Using AI under Bangladesh's Personal Data Protection Act 2026

Bangladesh’s Personal Data Protection Act 2026 replaced the 2025 ordinance in April 2026 and is treated as in force from 6 November 2025. It does not mention artificial intelligence, but any AI system that touches personal data falls under it, and its rule on automated decisions is unusually direct. This guide sets out what the Act means for an organisation using AI, in the order the work usually gets done. The framework page covers the Act itself.

Know which duties apply now

Most of the Act applies already. Two parts wait for a gazette notification that the government can issue once 18 months have passed. Section 23 requires significant data fiduciaries to appoint Chief Data Officers. Sections 31 to 35 cover complaints to the National Data Management Authority, administrative fines and compensation.

That timing matters. The duties on consent, notice, security, records, breach reporting and transfers bind organisations today, but the complaint and fine machinery is not yet running. The months before it starts are the time to build the record that shows the duties are met.

Start with an inventory of AI that uses personal data

Every duty below depends on knowing which systems process personal data and what they do with it. Section 19 already requires a register of processing records kept for at least five years. For AI, extend that register to each system and agent, with its owner, purpose, the personal data it uses, whether it profiles people, whether it decides anything about them on its own, and which vendor runs it.

Include AI built into the software you already use, such as assistants in office suites, chat on customer channels and scoring in lending or HR tools. A shadow AI search usually finds tools nobody recorded.

Tell people before you process by automated means

Section 13(6) says a data fiduciary must not process, withdraw or transfer personal data by automated means without informing the data subject. Section 15 requires notices covering the categories of data, the purposes, the categories that carry a risk of harm, how to exercise rights and complain, and any transfers.

For each system on the register that processes personal data automatically, write a short plain description of what it does, what data it uses and what the result means for the person. Put it where people meet the system, not only in a general privacy policy. Generic wording that “we may use automated tools” tells nobody anything about a specific decision.

Let people withdraw consent to automated decisions

Section 13(1)(c) gives people the right to withdraw consent, in whole or in part, to automated decisions relating to their personal data. Section 13(5) lets a person who thinks processing is likely to harm them ask for it to stop, and the fiduciary must stop and tell them.

In practice, each automated decision about people needs a route that works without it. A lender that scores applications automatically needs a way to assess an applicant who withdraws consent. An employer that screens CVs with AI needs a person who can review an application by other means. Record that alternative route for each system, and test that it works.

Hold AI vendors to the Act

Section 8 treats processing by a processor as processing by the data fiduciary, which stays responsible for it. Most AI vendors processing personal data for you are processors in this sense. You must take reasonable steps to make sure they follow the Act and its regulations.

Check what each AI contract says about training on your data, model changes, sub-processors, security and notice of incidents. The vendor AI risk guide covers the due-diligence questions.

Check transfers before using AI hosted abroad

Many AI services process data outside Bangladesh. Section 29 lets the government classify personal data as public, internal, confidential or restricted, and allows transfers abroad only on the grounds it lists, namely consent, a contract with the data subject for goods or services, or the data subject’s business, education, travel or migration matters with their consent. Transfers may go only to places with the storage technology the regulations specify. Large cross-border transfers of national ID, passport and tax numbers, biometrics, genetic data or criminal records must be notified to the Authority.

Restricted and confidential data deserve particular care. Under section 13(3), a fiduciary may refuse erasure of confidential or restricted personal data. Before sending these classes to an AI service abroad, take advice on how the classification and any regulations apply.

Assess harm and be ready for an audit

The Act does not require an impact assessment by name. Section 22 does require every data fiduciary to identify harm to data subjects and plan the technical and organisational measures that prevent it. Section 21 lets the Authority order an independent audit where it thinks processing may harm data subjects, and requires audits for prescribed classes of fiduciary.

An AI impact assessment that describes the system, identifies who it affects, weighs the harm and records the controls is the most direct way to show the section 22 plan and to answer an auditor.

Report breaches and incidents

Section 20 requires a data fiduciary to tell the Authority about a personal data breach likely to cause significant harm to a data subject, in the form and time the regulations set. Separately, the Cyber Security Act 2026 requires any organisation where a cyber incident occurs to tell the national computer emergency response team without delay. An AI incident, such as a model leaking personal data through its outputs, can trigger both.

Watch the AI policy

The ICT Division’s draft National AI Policy would add risk tiers, algorithmic impact assessments for high-risk AI and a right to human review of high-stakes automated decisions. It is not yet adopted, but an inventory, impact assessments and recorded human oversight built for the Act will carry over.

A note on this guide

This is Aicura’s reading of the Act, translated from the Bangla text on the Laws of Bangladesh portal. It is not legal advice. Read the primary source, watch for the regulations and the government’s English translation, and take advice on how the Act applies to you.