BangladeshPersonal Data Protection Act, 2026, breach notification duties
Personal Data Protection Act, 2026, Act No. 63 of 2026, s.20
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://bdlaws.minlaw.gov.bd/act-details-1692.htmlIn force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that suffers a personal data breach in Bangladesh, including one involving a biometric identifier, must notify the Authority in the form, manner and time a regulation prescribes whenever the breach creates a possibility of significant harm to an affected data principal; no separate statutory duty to notify the affected individual directly was found.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the duty in section 20(1) to notify the Authority of a breach that carries a possibility of 'উল্লেখযোগ্য ক্ষতি' (significant harm) bind a Data Fiduciary before a regulation prescribes the 'প্রবিধান দ্বারা নির্ধারিত রূপ, পদ্ধতি এবং সময়ের মধ্যে' (form, manner and time prescribed by regulation) for notifying, given that section 1(3) deems the Act in force from ?
What it makes you log
Logging duty
Section 20 requires a Data Fiduciary to notify the Authority of a breach that may cause significant harm, in the form, manner and time a regulation prescribes. It requires no register or record of breaches, notified or not. The register of records in section 19 is outside the section this row cites.
- Kind
- None
- As of
What this law does
Section 20(1) requires a Data Fiduciary to notify the Authority of a personal data breach, in the form, manner, and time prescribed by regulation, whenever the breach creates a possibility of significant harm to the affected data principal. Section 20(2) lists factors, nature of breach, affected-principal categories and counts, contact details, and mitigation steps, that the Authority considers in gauging severity, again by regulation not yet located.
No statutory deadline (no 72 hour figure) appears in the Act itself, and no separate duty to notify the affected data principal directly was found in the sections read.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .