Bangladesh

Personal Data Protection Act 2026 (Act No. 63 of 2026), section 1(2)(a)-(c) and section 4(2)-(3). Section 4 says a breach committed from outside Bangladesh into Bangladesh is treated as if the whole thing happened in Bangladesh. The same applies to a breach committed from inside Bangladesh out to another country. The only duty to have someone in the country is section 23. An organisation that the government names a major data handler must appoint one or more Chief Data Officers. They work at a location the Authority decides. Section 23 has not started. It begins on a date the government sets by notification, and not before 18 months after the Act was issued on 10 April 2026. There is no registration or licence step for ordinary organisations.

Personal Data Protection Act 2026, section 29. Section 29(3) sets the three routes: consent; a contract the person is party to; and consent-based business, education, emigration or immigration matters. Section 29(4) then limits transfers to places or countries named in regulations as having suitable technology and equipment for protecting personal data. No such regulations have been published. On a strict reading, no destination is currently approved. Section 29(6) requires you to tell the Authority before a large-volume transfer abroad of 'sensitive personally identifiable data'. That means government unique identifiers (national identity card number, passport number, taxpayer number), biometric identifiers, genetic or DNA information, and criminal records. Section 30 lets the government sign data-exchange deals with one or more other countries. INDUSTRY OVERRIDES. Banking, finance companies and payment service providers: the March 2026 electronic know-your-customer Guidelines require customer data to be kept on locally hosted servers or private cloud servers. They forbid sending it outside Bangladesh without Bangladesh Bank's prior approval. The 2023 Cloud Computing Guidelines separately bar customers' financial and other sensitive data from public and hybrid cloud outside the country, except with prior Bangladesh Bank approval. Rated closed. Mobile financial services: we found no storage-location rule in the 2022 Mobile Financial Services Regulations, but a six-year record-keeping minimum applies. Rated conditional. Government and public sector: the National Data Management Act 2026 lets the Authority make scheduled bodies store their data in the national data repository system. It also lets the government restrict exchange of state-critical sensitive data by notification. Rated conditional today. That changes if those powers are used. Telecoms: we found no rule forcing data to stay in the country. The 2025 licensing policy instead makes licence holders follow the privacy law and marks critical platforms as Critical Information Infrastructure. Health, insurance, securities, education, online gaming, mapping and defence: no storage rule found, checked 18 August 2026, medium confidence.

Personal Data Protection Act 2026, section 29(3), (4) and (6). There is no standard contract template, no certification scheme and no company-wide-rules route published. The section 29(4) list of permitted destinations depends on regulations that do not exist. The complaint and fining sections have not started either. So transfers today happen in a legal grey zone rather than under a working approval system. Banks, finance companies and payment service providers have a separate route that does work. They get written prior approval from Bangladesh Bank, case by case, under the 2023 Cloud Computing Guidelines and the 2026 electronic know-your-customer Guidelines.

National Data Management Act 2026 (Act No. 80 of 2026), sections 8 and 9. The Authority is a statutory body attached to the Prime Minister's Office. The government sets it up by notification, with one executive chairman and six members. The Personal Data Protection Act 2026 defines 'the Authority' by reference to that body. Sections 31 to 35 of the privacy law cover complaints, administrative fines, how fines are set, and compensation. None of them start until a date the government fixes, and not before 18 months after 10 April 2026. Section 38 lets the government direct the Authority on grounds of sovereignty, security, friendly relations with foreign states or public order. The Authority must comply, so it is not independent. Appeals against fines go to the tribunal set up under section 68 of the Information and Communication Technology Act, within 30 days. The National Cyber Security Agency is visibly working. Its National Cyber Security Council held its first meeting on 28 December 2025, and it runs a cyber incident reporting system. Bangladesh Bank is far more active by comparison. It issued a new Cybersecurity Framework on 29 March 2026 and electronic know-your-customer guidelines on 11 March 2026, and it grants or refuses cloud approvals.

