The framework
Bangladesh has enacted the Personal Data Protection Act, 2026 (Act No. 63 of 2026), but the regime is not yet fully operative.
That puts Bangladesh in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Personal Data Protection Act, 2026 (Act No. 63 of 2026)
Bangladesh now has a data protection statute. Parliament passed the Personal Data Protection Act on 9 April 2026, replacing the interim government's 2025 ordinance, and most of it is treated as in force from 6 November 2025. The fines, complaints and chief data officer provisions wait for a government notice at least 18 months after enactment, and the new National Data Management Authority is still being built.
Marketing and advertising
Consent-based processing under the 2026 Act; the complaints, fines and compensation provisions start only when the government notifies them, no earlier than October 2027. That single sentence decides most channel plans here.
Cross-border transfers
The Act regulates transfers abroad, with the National Data Management Authority as supervisor once it is operating.
Enforcement and penalties
Administrative fines and compensation provisions are deferred until the government notifies them, no earlier than October 2027.