Bangladesh

Section 25(1) makes it an offence for any person, through a website or other digital or electronic medium, intentionally or knowingly to send, publish, or broadcast, or threaten to send, publish, or broadcast, any information, video, audio-visual footage, still image, or graphics that is captured, edited, or created or edited by artificial intelligence, and displayable, where it was created for, obtained for, or preserved for the purpose of blackmail, sexual harassment, revenge pornography, digital child-sexual-abuse material, or sextortion, and is harmful or intimidating.

Section 25(2) sets the base penalty at up to two years' imprisonment, or a fine of up to BDT 1,000,000, or both; section 25(3) raises it to up to five years' imprisonment, or a fine of up to BDT 2,000,000, or both, where the victim is a woman or a child under eighteen.

The Act's own commencement clause deems it, including this section, to have come into force on 21 May 2025, the date its immediate predecessor, the Cyber Security Ordinance 2025, took effect; that Ordinance had itself replaced the Cyber Security Act, 2023.

Section 20(1) requires a Data Fiduciary to notify the Authority of a personal data breach, in the form, manner, and time prescribed by regulation, whenever the breach creates a possibility of significant harm to the affected data principal. Section 20(2) lists factors, nature of breach, affected-principal categories and counts, contact details, and mitigation steps, that the Authority considers in gauging severity, again by regulation not yet located.

No statutory deadline (no 72 hour figure) appears in the Act itself, and no separate duty to notify the affected data principal directly was found in the sections read.

Section 5 requires a Data Fiduciary to have a lawful basis before processing personal data: voluntary, specific, clear, revocable consent (s.5(2)), or one of seven enumerated legitimate-interest grounds without consent (contract performance, pre-contractual steps, legal-claims necessity, vital interests, employment/labor/social-security legal duties, the data principal's own voluntary public disclosure, or preventing harm from unreasonably withheld consent).

A Data Fiduciary determines purpose and means and remains liable for a Processor's processing (s.8). Section 18 bars retaining data beyond what the purpose requires, subject to a scientific, historical, statistical-research, or public-interest exception. In force since 6 November 2025, deemed retroactively by the Act's own commencement clause.

Section 29(1) empowers the Government to classify personal data into four tiers by Schedule (public/open, internal, confidential, restricted). Transfer abroad is permitted with the data principal's consent, under a contract to which they are party involving goods or services, or with consent for their business, education, or travel/migration interests (s.29(3)), and the destination must have adequate technology and safeguards for personal-data storage per regulation (s.29(4)).

Bulk cross-border transfer of sensitive personally identifiable data, including a biometric identifier such as a fingerprint, facial-recognition data, or iris scan, requires mandatory notification to the Authority where it could threaten sovereignty, national security, or financial stability (s.29(6)).

No blanket data-localization mandate appears in the enacted text, correcting the amendment-ordinance stage's residency mandate, which industry comment reports was removed in the revision that became this Act.

Chapter 3 lets a data principal exercise rights against a Data Fiduciary by written application (s.10(1)) and declares them universal, inherent, non-transferable and inviolable, so that no contract or notice can cancel or depart from them (s.10(4)). Section 11 gives a right of access to the personal data processed, with a copy in a concise and intelligible format, and lets the Data Fiduciary arrange a direct transfer of the data to another Data Fiduciary where an interoperable ecosystem applies.

Section 12 gives a right to correct inaccurate or misleading personal data, complete incomplete data and update stale data, and if the Data Fiduciary refuses it must give its reasons in writing; where it does make a change it must tell the data principal within 30 days.

Section 13 lets the data principal withdraw consent to storage, processing or automated decisions at any time, and requires erasure on request where the purpose has ended, consent is withdrawn, the data principal objects, the data was processed unlawfully, or a legal duty or regulation requires it, with listed grounds for refusal.

Section 14 provides for an approved correction or erasure to be propagated, on the Authority's direction, to the secondary Data Fiduciaries and Processors that hold the data. The procedures, forms and time limits for requests are left to regulations.

A data principal or any person with reason to believe a rights violation occurred may file a complaint with the National Data Management Authority (s.31); the Authority may impose an administrative fine of up to BDT 2,500,000 for a rights violation, up to BDT 5,000,000 where the violator is a significant data fiduciary, with a further fine on top for a second or repeated violation (s.32), and separately up to BDT 2,500,000 for a security or protection failure (s.33), with factors for setting the fine listed at s.34, plus compensation to the complaining data principal in addition to the fine (s.35).

Section 36 lets the Authority fine individual company officials personally implicated in a rights-violation complaint. Appeal against an Authority fine or compensation order runs to the Tribunal established under section 68 of the Information and Communication Technology Act, within 30 days (s.37).

