Bangladesh

Personal Data Protection Act 2026 (Act No. 63 of 2026), section 1(2)(a)-(c) and section 4(2)-(3). Section 4 states that a breach committed from outside Bangladesh into Bangladesh, and a breach committed from inside Bangladesh out to another country, are both treated as if the whole thing happened in Bangladesh. The only in-country personnel duty is section 23: an organisation designated a 'significant data-fiduciary' must appoint one or more Chief Data Officers, who work at a location the Authority decides. Section 23 has not commenced - it starts on a date the government sets by notification, and not before 18 months after the Act was issued on 10 April 2026. There is no registration or licence step for ordinary organisations.

Personal Data Protection Act 2026, section 29. Section 29(3) sets the three gateways (consent; a contract the data subject is party to; consent-based business, education, emigration or immigration matters). Section 29(4) then limits transfers to places or countries prescribed by regulations as having suitable technology and equipment for protecting personal data - no such regulations have been published, so on a strict reading no destination is currently approved. Section 29(6) requires mandatory notification to the Authority before a large-volume cross-border transfer of 'sensitive personally identifiable data', defined as government unique identifiers (national identity card number, passport number, taxpayer number), biometric identifiers, genetic or DNA information, and criminal records. Section 30 lets the government sign bilateral and multilateral data-exchange arrangements. SECTOR OVERRIDES. Banking, finance companies and payment service providers: the March 2026 e-KYC Guidelines require customer data to be kept on locally hosted servers or private cloud servers and forbid transmission or transfer outside Bangladesh without Bangladesh Bank's prior approval; the 2023 Cloud Computing Guidelines separately bar customers' financial and other sensitive data from cross-border public and hybrid cloud except with prior Bangladesh Bank approval - rate closed. Mobile financial services: no storage-location rule found in the 2022 MFS Regulations, but a six-year record-keeping floor applies - rate conditional. Government and public sector: the National Data Management Act 2026 lets the Authority compel scheduled bodies to store their data in the national data repository system and lets the government restrict exchange of state-critical sensitive data by notification - rate conditional today, mirror if those powers are used. Telecoms: no localisation rule found; the 2025 licensing policy instead makes licensees follow the privacy law and designates critical platforms as Critical Information Infrastructure. Health, insurance, securities, education, online gaming, mapping and defence: no sector storage rule found, checked 18 August 2026, medium confidence.

Personal Data Protection Act 2026, section 29(3), (4) and (6). There is no standard contract template, no certification scheme and no group-wide-rules route published. Because the section 29(4) list of permitted destinations depends on regulations that do not exist, and because the complaint and fining sections have not commenced, transfers today happen in a legal grey zone rather than under a working approval system. Banks, finance companies and payment service providers have a separate and operational route: written prior approval from Bangladesh Bank, case by case, under the 2023 Cloud Computing Guidelines and the 2026 e-KYC Guidelines.

National Data Management Act 2026 (Act No. 80 of 2026), sections 8 and 9: the Authority is a statutory body attached to the Prime Minister's Office, constituted by government notification with one executive chairman and six members. The Personal Data Protection Act 2026 defines 'the Authority' by reference to that body. Sections 31 to 35 of the privacy law - complaints, administrative fines, factors in setting fines, and compensation - do not commence until a date the government fixes, and not before 18 months after 10 April 2026. Section 38 lets the government direct the Authority on grounds of sovereignty, security, friendly relations with foreign states or public order, and the Authority must comply, so it is not independent. Appeals against fines go to the tribunal set up under section 68 of the Information and Communication Technology Act, within 30 days. The National Cyber Security Agency is observably operational: its National Cyber Security Council held its first meeting on 28 December 2025 and it runs a cyber incident reporting system. Bangladesh Bank is active and aggressive by comparison - it issued a new Cybersecurity Framework on 29 March 2026 and e-KYC guidelines on 11 March 2026, and it grants or refuses cloud approvals.

