Is Bangladesh's Data Protection Law Already in Force?

Bangladesh gazetted the Personal Data Protection Ordinance on 6 November 2025; it was amended by a further ordinance on 5 February 2026; and it has been reported as converted into an Act in force from 15 April 2026, which would make it the country's first comprehensive data protection statute.

I have written reported deliberately, and I will come back to why.

The confusion comes from that last row. A particular set of obligations, the enforcement machinery, the appointment of a data officer by larger controllers, and the complaint and penalty procedures, are understood to be deferred for roughly eighteen months from the original gazette.

If that reading is right, and it is the reading every briefing I have seen adopts, then the deferral is narrow rather than general. The substantive definitions and the transfer rules would not be the parts deferred.

Which would mean the standard applies to you now, and only the machinery that comes looking is still switched off. Those are very different things, and the gap between them is the window that everyone building in Bangladesh currently has. I would rather people used it than discovered it had closed.

This is the detail I most want to put in front of people, because I have not seen it reflected in the local compliance guidance I have read.

The regime as gazetted in November 2025 contained a data residency requirement framed around keeping a synchronised real-time copy of cloud-stored data inside Bangladesh. A great many architecture decisions in this country were taken in late 2025 on the strength of that text.

The February 2026 amendment changed it. The law firm briefings I have read indicate the position moved away from a blanket in-country copy toward something narrower, tied to restricted data and critical infrastructure, alongside a discretionary power for the authority to require relocation.

Now the caveat, which is not a small one. I have not obtained a consolidated official text of the Act as enacted; the national law portal has been intermittently unreachable through 2026, and the published commentary is not fully consistent with itself. That is precisely why I am not quoting you section numbers from this particular statute, and why everything in this section is a question to put to your counsel rather than a conclusion to act on.

But the direction is not in dispute anywhere I have looked. Bangladesh wrote a data residency rule in November 2025 and rewrote it inside three months. If your hosting architecture was designed between those two dates and has not been revisited since, it is built on a rule that has moved underneath it.

We are building a product that will record customer conversations, so this is a question I have to answer before anybody asks it of me.

The statute treats biometric data as a sensitive category carrying heavier obligations. Whether a stored recording of a customer's voice sits inside that category appears to depend on what is done with it; a recording kept for quality review is one thing, and a voiceprint used to recognise a returning caller looks considerably more like a biometric identifier.

I have looked for a published Bangladeshi view on where that line falls and have not found one. I would welcome being pointed at it if it exists.

In the meantime we took a position, which I offer only as a description of ours. We treat recordings at the cautious end: consent for the recording handled as a separate and specific matter from consent for the transaction; a defined retention period; and no voiceprint-based identification at all.

That last one costs us something real. It means we cannot recognise a returning caller by voice, so a call begins by asking for a phone number, exactly like everybody else's. On an unsettled question, that seemed the better side to be standing on.

Data protection takes the attention; the filing calendar is what quietly does the damage.

Under the Companies Act 1994 a company may hold its first annual general meeting within eighteen months of incorporation, and thereafter not more than fifteen months may pass between meetings. The annual return is then filed with the Registrar within twenty-one days of that meeting.

The penalty is the part nobody sees coming. It is a daily fine, and it can attach not only to the company but to officers who knowingly permitted the default, which means it accrues quietly against individuals while everybody is busy building the actual business.

Two more that cost nothing to know and a good deal to learn late. Registering your company name at RJSC is not trade mark protection. They are different registers under different statutes with different examiners. A company name is cleared against a register of company names; a trade mark is registered with the Department of Patents, Designs and Trade Marks. Having the first gives you very little of the second, and a striking number of founders here believe otherwise.

And the trade mark opposition window is short. Section 18(1) of the Trademarks Act 2009 provides that any person may, within two months from the date of the advertisement of an application, give notice of opposition. Two months. If somebody applies to register something close to your mark and you notice in month three, ask counsel quickly what remains open to you, because that particular door is built to shut.

There is also a provision on identical company names giving the Registrar a role, which is an administrative route rather than a litigation one. Most founders I have spoken to have never heard of it and get sent straight to passing off. It is worth asking your advocate whether it is available to you before you spend money the slow way.

We incorporated in November 2025, and everything above is something we worked through over the last nine months, largely from the primary instruments, because the practical guidance either did not exist yet or predated the changes.

I do not think that is anybody's fault. Firms here publish what generates instructions, so incorporation and trade mark filing are well covered and ongoing filing discipline is not; the instruments themselves moved twice inside ninety days; and keeping current is genuinely hard, which I know because I do not always manage it.

The result, though, is that a number of good companies here are operating on a picture of the law that is six to twelve months out of date, and the gap is widest in exactly the places where the consequences are heaviest.

If you run a technology company in Bangladesh, the useful next hour is not reading more articles like this one. It is opening your own file and checking three dates: when your first AGM falls due, when your annual return was last filed, and whether your marks are actually registered or only your company name. Then take the data question to a lawyer, because that one is still moving.

Md. Ajmal Hossen is a co-founder, Managing Director and Chief Operating Officer of Omnistra Private Limited, Dhaka, which builds Bangla and English voice and messaging agents and Order OS for cash-on-delivery commerce. He is a company director and not an enrolled advocate. Nothing in this article is legal advice; Bangladeshi law reserves legal practice to advocates enrolled with the Bar Council, and the questions raised here are ones to put to one.