Bangladesh Personal Data Protection Act 2026 and automated decisions

What it is

The Personal Data Protection Act 2026, Act No. 63 of 2026, is Bangladesh’s first comprehensive data protection law. It began as the Personal Data Protection Ordinance 2025, issued by the interim government on 6 November 2025 and amended by a further ordinance on 5 February 2026. Parliament replaced both with the Act, published on 10 April 2026. Section 44 repeals the ordinances and keeps anything done under them in effect.

The Act treats a person’s personal data as belonging to them, and builds most processing around their consent. It uses the term data fiduciary for the organisation that decides why and how personal data is processed, and processor for anyone processing on its behalf. It sits beside the National Data Management Act 2026, which sets up the regulator and a national framework for data interoperability.

The official text is in Bangla on the Laws of Bangladesh portal. Section 45 lets the government publish an authentic English translation.

Who it applies to

Section 1(2) applies the Act to data fiduciaries, processors and anyone else involved in processing who is a citizen of, resides in, works in or is temporarily in Bangladesh, or who processes personal data inside Bangladesh other than simply passing it through. It also reaches processing outside Bangladesh connected with providing goods or services to people in Bangladesh, or with monitoring or profiling them. That brings in foreign AI providers whose products are used by people in Bangladesh.

A data subject is a natural person, living or dead, who is identified or identifiable from the data. Significant data fiduciaries are those the Authority designates by regulation, based on factors such as the effect on state sovereignty, the volume of data processed and its financial weight, and the risk to data subjects’ rights.

Section 8 makes the data fiduciary responsible for what its processors do. An organisation that uses a vendor’s AI system on personal data carries the duties for that processing.

What it requires

For AI systems, the provisions that matter most are these.

• Consent and lawful basis. Section 5 requires consent that is voluntary, specific, clear and withdrawable, given after the person is told the purpose, retention period, transfers and how to withdraw. It also lists grounds that allow processing without consent, including performing a contract, legal claims, vital interests and employment or social protection rights. The fiduciary bears the burden of proving consent.
• Automated decisions. Section 13(1)(c) lets a person withdraw consent to automated decisions relating to their personal data. Section 13(6) bars a fiduciary from processing, withdrawing or transferring personal data by automated means without informing the person.
• Transparency. Section 15 requires the fiduciary to tell people the categories of data collected, the purposes, the categories that carry a risk of harm, how to exercise their rights and complain, any transfers and how to contact the fiduciary.
• Security. Section 17 requires technical and organisational measures including pseudonymisation, encryption, resilience, recovery after incidents and regular testing of how well the measures work.
• Records. Section 19 requires records of processing to be kept in a register for at least five years.
• Breach reporting. Section 20 requires the fiduciary to tell the Authority of a personal data breach likely to cause significant harm to a data subject, in the form, manner and time the regulations set.
• Audit. Section 21 requires prescribed classes of fiduciary to have their processing audited by an independent data auditor, and lets the Authority order an audit where processing may harm data subjects.
• Data protection plan. Section 22 requires every fiduciary to plan technical and organisational measures that prevent harm to data subjects and to follow the standards the regulations set.
• Chief Data Officer. Section 23 requires significant data fiduciaries to appoint Chief Data Officers who represent them to the Authority and handle data subject requests.
• Classification and transfers. Section 29 lets the government classify personal data as public, internal, confidential or restricted. Transfers abroad are allowed with consent, under a contract with the data subject, or for business, education, travel or migration matters with consent, and only to places with suitable storage technology. Large cross-border transfers of national ID, passport and tax numbers, biometrics, genetic data and criminal records must be notified to the Authority.

The Act does not require an impact assessment by name. An AI impact assessment is still the most direct way to show the section 22 plan, identify harm to data subjects and prepare for an audit under section 21.

Key dates

• 6 November 2025. Personal Data Protection Ordinance 2025 issued. The Act is treated as in force from this date.
• 5 February 2026. Amendment ordinance issued.
• 10 April 2026. Personal Data Protection Act 2026 published. The National Data Management Act 2026 and the Cyber Security Act 2026 were published the same day.
• Date to be notified. Section 23 and sections 31 to 35 commence on a date the government sets by gazette notification after 18 months. Until then, the administrative fines in sections 32 and 33 do not apply. They reach up to 25 lakh taka for failing to honour data subject rights or to secure personal data, and up to 50 lakh taka where a significant data fiduciary fails to honour those rights.

How it relates to other frameworks

The Act borrows the data fiduciary vocabulary from India’s DPDP Act, and like it relies on consent, notice and rights rather than a standalone ban on automated decisions. It is weaker on automated decisions than GDPR Article 22, which restricts solely automated decisions with significant effects, but it goes further than many laws by making automated decisions a distinct object of consent.

Bangladesh’s draft National AI Policy treats this Act as the base for AI accountability and proposes a right to human review of high-stakes automated decisions. Organisations often pair the Act with ISO/IEC 42001 or the NIST AI RMF to structure the inventory, assessments and controls the Act’s security, plan and audit duties imply.

A note on this page

This is Aicura’s reading of the Act, translated from the Bangla text on the Laws of Bangladesh portal. It is not legal advice and it is not the law itself. Read the primary source, check for the government’s English translation and regulations, and take advice on how the Act applies to your organisation.