Bangladesh PDPA compliance and requirements, so your data handling holds up when someone asks.

What it is

What is Bangladesh's Personal Data Protection Act and what is it used for?

The Personal Data Protection Act, 2026 (Act No. 63 of 2026) is Bangladesh's general law on personal data. It treats a person's personal data as that person's own and allows lawful processing with consent. It sets conditions for sensitive data such as biometric, genetic and financial data and for children's data, gives people rights to access, port, update, correct, erase and object, and requires security measures, limited retention, records, breach handling, data audits and a data protection plan.

The regulator the Act names is the National Data Management Authority, established under section 8 of the National Data Management Act, 2026. The Act covers anyone processing personal data inside Bangladesh and reaches processing abroad that relates to goods or services offered to, or monitoring of, people in Bangladesh. The practical test: for any personal data you hold, could you show its basis, who was told, how it is protected and where it goes?

Current law. Section 1(3) of the Act says all sections except section 23 and sections 31 to 35 are deemed to have taken effect on 6 November 2025; those sections take effect on a date the Government notifies in the Gazette. Section 23 concerns a Chief Data Officer; sections 31 to 35 concern complaints, administrative penalties and compensation. The Act is published in Bangla, so confirm with your counsel which text governs and whether any notification has followed.

Who it is for

Who needs to comply with the Bangladesh PDPA?

The Act applies to anyone processing personal data inside Bangladesh, whatever their size, including employers holding staff records, and it reaches overseas businesses serving or monitoring people there. Organisations usually come to Sterling for a structured programme from one of four directions:

• You hold customer, member or employee data in Bangladesh. The Act treats a person's personal data as that person's own and allows lawful processing with consent, so every business with such records needs a basis, notices and safeguards it can show.
• You serve or monitor people in Bangladesh from abroad. The Act reaches processing abroad that relates to goods or services offered to, or monitoring of, people in Bangladesh, so a foreign platform or exporter with Bangladeshi users is in scope.
• You handle sensitive data. Banks, fintechs, telecoms and health providers hold biometric, genetic or financial data, which the Act allows only on its specific conditions, so these teams are asked for evidence first.
• You process data for others. The Act defines processors and gives them duties, so outsourcing, software and cloud customers ask for contracts, security measures and breach handling in writing.

The aim is handling of personal information that you control and can evidence. Compliance depends on how the rules are applied every day, not on a policy document alone.

Requirements

What are the main Bangladesh PDPA requirements?

Strip away the vocabulary and Bangladesh's Personal Data Protection Act requires a business to comply in six areas of personal data handling. The list below puts each one in business terms; the Act and the regulator's guidance give the full wording and exceptions.

• Processing rests on a lawful basis: personal data is processed lawfully, chiefly with the person's consent, and any further processing meets the conditions the Act sets.
• Sensitive and children's data get extra care: biometric, genetic, financial and other sensitive data, and data about children or people unable to consent, are processed only on the Act's specific conditions.
• People can use their data rights: requests to access, port, update, correct, erase or object to processing, and to withdraw consent, are received and carried through every system.
• Data is secured, limited and recorded: security measures protect personal data, retention is limited to what the purpose needs, and records show how the Act is being followed.
• Breaches and audits are managed: personal data breaches are handled as the Act requires, and data audits and a data protection plan show that processing stays under control.
• Storage and transfer rules are tracked: personal data is classified, and the Act's rules on storage and transfer, with the Authority's directions and any Government notification, are followed.

Compliance route

How do you achieve Bangladesh PDPA compliance?

There is no certificate at the end of this route. Compliance is something your organisation demonstrates, to the National Data Management Authority if a complaint or incident arises, and to customers who ask. Sterling helps you build and run the programme; interpretation of the law in contested cases remains with your legal advisers and, ultimately, the regulator and the courts.

1. 01
   Map the personal information you handle.Customers, members, staff and any other individuals: what is collected, on which basis, where it is stored, how it is classified, who processes it for you and whether it leaves Bangladesh.
2. 02
   Gap analysis: compare current practice with the Act.Each area of the Act reviewed against what actually happens, with actions, owners and dates agreed.
3. 03
   Put the controls and routines in place.Update notices and consent wording, set rules for sensitive and children's data, put security and retention measures in place, govern processors by contract, agree a breach procedure and plan the data audits and the data protection plan.
4. 04
   Test the programme and review the results.Internal review of samples, a simulated incident or data-subject request, and a management review that closes findings with evidence.
5. 05
   Operate, demonstrate and keep it current.Answer requests, record incidents, run the data audits, refresh training and follow the Authority's directions and any Government notification as they are issued.

Check the route before you sign. The Act creates no certificate, so treat any offer of a "PDPA certificate" with suspicion. If a customer wants independent assurance, ISO/IEC 27701 is certifiable by a certification body accredited for it; confirm the body's accreditation directly with the accreditation body concerned. Ask your counsel and the National Data Management Authority what they will treat as evidence.

Cost

How much does Bangladesh PDPA compliance cost?

The cost of a Bangladesh PDPA programme is driven by how much personal information you hold, how many systems and suppliers touch it, and how much already works. Your proposal shows each component, with what is included and what remains for your legal advisers.

Timeline

How long does Bangladesh PDPA compliance take?

Timing depends on how scattered your personal information is, how quickly system owners respond and how much has to change. Your proposal sets out the phases for your scope, long enough to map the information, fix the gaps and show that requests and incidents are handled the way the procedures say.

If a customer or contract has set a date, tell us at the outset and we will say plainly what can be in place by then and what should follow.

Your engagement

What your Bangladesh PDPA engagement includes

Your scope covers the full programme, from the information map to evidence that runs. Sterling does not certify, attest or validate compliance with the Act, and the Act creates no certificate of compliance; the National Data Management Authority supervises it, and we work alongside your legal advisers.

• Information map, gap analysis and plan

  Sources, systems, suppliers and overseas flows, with actions and owners agreed.

• Policies, notices and procedures

  Notices, consent wording, rules for sensitive and children's data, request, security, retention and breach procedures, drafted from Sterling's own templates with your teams.

• Effivity ISO & GRC software

  Registers, requests and incidents managed in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal review and management review

  Sample testing, an incident exercise and findings closed with evidence.

• Data protection plan and audit support

  Help preparing the data protection plan and getting ready for data audits, with findings closed with evidence.

Sterling OS™ sets how we deliver. Design™ is guided support, where your team builds the programme with our consultants' direction; Drive™ is managed support, where our consultants do most of the work with your input. You choose one of the two, not both in sequence. Once the programme is operating, Sustain™ keeps reviews, training and updates on schedule, and Automate™ is Effivity, where the records live.

The Act names the National Data Management Authority, established under the National Data Management Act, 2026, as its regulator.

Often combined with

Standards organisations pair with PDPA (Bangladesh)

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.