Personal Data Protection Act 2026, sections 18 and 19. Section 18 limits how long you may keep data to the period set by regulations. It makes an exception for public-interest, scientific, historical or statistical purposes while safeguards are being built. Section 19 requires you to keep a register of how you use personal data for at least five years, unless another law says otherwise. Bangladesh Mobile Financial Services Regulations 2022, section 18.1: records must be kept for not less than six years from when they arose. That covers know-your-customer and customer due diligence records. It applies to account holders and to wholesale and retail agents. It also covers records of mobile financial services transactions. Bangladesh Bank's 2026 Cybersecurity Framework requires audit logs to be kept in line with record retention requirements. It also requires a quarterly clear-out of stored sensitive data that is past its keeping period. It names no number of months.

Personal Data Protection Act 2026, section 20(1): you must tell the Authority where a personal data breach is likely to cause significant harm to the person the data is about. The form, manner and time are set by regulations. No regulations exist, and there is currently no Authority to receive the notice. Section 20 contains no express duty to tell the people affected. Cyber Security Act 2026, section 9(4) proviso: where a cyber incident happens at a government, private or autonomous body, that body must inform the national computer emergency response team without delay. Security operations centres of designated Critical Information Infrastructure must also file quarterly performance reports to the National Cyber Security Operation Centre. Critical Information Infrastructure must submit a yearly internal and external audit report. Bangladesh Bank's Cybersecurity Framework 2026 requires round-the-clock detection and response, and reporting to Bangladesh Bank and the government computer incident response team. It sets no number of hours. The 2023 Information and Communication Technology Security Guideline adds one more duty. The bank must tell Bangladesh Bank 'as soon as possible' when a critical system fails over to its disaster recovery site.

(1) Personal Data Protection Act 2026, section 1(3): except sections 23 and 31 to 35, the Act is treated as having come into force on 6 November 2025. That is the date the repealed Personal Data Protection Ordinance 2025 was made. (2) Section 2(3): the person the data is about means a natural person who is identified or identifiable, 'whether living or dead'. (3) Section 2(19) defines a child as under 18, or such age as the government sets. Section 9(3) says parental or guardian consent covers the child until 18. (4) Section 36: where someone complains against a company, the Authority may fine any board member, managing director, officer connected with management, or employee involved in the breach. (5) Bangladesh Bank electronic know-your-customer Guidelines, March 2026: 'The bank/FC/PS provider shall preserve customer data on locally hosted servers or private cloud servers'. Data collected from customers must not be sent outside Bangladesh without Bangladesh Bank's prior approval. A sixth item is worth watching. Section 29(5) lets the government charge a fee on the yearly business or commercial profit an organisation makes from using Bangladeshi citizens' personal data. Most privacy laws have nothing like it.

DATED. (1) Personal Data Protection Act 2026, section 1(3): sections 23 and 31 to 35 start on a date fixed by government notification after 18 months from the Act's issue on 10 April 2026. So 10 October 2027 at the earliest. (2) Bangladesh Bank BRPD-2 Circular 02 of 29 March 2026: compliance with the Cybersecurity Framework Version 1.0 must be ensured by 31 December 2026. (3) The Cyber Security (Amendment) Act 2026 (Act No. 99 of 2026) took effect on 1 July 2026 and deleted section 20 of the Cyber Security Act, the online gambling offence. The Information and Communication Technology Division reported a cabinet committee meeting on 15 July 2026 to review and finalise a further draft amendment. POWERS THE GOVERNMENT CAN USE AT ANY TIME. (a) National Data Management Act 2026, section 32: the Authority may make it compulsory for scheduled bodies to store their data in the national data repository system. (b) Section 31(2): the government may by notification put limits and conditions on any organisation's data sharing where state-critical sensitive data is involved. That includes anything touching sovereignty, public safety, borders or a declared emergency. (c) Personal Data Protection Act 2026, section 29(1) and (4): the government may sort personal data into public, internal, confidential and restricted tiers, and set which countries may receive data at all. (d) Section 29(5): a charge on profits made from Bangladeshis' personal data. (e) Section 38: the government may direct the regulator, and the regulator must obey. (f) Section 43: in an emergency the government or the Authority may issue an order about any use, storage, keeping or transfer of data.