Bangladesh Now Has a Data Protection Law. Read It With Article 43.

You buy a SIM card. You give a photocopy of your NID and a fingerprint. Two weeks later you start getting calls from three different insurance companies who somehow know your name, your age and your address.

Where did they get it? Who did they buy it from? And what, exactly, can you do about it?

Until very recently, the honest answer in Bangladesh was: not much. We had scattered provisions in telecom rules, banking secrecy obligations and cyber legislation — but nothing that treated your personal information as something you own and can defend.

That has changed.

The starting point: Article 43

Before the new statute, the strongest privacy protection in Bangladesh was a single line in the Constitution.

Article 43 says that every citizen shall have the right, subject to any reasonable restrictions imposed by law in the interests of the security of the State, public order, public morality or public health —

(a) to be secured in his home against entry, search and seizure; and

(b) to the privacy of his correspondence and other means of communication.

Read it slowly, because three things in that sentence matter enormously.

First, it is a right of "every citizen." Not every person. A foreign national working in Dhaka does not obviously get it.

Second, it is a fundamental right. Fundamental rights under Part III of the Constitution are, as a general rule, enforceable against the State — not against your neighbour, and not against a private company. If a mobile operator sells your call records, Article 43 is not naturally the weapon you reach for. You would need to show that the operator is a statutory public authority or is performing a public function before you could bring it into writ jurisdiction under Article 102.

Third, it is subject to "reasonable restrictions." The State can lawfully intrude on your correspondence, provided it does so by law and for one of the four listed purposes. The word doing all the work there is reasonable. A restriction that is arbitrary, excessive or has no real connection to the stated purpose is not reasonable, and a law imposing it can be challenged as void under Article 26.

So Article 43 gives us a strong idea — privacy is constitutionally protected — with a narrow reach. It protects citizens, mostly against the State, and mostly in the classic settings of the home and the letter.

That is the gap the new statute fills.

What was enacted, and when

The road was long. A draft data protection law was approved in cabinet in late 2023 and then revised repeatedly. On 6 November 2025 the President promulgated the Personal Data Protection Ordinance, 2025. That Ordinance was amended on 5 February 2026, and in April 2026 Parliament repealed the Ordinance and passed the permanent Personal Data Protection Act, 2026 (Act 63 of 2026).

The February amendment was significant on its own. It tightened data residency: where data falls into a restricted category or is processed by critical information infrastructure, at least one synchronised real-time copy must be kept inside Bangladesh. Commentary at the time also noted a shift away from imprisonment of company officers towards financial penalties on the organisation — closer to the European approach than to our usual instinct of criminalising everything.

Who the Act binds

The Act does not only cover companies sitting in Dhaka.

It applies to processing that happens inside Bangladesh. It also applies outside Bangladesh where the processing relates to offering products or services to people located in Bangladesh, or to monitoring them. Data merely passing through the country in transit is excluded.

In practice, that means a foreign app with Bangladeshi users is within scope. This is the same extraterritorial design the EU adopted, and it is why global platforms end up complying with laws of countries they have no office in.

The vocabulary you have to learn

You cannot argue this statute without its vocabulary. Four terms carry most of the load:

Data subject — the natural person the data is about. Note something unusual: the definition extends to individuals whether identified or identifiable, and whether living or dead.

Data fiduciary — the person who processes personal data for a purpose, supervises that processing, or authorises someone else to do it. Think of this as the entity that decides why and how.

Data processor — the entity that processes on the fiduciary's behalf, under a contract. Critically, processing done by a processor is deemed to have been done by the controller. So outsourcing does not outsource liability.

Processing — almost anything you can do with data: collecting, recording, storing, retrieving, using, altering, transferring, disclosing, restricting, erasing.

And then consent, which the Act defines as a clear, explicit, specific and freely given positive indication of agreement. A pre-ticked box is not consent. Burying permission in a twelve-page terms document is not consent.

