BangladeshPersonal Data Protection Act, 2026, data principal rights of access, correction, withdrawal and erasure
Personal Data Protection Act, 2026, Act No. 63 of 2026, ss.10-14
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://bdlaws.minlaw.gov.bd/act-details-1692.htmlIn force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects or processes the personal data of an individual in Bangladesh must let that individual apply in writing to exercise the rights of this chapter, and may not cancel or depart from those rights by contract or notice.
- On the data principal's request, give the data principal a copy of the personal data collected and processed, in a concise and intelligible format, with the identity of the others it was shared with.
- On request, correct inaccurate or misleading personal data and complete or update incomplete or stale data, or give the data principal written reasons for refusing, and tell the data principal of a change made within 30 days.
- Let the data principal withdraw consent to storage, processing or automated decisions at any time, and on request erase all of that person's personal data held where one of the grounds in section 13(2) is met, the way a regulation prescribes.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Do the rights in sections 10 to 14 bind a Data Fiduciary before the regulations they call for set the request procedure, the frequency limit and the response time, given that section 1(3) deems the chapter in force from ?
What it makes you log
Logging duty
Section 10(3) requires the Data Fiduciary, on receiving a data principal's request, to check the sensitivity of the data and the risk of fraud before acting, and to preserve the action it takes for audit as applicable. It names no register of requests and no fields to be kept. The register of records in section 19 is outside the sections this row cites.
- Kind
- Implicit
- As of
- Provision
- Section 10(3)
- Trigger
- personal_data_processing
What this law does
Chapter 3 lets a data principal exercise rights against a Data Fiduciary by written application (s.10(1)) and declares them universal, inherent, non-transferable and inviolable, so that no contract or notice can cancel or depart from them (s.10(4)). Section 11 gives a right of access to the personal data processed, with a copy in a concise and intelligible format, and lets the Data Fiduciary arrange a direct transfer of the data to another Data Fiduciary where an interoperable ecosystem applies.
Section 12 gives a right to correct inaccurate or misleading personal data, complete incomplete data and update stale data, and if the Data Fiduciary refuses it must give its reasons in writing; where it does make a change it must tell the data principal within 30 days.
Section 13 lets the data principal withdraw consent to storage, processing or automated decisions at any time, and requires erasure on request where the purpose has ended, consent is withdrawn, the data principal objects, the data was processed unlawfully, or a legal duty or regulation requires it, with listed grounds for refusal.
Section 14 provides for an approved correction or erasure to be propagated, on the Authority's direction, to the secondary Data Fiduciaries and Processors that hold the data. The procedures, forms and time limits for requests are left to regulations.
When LexLint raises it
When your app profile says your app processes personal data or makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .