Bangladesh · Compliance
Bangladesh Personal Data Protection Act, 2026 (PDPA) compliance in Bangladesh
Achieve Bangladesh Personal Data Protection Act, 2026 (PDPA) compliance with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Mumbai office team
- Effivity software included
- Academy training included
Who asks for Bangladesh Personal Data Protection Act, 2026 (PDPA) in Bangladesh
Clients include
Bangladesh Personal Data Protection Act, 2026 (PDPA) compliance in Bangladesh at a glance
Personal Data Protection Act, 2026 (Act No. 63 of 2026) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Bangladesh ask for evidence that you meet it.
Most of Bangladesh's Personal Data Protection Act, 2026 (Act No. 63 of 2026) is deemed to have taken effect on 6 November 2025, while section 23 and sections 31 to 35 wait for a Government notification in the Gazette. The Act treats a person's personal data as that person's own and allows lawful processing with consent. It covers anyone processing personal data inside Bangladesh and reaches processing abroad linked to goods or services offered to, or monitoring of, people in Bangladesh. The regulator is the National Data Management Authority, established under the National Data Management Act, 2026. The Act refers to independent data auditors but creates no certificate, so compliance is shown through records, notices, security measures and oversight of processors, with ISO/IEC 27701 or ISO/IEC 27001 certification by an accredited body as an optional benchmark. Sterling's Mumbai office maps data flows, drafts notices and procedures and builds the evidence, with Effivity and Sterling Academy included with the engagement. Sterling does not give legal advice.
Who needs Bangladesh Personal Data Protection Act, 2026 (PDPA) in Bangladesh, and what happens without it
These are the organisations in Bangladesh that most often need to show Bangladesh Personal Data Protection Act, 2026 (PDPA).
- Businesses that hold customer, member or employee data in BangladeshThe Act treats a person's personal data as that person's own and allows lawful processing with consent, and it covers anyone processing personal data inside Bangladesh.
- Overseas companies serving or monitoring people in BangladeshThe Act reaches processing abroad that relates to goods or services offered to, or monitoring of, people in Bangladesh, so a foreign platform or exporter with Bangladeshi users is in scope.
- Banks, fintechs, telecoms and health providers handling sensitive dataThe Act names sensitive categories such as biometric, genetic and financial data and sets conditions for processing them, so these teams are asked for evidence first.
- Outsourcing, software and cloud providers acting as processorsThe Act defines processors and gives them duties, so customers will ask for contracts, security measures and breach handling in writing.
- Large platforms that may be treated as significant data-fiduciariesThe Act defines this category; whether an organisation falls within it depends on the Act and on later rules, which counsel can check.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkBangladesh Personal Data Protection Act, 2026 (PDPA) requirements in Bangladesh
Strip away the vocabulary and Bangladesh's Personal Data Protection Act requires a business to comply in six areas of personal data handling.
In Bangladesh these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Bangladesh Personal Data Protection Act, 2026 (PDPA) explained →
How to achieve Bangladesh Personal Data Protection Act, 2026 (PDPA) compliance in Bangladesh
One team from the Mumbai office carries the work from scoping to sign-off. Clients across Bangladesh are served from Sterling's Mumbai office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Bangladesh Personal Data Protection Act, 2026 (PDPA) and the Bangladeshi requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Bangladesh Personal Data Protection Act, 2026 (PDPA) compliance take in Bangladesh?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Bangladesh these are the factors that set the timeline.
- Number of systems, files and processing activities to map
- Supplier, processor and cross-border arrangements to review
- Sections still awaiting a Government notification and rules still to come
- Existing ISO/IEC 27001 or ISO/IEC 27701 documentation that can be reused
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Bangladesh Personal Data Protection Act, 2026 (PDPA) compliance cost in Bangladesh?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Bangladesh these factors move both.
- Number of legal entities and data subject groups in scope
- Volume and sensitivity of the data processed
- Security remediation that the risk assessment calls for
- Training for staff who handle personal data
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Bangladesh Personal Data Protection Act, 2026 (PDPA) consultants and assessors in Bangladesh
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Bangladesh Personal Data Protection Act, 2026 (PDPA) and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Bangladesh are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Bangladesh Personal Data Protection Act, 2026 (PDPA) in Bangladesh (3)
| Instrument | How it treats the standard |
|---|---|
| Personal Data Protection Act, 2026 (Act No. 63 of 2026) | The instrument itself Regulated by the National Data Management Authority and covering lawful processing with consent, data subject rights, security, retention, records, breach, data audit and a data protection plan; most sections are deemed to have taken effect on 6 November 2025, while section 23 and sections 31 to 35 take effect on a date the Government notifies in the Gazette. |
| National Data Management Act, 2026 (Act No. 80 of 2026) | Related Sets the framework for national data management and interoperability and provides for the National Data Management Authority, the regulator the Personal Data Protection Act names. |
| Cyber Security Act, 2026 (Act No. 81 of 2026) | Related Covers cyber security and cyber offences, with inspection and audit of critical information infrastructure; it cites no standard and creates no certificate. |
Accreditation, audit language and remote audits in Bangladesh
Compliance, not certification: the Act creates no certificate. Evidence is the business's own records of lawful bases and consent, privacy notices, security and retention measures, breach handling and the results of data audits. ISO/IEC 27701 certification by a certification body accredited for it, or by an accreditation body within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA), is a voluntary benchmark. Ask your counsel and the National Data Management Authority what it will treat as evidence. Edition and transition details: Bangladesh Personal Data Protection Act, 2026 (PDPA) hub →
Audit language
The Act is published in Bangla on the Laws of Bangladesh portal, and it has a section on publishing an English translation, so confirm with counsel which text governs. Privacy notices should reach data subjects in a language they read, usually Bangla; internal records can follow the company's working language.
Remote and on-site
Data-mapping, policy and supplier workshops can run remotely; visits to factories, branches or data rooms are arranged where the scope needs them.
Bangladesh Personal Data Protection Act, 2026 (PDPA) in Bangladesh: questions clients ask
Does Bangladesh's Personal Data Protection Act apply to a foreign company?
It can. The Act applies to anyone processing personal data inside Bangladesh and reaches processing abroad that relates to goods or services offered to, or monitoring of, people in Bangladesh. A company with no presence in the country but with Bangladeshi customers or users should therefore treat the Act as relevant. Bangladeshi counsel can confirm how it reaches your activity.
Is the Personal Data Protection Act, 2026 fully in force?
Mostly. Section 1(3) says all sections except section 23 and sections 31 to 35 are deemed to have taken effect on 6 November 2025, and those sections take effect on a date the Government notifies in the Gazette. Section 23 concerns a Chief Data Officer; sections 31 to 35 concern complaints, administrative penalties and compensation. Check the Gazette for any notification since.
Is there a certificate for the Personal Data Protection Act in Bangladesh?
No. The Act creates no certificate, and compliance is shown through your own records, notices, security and retention measures, breach handling and data audits. The Act refers to independent data auditors, but an audit is not a certificate. ISO/IEC 27701 or ISO/IEC 27001 certification from an accredited body is a voluntary benchmark that never replaces meeting the Act itself.
Who regulates personal data protection in Bangladesh?
The National Data Management Authority, established under section 8 of the National Data Management Act, 2026, is the regulator the Personal Data Protection Act names. The Act has a chapter on the Authority's functions and powers and another on complaints, administrative penalties and appeals. Confirm with your counsel which rules or directions the Authority has issued for your sector.
More on Bangladesh Personal Data Protection Act, 2026 (PDPA) for Bangladeshi organisations
Other standards Bangladeshi businesses ask Sterling for
Organisations in Bangladesh often combine Bangladesh Personal Data Protection Act, 2026 (PDPA) with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Mumbai office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Act, 2026 (Act No. 63 of 2026) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- National Data Management Act, 2026 (Act No. 80 of 2026) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
- Cyber Security Act, 2026 (Act No. 81 of 2026) — bdlaws.minlaw.gov.bd (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Navi Mumbai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
india@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice