BangladeshPersonal Data Protection Act, 2026, cross-border transfer of personal data
Personal Data Protection Act, 2026, Act No. 63 of 2026, ss.29, 30
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://bdlaws.minlaw.gov.bd/act-details-1692.htmlIn force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of a person in Bangladesh abroad, including a biometric identifier, must have the data principal's consent or a qualifying contract or personal-interest ground, and must notify the Authority before a bulk cross-border transfer of sensitive personally identifiable data such as fingerprint, facial-recognition, or iris data where it could threaten sovereignty, national security, or financial stability.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does 'কেবল' (only) in section 29(4) make a destination named under a regulation a further condition on every transfer abroad that already meets one of the grounds in section 29(3)(ক) to (গ), and which regulation names the places or countries where 'উপযুক্ত প্রযুক্তি ও সরঞ্জাম বিদ্যমান' (suitable technology and equipment exist)?
- How large must a transfer be to count as 'বিপুল পরিমাণ' (a large quantity) of sensitive personally identifiable data that section 29(6) requires to be notified to the Authority?
What it makes you log
Logging duty
Sections 29 and 30 classify personal data, set the grounds for transfer abroad and require the Authority to be notified of a bulk cross-border transfer of sensitive identifiable data. That is a notification to the Authority, and no record of transfers is kept or produced. The register of records in section 19 is outside the sections this row cites.
- Kind
- None
- As of
What this law does
Section 29(1) empowers the Government to classify personal data into four tiers by Schedule (public/open, internal, confidential, restricted). Transfer abroad is permitted with the data principal's consent, under a contract to which they are party involving goods or services, or with consent for their business, education, or travel/migration interests (s.29(3)), and the destination must have adequate technology and safeguards for personal-data storage per regulation (s.29(4)).
Bulk cross-border transfer of sensitive personally identifiable data, including a biometric identifier such as a fingerprint, facial-recognition data, or iris scan, requires mandatory notification to the Authority where it could threaten sovereignty, national security, or financial stability (s.29(6)).
No blanket data-localization mandate appears in the enacted text, correcting the amendment-ordinance stage's residency mandate, which industry comment reports was removed in the revision that became this Act.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .