Processes personal data, in Bangladesh

Cyber Security Act, 2026 (Act No. 81 of 2026), s. 9 · Read the law's page

• Without delay after a cyber incident occurs, inform the National Computer Emergency Response Team the National Cyber Security Agency maintains; the Act names no fixed number of hours or days for this notification.
• This binds a government, private, or autonomous organization or institution in Bangladesh, the Act's own general categories for essentially any actor rather than a licensed or sector-specific status, so an ordinary software distributor or app operator falls within it without needing a critical-infrastructure designation.

Personal Data Protection Act, 2026, Act No. 63 of 2026, s.2(21), s.2(14), s.7 · Read the law's page

• An app that derives a facial image, voiceprint, or other biometric identifier from a person in Bangladesh must treat it as Sensitive Personal Data and satisfy one of section 7's narrower lawful-basis conditions, ordinarily the data principal's specific consent, before processing it.

Personal Data Protection Act, 2026, Act No. 63 of 2026, s.20 · Read the law's page

• An app that suffers a personal data breach in Bangladesh, including one involving a biometric identifier, must notify the Authority in the form, manner and time a regulation prescribes whenever the breach creates a possibility of significant harm to an affected data principal; no separate statutory duty to notify the affected individual directly was found.

Personal Data Protection Act, 2026, Act No. 63 of 2026, ss.10-14 · Read the law's page

• An app that collects or processes the personal data of an individual in Bangladesh must let that individual apply in writing to exercise the rights of this chapter, and may not cancel or depart from those rights by contract or notice.
• On the data principal's request, give the data principal a copy of the personal data collected and processed, in a concise and intelligible format, with the identity of the others it was shared with.
• On request, correct inaccurate or misleading personal data and complete or update incomplete or stale data, or give the data principal written reasons for refusing, and tell the data principal of a change made within 30 days.
• Let the data principal withdraw consent to storage, processing or automated decisions at any time, and on request erase all of that person's personal data held where one of the grounds in section 13(2) is met, the way a regulation prescribes.

Personal Data Protection Act, 2026, Act No. 63 of 2026, ss.29, 30 · Read the law's page

• An app transferring the personal data of a person in Bangladesh abroad, including a biometric identifier, must have the data principal's consent or a qualifying contract or personal-interest ground, and must notify the Authority before a bulk cross-border transfer of sensitive personally identifiable data such as fingerprint, facial-recognition, or iris data where it could threaten sovereignty, national security, or financial stability.

Personal Data Protection Act, 2026, Act No. 63 of 2026, ss.5, 8, 18 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Bangladesh, including a voiceprint, faceprint, or other biometric identifier, must have a lawful basis before processing, ordinarily the data principal's voluntary, specific, and revocable consent or one of the Act's enumerated legitimate-interest grounds, and must not retain the data beyond what its stated purpose requires.

Bangladesh Bank, Guidelines on the Licensing, Operation and Regulation of Credit Bureau, Payment Systems Department Circular No. 05/2024, ss. 7, 11, 14 and 18 · Read the law's page

• If you operate a credit bureau in Bangladesh, get a licence from Bangladesh Bank first: no individual or company may operate one without it, and the licensed bureau's name must include the words Credit Bureau.
• Collect, store and process a person's credit information only with the person's consent, and give it only to a user that has a permissible purpose and the person's consent, unless a law enforcement agency, regulator or court order requires the report.
• Keep collected data inside Bangladesh, and do not store it in an internet cloud located outside Bangladesh.
• Give a person free access to a copy of their credit report once a year or when a user has taken an adverse action, and run a dispute process that lets the person correct information that is inaccurate, incomplete or out of date.
• Report to Bangladesh Bank every quarter, give it unrestricted access to the credit information you hold, and appoint an external auditor for a technology and financial audit every year.

Personal Data Protection Act, 2026, Act No. 63 of 2026, ss.31-38 · Read the law's page

• Honor each right the Act gives a data principal, and give personal data the protection and security that the Act, its rules and regulations or the general operating procedure prescribe, a biometric identifier included (ss.32 and 33).
• Treat compensation the National Data Management Authority determines for a data principal on a complaint under section 32 or 33 as owed in addition to any administrative fine, and file any appeal against a fine or compensation order with the Tribunal within 30 days of the order (ss.35 and 37).