Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Bangladesh: ICT Department publishes draft Personal Data Protection Bill

On July 24, 2023, the Department of Information and Communication Technology (ICT Department) published the draft Data Protection Bill 2023. In particular, the draft bill would provide for the protection of personal data and its compliance with applicable laws and regulations. The draft bill would apply to the processing of personal data of the residents of Bangladesh and to the data processing that is not carried out in Bangladesh, offering goods and services to the residents of Bangladesh.  

In particular, the draft bill provides for obligations of data controllers and processors, key definitions, data processing principles, provisions on data collection, data retention requirements, data subject rights for children, including rights specific to physically disabled children, data protection by design, the requirement to conduct a Data Protection Impact Assessment (DPIA), data transfer and storage requirements, rights of data subjects, and penalties.

You can read the draft bill, only available in Bengali, here.

Update: November 29, 2023

Cabinet approves data protection bill

On November 29, 2023, OneTrust DataGuidance Research confirmed with Nasir Doulah, Partner at Doulah & Doulah, that the Personal Data Protection Bill 2023 was passed by the Cabinet of Bangladesh.

What are the key features of the bill?

In particular, the bill would apply to the processing of personal data of the residents of Bangladesh and to the data processing that is not carried out in Bangladesh but offering goods and services to the residents of Bangladesh.

More specifically, the bill provides for key definitions such as 'data fiduciary,' 'processor,' 'genetic data,' 'pseudonymized data,' and 'biometric data,' among others. The bill also lays down data protection principles, retention requirements, obligations of data controllers and processors, and rights of data subjects, including the rights of children. Interestingly, the bill also provides for the rights of foreign data holders residing in Bangladesh, stating that the bill would apply to them. Further, the bill lists certain exemptions from its applicability, including, among others, for the prevention of crime and for journalistic, artistic, and literary purposes. 

What are the next steps?

Nasir Doulah confirmed that the "bill shall now be placed at the Parliament for enactment."

You can read the bill, only available in Bengali, here.