Data Protection · Bangladesh
PDPO and Data Protection Compliance in Bangladesh
Bring your company in line with the Personal Data Protection Act 2026, the law that replaced the PDPO, with clear privacy notices, lawful consent, secure records, rights handling and safe transfers of employee and customer data.
Definition
What Is PDPO Compliance in Bangladesh?
PDPO compliance in Bangladesh means meeting the Personal Data Protection Act 2026, which replaced the Personal Data Protection Ordinance (PDPO) 2025: processing personal data only with valid consent or another lawful ground, telling people how their data is used, keeping it secure, honouring their rights and following the rules on sending data abroad.
Many people still call it the PDPO. The rules carried over into the Act, so a programme built for the Ordinance is the right starting point, as long as it is checked against the final text.
Who it applies to
- 1Anyone processing personal data in Bangladesh
- 2Foreign companies serving or monitoring people in Bangladesh
- 3Employers handling staff and payroll data
PDPO 2025 issued
The Personal Data Protection Ordinance is gazetted alongside the National Data Governance Ordinance.
Amendment Ordinance
The PDPO is amended and reissued before the new Parliament sits.
Personal Data Protection Act 2026
Parliament passes Act No. 63 of 2026. It replaces the PDPO, with most provisions treated as in force from 6 November 2025.
CDO duty and fines start
Chief Data Officer duties and administrative fines begin on a date the government sets by gazette.
Know your data
Which Personal Data Needs the Most Care?
The darker the tile, the stricter the rules. Map your own data against this before you change anything else.
Name, phone and email
Personal data. Needs a lawful ground and a privacy notice.
Salary and bank details
Confidential. Limit access and secure it in payroll systems.
National ID, passport and TIN
Sensitive identifiers. Large transfers abroad need notice to the Authority.
Biometric and genetic data
Highly protected. Cannot leave Bangladesh without authorisation.
Health and medical records
Sensitive. Needs specific consent or a listed ground.
Religion, union membership, beliefs
Sensitive. Collect only when the law or a clear purpose requires it.
Real-time location
Sensitive. Tracking apps and GPS logs need careful justification.
Children's data (under 18)
Parent or guardian consent. No profiling, tracking or targeted ads.
Your obligations
The Data Lifecycle Under Bangladesh Law
Five stages, five sets of rules. Most compliance gaps sit at the share and delete stages.
Collect
Give a privacy notice. Get consent that is free, specific, clear and revocable, or rely on another lawful ground.
Use
Use data only for the purpose you stated. Give people a way to challenge automated decisions.
Store
Keep it secure and record your processing in a register kept for at least five years.
Share
Bind vendors by contract. You stay liable for what your processors do. Check transfer rules before sending data abroad.
Delete
Do not keep data longer than its purpose needs, then delete or anonymise it.
Using outside vendors to handle personal data? See our vendor data protection review. Updating staff privacy notices? See employment contracts and HR policies.
Data subject rights
The Rights Your Customers and Staff Can Use
Under the Personal Data Protection Act 2026, people can ask what you hold about them, correct it, take a copy, have it deleted in set cases, withdraw consent and limit automated decisions.
Each request needs an owner, a log and a reply. Without a simple process, a single angry employee can turn a routine request into a complaint to the Authority.
What a rights process needs
- 1One inbox or form for requests
- 2Identity check before you reply
- 3A log of every request and answer
Penalties and timing
Fines Start Later. Your Liability Does Not.
The Chief Data Officer duty and administrative fines switch on by government notice after an 18-month runway. The core duties on consent, notice, security and rights already apply.
That runway is the time to fix your data map, notices and vendor contracts, not a reason to wait.
Use the runway to
- 1Name an internal data owner now
- 2Build your register of processing
- 3Rewrite notices and vendor contracts
Repeat violations can bring further fines, and the Authority can order compensation. Fines apply once the government brings the penalty sections into force, at least 18 months after the law was issued.
FAQs
PDPO and Data Protection in Bangladesh: FAQs
What is the PDPO in Bangladesh?
The PDPO is the Personal Data Protection Ordinance 2025, Bangladesh’s first general data protection law, issued on 6 November 2025. It set rules on consent, data subject rights, security and transfers of personal data, and has since been replaced by the Personal Data Protection Act 2026.
Is the PDPO still in force?
No. Parliament passed the Personal Data Protection Act 2026, Act No. 63 of 2026, which replaced the Ordinance. Most provisions are treated as in force from 6 November 2025, so the obligations have continued without a gap.
Does the law apply to foreign companies?
Yes. It covers processing outside Bangladesh when it is connected to offering goods or services to people in Bangladesh or monitoring them, as well as all processing inside the country.
Do we need consent to process employee data?
Not always. The law allows processing without consent for things like performing the employment contract and meeting employment and social security obligations. Sensitive data, such as biometric attendance or medical records, needs specific consent or another listed ground.
Can we transfer personal data outside Bangladesh?
Yes, in defined cases such as with consent or to perform a contract. Large-volume transfers of national ID, passport or tax numbers must be notified to the Authority, biometric and genetic data are tightly restricted, and the Authority can suspend transfers.
Do we need a Chief Data Officer?
Significant data fiduciaries, to be identified by regulation, must appoint a qualified Chief Data Officer. The duty starts by government notice after the 18-month runway, but naming an internal owner now makes the move far easier.
What are the penalties under the Personal Data Protection Act?
Administrative fines of up to Tk 25 lakh for failing to honour data subject rights or to keep data secure, and up to Tk 50 lakh for a significant data fiduciary. The Authority can add fines for repeat violations and order compensation.
How quickly must a data breach be reported?
The Authority must be told when a breach is likely to cause significant harm, in the form and time set by regulation. Until the deadline is published, we recommend being ready to report within 72 hours, the standard used by many international privacy laws.
Find Your Data Protection Gaps Before Someone Else Does
Tell us what personal data you hold, where it is stored and who you share it with. We will map it against the Personal Data Protection Act 2026, list the gaps by risk and quote a fixed fee to close them.