Bangladesh

Section 25(1) makes it an offence for any person, through a website or other digital or electronic medium, intentionally or knowingly to send, publish, or broadcast, or threaten to send, publish, or broadcast, any information, video, audio-visual footage, still image, or graphics that is captured, edited, or created or edited by artificial intelligence, and displayable, where it was created for, obtained for, or preserved for the purpose of blackmail, sexual harassment, revenge pornography, digital child-sexual-abuse material, or sextortion, and is harmful or intimidating.

Section 25(2) sets the base penalty at up to two years' imprisonment, or a fine of up to BDT 1,000,000, or both; section 25(3) raises it to up to five years' imprisonment, or a fine of up to BDT 2,000,000, or both, where the victim is a woman or a child under eighteen.

The Act's own commencement clause deems it, including this section, to have come into force on 21 May 2025, the date its immediate predecessor, the Cyber Security Ordinance 2025, took effect; that Ordinance had itself replaced the Cyber Security Act, 2023.

Section 20(1) requires a Data Fiduciary to notify the Authority of a personal data breach, in the form, manner, and time prescribed by regulation, whenever the breach creates a possibility of significant harm to the affected data principal. Section 20(2) lists factors, nature of breach, affected-principal categories and counts, contact details, and mitigation steps, that the Authority considers in gauging severity, again by regulation not yet located.

No statutory deadline (no 72 hour figure) appears in the Act itself, and no separate duty to notify the affected data principal directly was found in the sections read.

Section 5 requires a Data Fiduciary to have a lawful basis before processing personal data: voluntary, specific, clear, revocable consent (s.5(2)), or one of seven enumerated legitimate-interest grounds without consent (contract performance, pre-contractual steps, legal-claims necessity, vital interests, employment/labor/social-security legal duties, the data principal's own voluntary public disclosure, or preventing harm from unreasonably withheld consent).

A Data Fiduciary determines purpose and means and remains liable for a Processor's processing (s.8). Section 18 bars retaining data beyond what the purpose requires, subject to a scientific, historical, statistical-research, or public-interest exception. In force since 6 November 2025, deemed retroactively by the Act's own commencement clause.

Section 29(1) empowers the Government to classify personal data into four tiers by Schedule (public/open, internal, confidential, restricted). Transfer abroad is permitted with the data principal's consent, under a contract to which they are party involving goods or services, or with consent for their business, education, or travel/migration interests (s.29(3)), and the destination must have adequate technology and safeguards for personal-data storage per regulation (s.29(4)).

Bulk cross-border transfer of sensitive personally identifiable data, including a biometric identifier such as a fingerprint, facial-recognition data, or iris scan, requires mandatory notification to the Authority where it could threaten sovereignty, national security, or financial stability (s.29(6)).

No blanket data-localization mandate appears in the enacted text, correcting the amendment-ordinance stage's residency mandate, which industry comment reports was removed in the revision that became this Act.

Once operative, a data principal or any person with reason to believe a rights violation occurred may file a complaint with the National Data Management Authority (s.31); the Authority may impose an administrative fine of up to BDT 2,500,000 for a rights violation (s.32) and separately up to BDT 2,500,000 for a security or protection failure (s.33), with factors for setting the fine listed at s.34, plus compensation to the complaining data principal in addition to the fine (s.35).

Section 36 lets the Authority fine individual company officials personally implicated in a rights-violation complaint. Appeal against an Authority fine or compensation order runs to the Tribunal established under section 68 of the Information and Communication Technology Act, within 30 days (s.37).

None of this is currently operative: sections 23 and 31 to 35 are excluded from the Act's own retroactive commencement deeming and await a separate Government gazette notification, expected roughly 18 months after the Act's gazetted predecessor (a date not yet reached or notified as of the date shown). No standalone private civil right of action (a direct court suit) was found; the only individual remedy is the Authority's own compensation power under section 35, and that too is deferred.

Biometric Data is defined (definitions item 14) as personal data created through measurement or technical processing of a person's physical, physiological or behavioral characteristics, capable of uniquely identifying a specific person, expressly naming DNA, blood group, fingerprint, facial image, iris scan, voiceprint, and gait pattern as examples.

It is one of the enumerated Sensitive Personal Data categories (item 21), alongside genetic data, ethnic and community data, political or religious belief, trade union membership, health data, sexual orientation, criminal-record data, and real-time geolocation data.

Section 7 processing conditions for sensitive data are narrower than the ordinary section 5(3) legitimate-interest grounds: specific consent, contract necessity, an employment or social-security legal duty, a health worker's treatment duty or life or health emergency, a duty imposed by law, or the data principal's own voluntary public disclosure of the data.

Section 18(1)(a) makes it an offence for a person intentionally to gain illegal entry into a computer, digital device, computer system, or computer network, or to assist another to do so, punishable by up to one year's imprisonment or a fine of up to BDT 1,000,000, or both. Section 18(1)(b) raises the offence, and the penalty to up to two years or BDT 2,000,000, where the illegal entry is for the purpose of committing an offence.

Section 18(1)(c) raises it further, to up to five years or BDT 5,000,000, where the illegal entry (described as hacking) results in theft, destruction, cancellation, or alteration of information from a data store, in a diminution of its value or utility, or in an artificial intelligence agent generating new data through that access.

The Act does not define "illegal entry" by reference to defeating a security measure or exceeding an authorisation, so the provision's reach over a scraper reading a public, unauthenticated page is not addressed by the text read.

Section 2(11) lists a database among the eight enumerated categories of a copyrightable "work", alongside literary, dramatic, musical and artistic works, film, sound recording, broadcast, and performance.

Section 2(16) defines "database" as an electronically or otherwise systematically arranged collection of original works in which the compiler's own intellectual expression exists and which can be used through electronic or other means, an originality-based standard rather than an investment-based sui generis extraction right of the kind the EU Database Directive creates.

The Act does not carry a text-and-data-mining exception, and its general reproduction and "good use" exception for a literary work (s.70(1)) leaves the purpose and conditions under which reproduction does not infringe copyright to be set by Rules not otherwise identified.

The Agency maintains a National Computer Emergency Response Team and a National Security Operation Center, and every entity the Government designates as Critical Information Infrastructure must maintain its own Computer Emergency Response Team or Computer Incident Response Team and Security Operation Center.

Any government, private, or autonomous organization or institution that experiences a cyber incident must, without delay, inform the National Computer Emergency Response Team under the Agency. The Act names no fixed number of hours or days for that notification. No provision of the Act states a penalty specific to a failure to give this notification.

The Act's own offences for unauthorized access to a computer system or to Critical Information Infrastructure bind the person, software developer, or artificial intelligence tool user who intrudes, and are recorded on this jurisdiction's scraping row.