BangladeshPersonal Data Protection Act, 2026, sensitive personal data and biometric data
Personal Data Protection Act, 2026, Act No. 63 of 2026, s.2(21), s.2(14), s.7
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://bdlaws.minlaw.gov.bd/act-details-1692.htmlIn force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app that derives a facial image, voiceprint, or other biometric identifier from a person in Bangladesh must treat it as Sensitive Personal Data and satisfy one of section 7's narrower lawful-basis conditions, ordinarily the data principal's specific consent, before processing it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a facial image or voice recording count as 'বায়োমেট্রিক উপাত্ত' (biometric data) under item (14) of section 2 only where it is 'নির্দিষ্ট ব্যক্তিকে অন্যভাবে শনাক্ত করিতে অথবা তাহার পরিচয় নিশ্চিত করিতে সক্ষম' (capable of identifying a particular person otherwise, or of confirming the identity of that person), or does the definition naming 'মুখের ছবি' (facial image) and 'কন্ঠস্বরের ছাপ' (voiceprint) bring every such image or recording within it?
- Does section 7, which opens with 'ধারা ৫ এবং ৬ এর বিধানসাপেক্ষে' (subject to the provisions of sections 5 and 6), require a Data Fiduciary to meet the consent requirements of section 5(2) as well as one of the conditions (ক) to (চ) of section 7 before processing sensitive personal data?
What it makes you log
Logging duty
Sections 2(14), 2(21) and 7 define biometric and other sensitive personal data and list the conditions for processing it, among them the data principal's specific consent. None of them requires a log or a record. The register of records in section 19 and the data audit in section 21 are outside the sections this row cites.
- Kind
- None
- As of
What this law does
Biometric Data is defined (definitions item 14) as personal data created through measurement or technical processing of a person's physical, physiological or behavioral characteristics, capable of uniquely identifying a specific person, expressly naming DNA, blood group, fingerprint, facial image, iris scan, voiceprint, and gait pattern as examples.
It is one of the enumerated Sensitive Personal Data categories (item 21), alongside genetic data, ethnic and community data, political or religious belief, trade union membership, health data, sexual orientation, criminal-record data, and real-time geolocation data.
Section 7 processing conditions for sensitive data are narrower than the ordinary section 5(3) legitimate-interest grounds: specific consent, contract necessity, an employment or social-security legal duty, a health worker's treatment duty or life or health emergency, a duty imposed by law, or the data principal's own voluntary public disclosure of the data.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .