BangladeshPersonal Data Protection Act, 2026, complaints, penalties and appeals
Personal Data Protection Act, 2026, Act No. 63 of 2026, ss.31-38
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://bdlaws.minlaw.gov.bd/act-details-1692.htmlAn enforcement supervision rule binding public and private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Honor each right the Act gives a data principal, and give personal data the protection and security that the Act, its rules and regulations or the general operating procedure prescribe, a biometric identifier included (ss.32 and 33).
- Treat compensation the National Data Management Authority determines for a data principal on a complaint under section 32 or 33 as owed in addition to any administrative fine, and file any appeal against a fine or compensation order with the Tribunal within 30 days of the order (ss.35 and 37).
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Do the words 'এই অধ্যাদেশে' (this Ordinance) in sections 32(1) and 33 of the Act, which section 44(1) says repeals the Personal Data Protection Ordinance, 2025, refer to the Act itself, so that the administrative fines in those sections apply to a failure to honor the rights and the security duties that the Act creates?
- Can the Authority fine an official under section 36, which section 1(3) deems in force from , before sections 31 to 35 (complaint, administrative fine and compensation) take effect on the date the Government fixes by gazette notification?
What it makes you log
Logging duty
Sections 31 to 38 cover complaints, administrative fines, compensation and appeal to the Tribunal within 30 days. They require no log or record, and the Authority's powers of inspection and to demand data in section 26, which this row does not cite, are not part of it.
- Kind
- None
- As of
What this law does
A data principal or any person with reason to believe a rights violation occurred may file a complaint with the National Data Management Authority (s.31); the Authority may impose an administrative fine of up to BDT 2,500,000 for a rights violation, up to BDT 5,000,000 where the violator is a significant data fiduciary, with a further fine on top for a second or repeated violation (s.32), and separately up to BDT 2,500,000 for a security or protection failure (s.33), with factors for setting the fine listed at s.34, plus compensation to the complaining data principal in addition to the fine (s.35).
Section 36 lets the Authority fine individual company officials personally implicated in a rights-violation complaint. Appeal against an Authority fine or compensation order runs to the Tribunal established under section 68 of the Information and Communication Technology Act, within 30 days (s.37).
The provisions this entry describes come into force on different days: sections 36 to 38 are deemed to have come into force on , and sections 31 to 35 take effect on a date the Government fixes by gazette notification once 18 months have passed from the issue of the Act.
No standalone private civil right of action (a direct court suit) was found; the only individual remedy is the Authority's own compensation power under section 35, which takes effect with sections 31 to 35 on the date the Government fixes.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .