Bangladesh. Comprehensive data protection. Act
PDPAPersonal Data Protection Act, 2026 (Act No. 63 of 2026; formerly Personal Data Protection Ordinance, 2025)
Partly verified
Medium confidence.Sources conflict on regulator name and phasing; official Act text not retrieved. Companion National Data Governance Ordinance 2025 (data authority, NRDEX exchange) - parliamentary status not confirmed. date_in_force reflects ordinance commencement.
§1Summary
- Synopsis
Bangladesh's first comprehensive data protection law, treating individuals as owners of their personal data and requiring explicit consent for collection, use and transfer. It grants access, correction, erasure and rights against automated decisions, protects sensitive (financial, health, genetic, biometric) data, and bans profiling and targeted advertising aimed at children.
- Key themes
- Unique features
Frames data subjects as owners and controllers as custodians; 'significant' controllers must appoint a Chief Data Officer who is the regulator's main contact.
- SaaS relevance
Reaches foreign SaaS offering products or services to people in Bangladesh or monitoring them there.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Authority where breach likely to cause significant damage; timeline set by regulations
- DPO
- Conditional
- Cross-border transfers
- Notice to authority for large-volume sensitive transfers; heightened oversight for national ID, passport, tax, biometric, genetic and criminal records data; authority can suspend transfers
- Maximum penalty
- Administrative fines up to BDT 25 lakh (BDT 50 lakh for significant controllers), plus increments for repeat violations
§3Dates
- Key dates
- Adopted
- In force
- Ordinance approved by Council of Advisers 2025-10-09, gazetted 2025-11-06 (most provisions immediate; CDO and complaints/offences sections deferred); amended by Ordinance No. 23 of 2026 (Feb 2026); re-enacted by Parliament as an Act 2026-04-09. Some provisions reportedly deferred ~18 months.
§4Text and authority
- Text
- Authoritative text bdlaws.minlaw.gov.bd
- Authority
- Data Protection Authority / National Data Governance (Management) Authority
§5Where it applies
- Domestic law of
- Bangladesh
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.Sources conflict on regulator name and phasing; official Act text not retrieved. Companion National Data Governance Ordinance 2025 (data authority, NRDEX exchange) - parliamentary status not confirmed. date_in_force reflects ordinance commencement.