Personal Data Protection Act 2026, section 18 (retention limited to the period prescribed by regulations, with an exception for public-interest, scientific, historical or statistical purposes while safeguards are being built) and section 19 (records of processing to be kept in a register for at least five years, 'unless specifically stated in any other provision'). Bangladesh Mobile Financial Services Regulations 2022, section 18.1: know-your-customer and customer due diligence records for account holders, wholesale and retail agents, and records of MFS transactions, must be retained for not less than six years from origination. Bangladesh Bank's 2026 Cybersecurity Framework requires audit logs to be kept in line with record retention requirements and a quarterly process to delete stored sensitive data past its retention period, without naming a number of months.

Personal Data Protection Act 2026, section 20(1): notification to the Authority where a personal data breach is likely to cause significant harm to the data subject, in the form, manner and time prescribed by regulations. No regulations exist, and there is currently no Authority to receive the notification. There is no express duty in section 20 to notify affected individuals. Cyber Security Act 2026, section 9(4) proviso: where a cyber incident occurs at a government, private or autonomous body, that body must inform the national computer emergency response team without delay. Security operations centres of designated Critical Information Infrastructure must also file quarterly performance reports to the National Cyber Security Operation Centre, and Critical Information Infrastructure must submit an annual internal and external audit report. Bangladesh Bank's Cybersecurity Framework 2026 requires 24/7 detection and response and reporting to Bangladesh Bank and the government computer incident response team, without a stated hour count; the 2023 ICT Security Guideline requires the bank to inform Bangladesh Bank 'as soon as possible' when a critical system fails over to its disaster recovery site.

(1) Personal Data Protection Act 2026, section 1(3): except sections 23 and 31 to 35, the Act is deemed to have come into force on 6 November 2025 - the date the repealed Personal Data Protection Ordinance 2025 was made. (2) Section 2(3): 'data subject' means a natural person related to personal data who is identified or identifiable, 'whether living or dead'. (3) Section 2(19) defines a child as under 18 or such age as the government sets, and section 9(3) says parental or guardian consent covers the child until 18. (4) Section 36: where a data subject complains against a company, the Authority may impose an administrative fine on any board member, managing director, officer connected with management, or employee involved in the breach. (5) Bangladesh Bank e-KYC Guidelines, March 2026: 'The bank/FC/PS provider shall preserve customer data on locally hosted servers or private cloud servers' and data collected from customers must not be transmitted or transferred outside Bangladesh without Bangladesh Bank's prior approval. A sixth item worth watching: section 29(5) lets the government set a fee or charge on the annual business or commercial profit an organisation makes from using Bangladeshi citizens' personal data - a revenue power with no equivalent in most privacy laws.

DATED. (1) Personal Data Protection Act 2026, section 1(3): sections 23 and 31 to 35 commence on a date fixed by government notification after 18 months from the Act's issue on 10 April 2026 - so 10 October 2027 at the earliest. (2) Bangladesh Bank BRPD-2 Circular 02 of 29 March 2026: compliance with the Cybersecurity Framework Version 1.0 must be ensured by 31 December 2026. (3) The Cyber Security (Amendment) Act 2026 (Act No. 99 of 2026) took effect on 1 July 2026 and deleted section 20 of the Cyber Security Act, the online gambling offence; the ICT Division reported a cabinet committee meeting on 15 July 2026 to review and finalise a further draft amendment. DORMANT SWITCHES. (a) National Data Management Act 2026, section 32: the Authority may make it compulsory for scheduled bodies to store their data in the national data repository system. (b) Section 31(2): the government may by notification impose limits and conditions on any organisation's data interoperability and exchange where state-critical sensitive data is involved, which includes anything touching sovereignty, public safety, borders or a declared emergency. (c) Personal Data Protection Act 2026, section 29(1) and (4): the government may classify personal data into public, internal, confidential and restricted tiers and prescribe which countries may receive data at all. (d) Section 29(5): a levy on profits made from Bangladeshis' personal data. (e) Section 38: the government may direct the regulator and the regulator must obey. (f) Section 43: in an emergency the government or the Authority may issue an order about any processing, storage, retention or transfer.