BangladeshPersonal Data Protection Act, 2026, comprehensive regime and lawful basis
Personal Data Protection Act, 2026, Act No. 63 of 2026, ss.5, 8, 18
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://bdlaws.minlaw.gov.bd/act-details-1692.htmlIn force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Bangladesh, including a voiceprint, faceprint, or other biometric identifier, must have a lawful basis before processing, ordinarily the data principal's voluntary, specific, and revocable consent or one of the Act's enumerated legitimate-interest grounds, and must not retain the data beyond what its stated purpose requires.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- May a Data Fiduciary rely on a ground in section 5(3)(ক) to (ছ) to process personal data without consent before the Authority makes the regulation that section 5(3) calls 'প্রবিধান দ্বারা নির্ধারিত বিধান' (provisions set by regulation) on benefit, necessity and 'সমানুপাতিকতা' (proportionality)?
- What makes further processing 'মূল উদ্দেশ্যের সহিত সামঞ্জস্যপূর্ণ' (consistent with the original purpose) under section 6, and does it need fresh consent under section 5?
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Section 5(4) puts the burden of proving that the data principal validly consented on the Data Fiduciary, which can only be met from a record of the consent. The sections this row cites name no log or register. Section 18 limits how long personal data is kept, not a record of processing. Section 19 (a register of records of processing, kept at least five years), section 21 (data audit) and section 26 (the Authority's powers of inspection) are outside the sections this row cites.
- Kind
- Implicit
- As of
- Provision
- Section 5(4)
- Trigger
- consent_or_optout
What this law does
Section 5 requires a Data Fiduciary to have a lawful basis before processing personal data: voluntary, specific, clear, revocable consent (s.5(2)), or one of seven enumerated legitimate-interest grounds without consent (contract performance, pre-contractual steps, legal-claims necessity, vital interests, employment/labor/social-security legal duties, the data principal's own voluntary public disclosure, or preventing harm from unreasonably withheld consent).
A Data Fiduciary determines purpose and means and remains liable for a Processor's processing (s.8). Section 18 bars retaining data beyond what the purpose requires, subject to a scientific, historical, statistical-research, or public-interest exception. In force since , deemed retroactively by the Act's own commencement clause.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .