-Your-Customer (e-KYC) Banking — Guidelines on Cloud Computing	Telecoms — Loi n° 26-02 fixant les regles generales relatives aux services de confiance pour les transactions electroniques et a l'identification electronique E-commerce — Loi n° 18-05 relative au commerce electronique Government — Decret presidentiel n° 25-320 portant mise en place d'un dispositif national de gouvernance des donnees