Processes biometric data, in Bangladesh

Cyber Security Act, 2026 (Act No. 81 of 2026), s. 9 · Read the law's page

• Without delay after a cyber incident occurs, inform the National Computer Emergency Response Team the National Cyber Security Agency maintains; the Act names no fixed number of hours or days for this notification.
• This binds a government, private, or autonomous organization or institution in Bangladesh, the Act's own general categories for essentially any actor rather than a licensed or sector-specific status, so an ordinary software distributor or app operator falls within it without needing a critical-infrastructure designation.

Personal Data Protection Act, 2026, Act No. 63 of 2026, s.2(21), s.2(14), s.7 · Read the law's page

• An app that derives a facial image, voiceprint, or other biometric identifier from a person in Bangladesh must treat it as Sensitive Personal Data and satisfy one of section 7's narrower lawful-basis conditions, ordinarily the data principal's specific consent, before processing it.

Personal Data Protection Act, 2026, Act No. 63 of 2026, s.20 · Read the law's page

• An app that suffers a personal data breach in Bangladesh, including one involving a biometric identifier, must notify the Authority in the form, manner and time a regulation prescribes whenever the breach creates a possibility of significant harm to an affected data principal; no separate statutory duty to notify the affected individual directly was found.

Personal Data Protection Act, 2026, Act No. 63 of 2026, ss.29, 30 · Read the law's page

• An app transferring the personal data of a person in Bangladesh abroad, including a biometric identifier, must have the data principal's consent or a qualifying contract or personal-interest ground, and must notify the Authority before a bulk cross-border transfer of sensitive personally identifiable data such as fingerprint, facial-recognition, or iris data where it could threaten sovereignty, national security, or financial stability.

Personal Data Protection Act, 2026, Act No. 63 of 2026, ss.5, 8, 18 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Bangladesh, including a voiceprint, faceprint, or other biometric identifier, must have a lawful basis before processing, ordinarily the data principal's voluntary, specific, and revocable consent or one of the Act's enumerated legitimate-interest grounds, and must not retain the data beyond what its stated purpose requires.

Personal Data Protection Act, 2026, Act No. 63 of 2026, ss.31-38 · Read the law's page

• Honor each right the Act gives a data principal, and give personal data the protection and security that the Act, its rules and regulations or the general operating procedure prescribe, a biometric identifier included (ss.32 and 33).
• Treat compensation the National Data Management Authority determines for a data principal on a complaint under section 32 or 33 as owed in addition to any administrative fine, and file any appeal against a fine or compensation order with the Tribunal within 30 days of the order (ss.35 and 37).