The provisions this entry describes come into force on different days: sections 36 to 38 are deemed to have come into force on 6 November 2025, and sections 31 to 35 take effect on a date the Government fixes by gazette notification once 18 months have passed from the issue of the Act.

No standalone private civil right of action (a direct court suit) was found; the only individual remedy is the Authority's own compensation power under section 35, which takes effect with sections 31 to 35 on the date the Government fixes.

Section 2(19) defines a child as a person under 18 years of age or of an age the government sets. Section 9(1) lets a Data Fiduciary collect or process the personal data of a child, or of a person unable to give consent, on the consent of that person's parent, legal guardian or a person empowered to decide for them, taken in the manner a regulation prescribes.

Section 9(2) requires the processing of such a person's personal data to be carried out with a view to keeping that person's rights and interests protected and unimpaired. Under section 9(3), a consent given for a child by a parent, legal guardian or person empowered to decide stays in force until the child reaches 18 years of age or, for a person unable to consent, until that person gains the capacity to consent.

Biometric Data is defined (definitions item 14) as personal data created through measurement or technical processing of a person's physical, physiological or behavioral characteristics, capable of uniquely identifying a specific person, expressly naming DNA, blood group, fingerprint, facial image, iris scan, voiceprint, and gait pattern as examples.

It is one of the enumerated Sensitive Personal Data categories (item 21), alongside genetic data, ethnic and community data, political or religious belief, trade union membership, health data, sexual orientation, criminal-record data, and real-time geolocation data.

Section 7 processing conditions for sensitive data are narrower than the ordinary section 5(3) legitimate-interest grounds: specific consent, contract necessity, an employment or social-security legal duty, a health worker's treatment duty or life or health emergency, a duty imposed by law, or the data principal's own voluntary public disclosure of the data.

Section 18(1)(a) makes it an offence for a person intentionally to gain illegal entry into a computer, digital device, computer system, or computer network, or to assist another to do so, punishable by up to one year's imprisonment or a fine of up to BDT 1,000,000, or both. Section 18(1)(b) raises the offence, and the penalty to up to two years or BDT 2,000,000, where the illegal entry is for the purpose of committing an offence.

Section 18(1)(c) raises it further, to up to five years or BDT 5,000,000, where the illegal entry (described as hacking) results in theft, destruction, cancellation, or alteration of information from a data store, in a diminution of its value or utility, or in an artificial intelligence agent generating new data through that access.

The Act does not define "illegal entry" by reference to defeating a security measure or exceeding an authorisation, so the provision's reach over a scraper reading a public, unauthenticated page is not addressed by the text read.

Section 2(11) lists a database among the eight enumerated categories of a copyrightable "work", alongside literary, dramatic, musical and artistic works, film, sound recording, broadcast, and performance.

Section 2(16) defines "database" as an electronically or otherwise systematically arranged collection of original works in which the compiler's own intellectual expression exists and which can be used through electronic or other means, an originality-based standard rather than an investment-based sui generis extraction right of the kind the EU Database Directive creates.

The Act does not carry a text-and-data-mining exception, and its general reproduction and "good use" exception for a literary work (s.70(1)) leaves the purpose and conditions under which reproduction does not infringe copyright to be set by Rules not otherwise identified.

Section 15 of the Cyber Security Act, 2026 lets the Government declare any computer system, network or information infrastructure as Critical Information Infrastructure by notification in the official Gazette and requires it to update the list at least once a year. Section 9(2) of the Act requires each declared Critical Information Infrastructure to have its own Computer Emergency Response Team or Computer Incident Response Team and Security Operation Center.

Section 9(2) also requires every Security Operation Center to submit a report on its activities and performance indicators to the National Cyber Security Operation Center every quarter. Section 16(2) requires each declared Critical Information Infrastructure to audit its internal and external infrastructure every year in the manner the rules prescribe, submit the audit report to the National Cyber Security Council and inform the Director General of its contents.

Section 16(1) has the Director General monitor and inspect Critical Information Infrastructure from time to time to ensure that the Act is complied with. The Act defines Critical Information Infrastructure as physical or virtual information infrastructure declared by the Government that controls, processes, transmits or stores data.

The Agency maintains a National Computer Emergency Response Team and a National Security Operation Center, and every entity the Government designates as Critical Information Infrastructure must maintain its own Computer Emergency Response Team or Computer Incident Response Team and Security Operation Center.

Any government, private, or autonomous organization or institution that experiences a cyber incident must, without delay, inform the National Computer Emergency Response Team under the Agency. The Act names no fixed number of hours or days for that notification. No provision of the Act states a penalty specific to a failure to give this notification.

The Act's own offences for unauthorized access to a computer system or to Critical Information Infrastructure bind the person, software developer, or artificial intelligence tool user who intrudes, and are recorded on this jurisdiction's scraping row.