What organisations now have to do

The core obligations will look familiar to anyone who has read the GDPR:

• Process only on a lawful basis. Consent, or a defined legitimate ground — contractual necessity, employment obligations, medical emergency, a duty imposed by law, or data the subject has voluntarily made public.
• Give notice. Before or during processing, tell the person what categories of data you collect, why, what the risks are, where it goes, and how to exercise their rights.
• Secure the data. Technical and organisational measures such as encryption and pseudonymisation, tested and updated according to the sensitivity of the data.
• Report breaches. Where a breach is likely to cause significant damage, notify the Authority within the prescribed time.
• Appoint a Chief Data Officer if you are a significant data controller. The CDO is the organisation's face before the regulator and the point of contact for complaints.
• Do not keep data forever. Retention beyond the purpose is prohibited, though records of processing must be preserved for at least five years.
• Handle children's data carefully. A child is anyone under eighteen, and processing requires verifiable consent from a parent or guardian.

What individuals now get

This is the part worth explaining to clients, because these rights did not exist here before.

A data subject can access their data and get a summary of the purposes, the recipients, the retention period and the safeguards used for any transfer abroad. They can demand portability — receiving their data in a usable format, or having it moved directly to another controller. They can require rectification of inaccurate or incomplete data, with the controller obliged to inform the person and other concerned parties within thirty days. They can seek erasure where the purpose has ended, consent has been withdrawn, or processing was unlawful. And they can withdraw consent at any time, though processing already done lawfully before withdrawal stays valid.

One provision deserves special attention: these rights are described as inherent and inalienable, and cannot be waived or reduced by contract or notice. That single line kills the standard corporate defence — "the user agreed to our terms."

Data leaving the country

The Act treats certain data as too sensitive to move freely. Large-scale transfers of national ID numbers, passport numbers and TINs, biometric identifiers, genetic information and criminal records attract strict oversight. Transfers of sensitive identifiers at scale must be notified to the Authority, and the Authority can order transfers to a foreign country to be suspended or stopped.

Regulation of data is being framed here as a question of national sovereignty, not only individual privacy. Whether that framing is right is an argument worth having in print.

The regulator and the penalties

Oversight sits with the data protection authority established under this framework alongside the national data governance legislation. It can issue binding instructions, inspect premises and systems, audit processing, issue warnings, impose administrative fines and halt cross-border transfers.

On penalties, the Act sets administrative fines of up to Tk 25 lakh for failing to secure personal data properly, and up to Tk 25 lakh for failing to honour a data subject's rights, rising to Tk 50 lakh where a significant data fiduciary is at fault, with further fines for repeat violations. Turnover-linked penalties for serious breaches were also widely reported when the framework was amended — a point to confirm against the gazette text before you rely on it in an opinion.

Now read the two together

Here is the analysis that makes this subject interesting rather than merely technical.

The Constitution protects citizens against the State. The statute protects data subjects — residents, visitors, arguably even the dead — against everyone, including private companies. The statute is horizontal where the Constitution is vertical. That is a genuine expansion, and it is the single most important structural point to grasp.

But notice what has not changed. Article 43 still allows restrictions in the interests of State security and public order. Any exemption the data protection framework grants to government agencies will ultimately be tested against that word — reasonable. A blanket exemption, with no independent oversight and no remedy for the individual, is very hard to defend as a reasonable restriction. A narrow, purpose-bound exemption with judicial or regulatory supervision is much easier.

That question is not settled. It will be argued, and someone will have to argue it.

Why this matters for your practice

Every bank, hospital, telecom operator, e-commerce platform and mid-sized company in this country is non-compliant by default today. Someone has to write their privacy notices, draft their processor contracts, run their impact assessments and represent them before the Authority. On the other side, someone has to bring the first complaints for data subjects — and the first writ petition when the State is the one processing.

Very few lawyers in Bangladesh can do this work well right now. In five years the country will need thousands.

Start with the Act itself, not summaries of it. Read it beside Article 43, then read one foreign judgment on proportionality in surveillance. That is a week's work, and it will put you ahead of most of the bar.