BangladeshCyber Security Act, 2026, unauthorised access to a computer system
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://bdlaws.minlaw.gov.bd/act-details-1710.htmlIn force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- User location, Place of effect
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not gain illegal entry into a computer, digital device, computer system, or computer network, and do not assist another person to do so; a higher penalty applies where the entry is for the purpose of committing an offence, and a further higher penalty applies where the entry results in the theft, destruction, or alteration of information, or in an AI agent generating new data through that access.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Up to 1 year's imprisonment, or a fine of up to BDT 1,000,000, or both, for illegal entry alone (s.18(2)(a)); up to 2 years, or a fine of up to BDT 2,000,000, or both, where the entry is for the purpose of committing an offence (s.18(2)(b)); up to 5 years, or a fine of up to BDT 5,000,000, or both, where the entry (hacking) results in theft, destruction, or alteration of data or in an AI agent generating new data (s.18(2)(c)).
What it makes you log
Logging duty
Section 18 makes it an offence to gain illegal entry into a computer, digital device, computer system or computer network, or to assist another to do so, with higher penalties where the entry is for committing an offence or results in theft, destruction or alteration of data. It imposes no duty to create, keep, produce or review a log or record. Section 4 gives the Act extra-territorial reach: an offence by a Bangladeshi citizen abroad, by a person abroad using a computer or network in Bangladesh to commit an offence within Bangladesh, and by a person in Bangladesh against a target abroad. The second is read as a place-of-effect hook and the third as a place-of-act hook.
- Kind
- None
- As of
What this law does
Section 18(1)(a) makes it an offence for a person intentionally to gain illegal entry into a computer, digital device, computer system, or computer network, or to assist another to do so, punishable by up to one year's imprisonment or a fine of up to BDT 1,000,000, or both. Section 18(1)(b) raises the offence, and the penalty to up to two years or BDT 2,000,000, where the illegal entry is for the purpose of committing an offence.
Section 18(1)(c) raises it further, to up to five years or BDT 5,000,000, where the illegal entry (described as hacking) results in theft, destruction, cancellation, or alteration of information from a data store, in a diminution of its value or utility, or in an artificial intelligence agent generating new data through that access.
The Act does not define "illegal entry" by reference to defeating a security measure or exceeding an authorisation, so the provision's reach over a scraper reading a public, unauthenticated page is not addressed by the text read.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .