CevroBangladesh: Personal Data Protection Act 2026 and what it requires
Personal Data Protection Act 2026: a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by Not yet finalized.
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Not required |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Not required |
| Data localization | Not required |
Penalties and enforcement
Administrative fines under the Act; some provisions deferred.
What to know in practice
Enacted from a 2025 Ordinance; no general data-localization requirement in the final Act, and enforcement is still maturing.
How Cevro helps
- Maps Personal Data Protection Act 2026 to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Bangladesh?
Not yet finalized oversees Personal Data Protection Act 2026.
Is breach notification mandatory under Personal Data Protection Act 2026?
Our reference does not record a fixed hourly deadline for Personal Data Protection Act 2026. Check the statute and Not yet finalized guidance for the notification timing that applies to you.
Does Bangladesh restrict cross-border data transfers?
Our reference records no general restriction on cross-border transfers, although sector rules and contracts can still apply.
Do you need a data protection officer under Personal Data Protection Act 2026?
It is not a general requirement in our reference, though naming an accountable person is still good practice.
What are the penalties for non-compliance in Bangladesh?
Administrative fines under the Act; some provisions deferred.