Personal Data Protection Act, 2026, complaints, penalties and appeals

Personal Data Protection Act, 2026, Act No. 63 of 2026, ss.31-38

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

An enforcement supervision rule binding public and private bodies.

As of 29 August 2026.

What it requires

Bangladesh's complaint, penalty, and appeal machinery for a personal-data violation, including one involving a biometric identifier, is not yet operative; no notification setting its commencement date had issued as of the date shown. Once in force, an app will answer to the National Data Management Authority for an administrative fine of up to BDT 2,500,000 per violation type, and the Authority may also order compensation to an affected data principal; Bangladesh gives a data principal no standalone civil right of action of their own.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Once operative, a data principal or any person with reason to believe a rights violation occurred may file a complaint with the National Data Management Authority (s.31); the Authority may impose an administrative fine of up to BDT 2,500,000 for a rights violation (s.32) and separately up to BDT 2,500,000 for a security or protection failure (s.33), with factors for setting the fine listed at s.34, plus compensation to the complaining data principal in addition to the fine (s.35).

Section 36 lets the Authority fine individual company officials personally implicated in a rights-violation complaint. Appeal against an Authority fine or compensation order runs to the Tribunal established under section 68 of the Information and Communication Technology Act, within 30 days (s.37).

None of this is currently operative: sections 23 and 31 to 35 are excluded from the Act's own retroactive commencement deeming and await a separate Government gazette notification, expected roughly 18 months after the Act's gazetted predecessor (a date not yet reached or notified as of the date shown). No standalone private civil right of action (a direct court suit) was found; the only individual remedy is the Authority's own compensation power under section 35, and that too is deferred.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Read the law

official statute text, Bangladesh Laws (bdlaws.minlaw.gov.bd), Internet Archive capture

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived August 29, 2026. Publisher's page: http://bdlaws.minlaw.gov.bd/act-details-1692.html

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app