BangladeshCredit bureaus: licensing, consent, data localization and data subject rights
Bangladesh Bank Guidelines on the Licensing, Operation and Regulation of Credit Bureau, Payment Systems Department Circular No. 05/2024, ss. 7, 11, 14 and 18
In force.
A data brokers rule binding private bodies.
- Enforcement body
- Bangladesh Bank
- Instrument type
- a regulation made under an act
- Obligation class
- Licensing, Data subject rights, Governance, Reporting
What it requires
- If you operate a credit bureau in Bangladesh, get a licence from Bangladesh Bank first: no individual or company may operate one without it, and the licensed bureau's name must include the words Credit Bureau.
- Collect, store and process a person's credit information only with the person's consent, and give it only to a user that has a permissible purpose and the person's consent, unless a law enforcement agency, regulator or court order requires the report.
- Keep collected data inside Bangladesh, and do not store it in an internet cloud located outside Bangladesh.
- Give a person free access to a copy of their credit report once a year or when a user has taken an adverse action, and run a dispute process that lets the person correct information that is inaccurate, incomplete or out of date.
- Report to Bangladesh Bank every quarter, give it unrestricted access to the credit information you hold, and appoint an external auditor for a technology and financial audit every year.
These lines are LexLint's reading of the law's text.
What this law does
A person may not operate a credit bureau in Bangladesh unless Bangladesh Bank has licensed it under its Guidelines on the Licensing, Operation and Regulation of Credit Bureau. A licensed credit bureau may collect, store and process credit information about a data subject only with the data subject's consent. A credit bureau may give credit information to a user only when the user has a permissible purpose and the bureau has the data subject's consent.
A credit bureau must keep collected data inside Bangladesh and may not store it in an internet cloud located outside Bangladesh. A data subject is entitled to a free copy of their credit report once a year or when a user has taken an adverse action. A credit bureau whose shareholders, directors or officers illegally disclose credit information is liable to a penalty of 500,000 taka.
When LexLint raises it
When your app profile says your app provides financial services or processes personal data.
Back to the example · Lint your app
Page updated .