2026

Cyber Protection Act

Speech, online content and cybercrime.

Freedom of expressionMedium risk

Civic participation & democratic processHigh risk

Privacy & data protectionMedium risk

How it affects you.

A complaint is made about something you posted.

The law’s two speech offenses cover sexual harms and blackmail, and religious, communal or ethnic hate speech. Police may arrest for the first without a warrant; for the second they need one. Both are bailable as a matter of right.§§25, 26

What it protects

Within 24 hours of a complaint being filed, the detainee must be presented before a magistrate, who then has 24 hours to order an investigation or dismiss the complaint and order release.§31(3)–(4)
Only a person directly aggrieved, someone they authorize in writing or a law-enforcement officer may file a case.§40

Where it falls short

Posting online is not, by itself, an offense. However, the distinction matters before a case reaches trial. Vague offense definitions and inconsistent observance of arrest safeguards can expose people to detention and legal costs even when a complaint lacks merit.
The legal requirement for an aggrieved person or an authorized representative to file cases is not routinely followed.

Your content is taken down.

The cyber agency’s chief, or law enforcement acting through the agency, can have content removed or blocked first. A tribunal must then approve within three days.§8

What it protects

If a tribunal has not approved a removal in time, the content must be restored.§8(4)
The government must publish information about all the content it has blocked.§8(3)

Where it falls short

Your content can disappear before a tribunal reviews the decision.
The framework does not clearly explain how you are notified, how you can challenge removal, or how restoration is enforced.
There is no avenue for users to report harmful content under this procedure.

An investigation reaches your device.

Investigators can take your devices and data. Police need a warrant from the tribunal or a chief magistrate to get your data from a service provider or interfere with your communications. Without a warrant, they can search, seize and arrest only in hacking cases where evidence could be lost.§§33–35

What it protects

Investigators must promptly tell the court what they have seized, and police must report every warrantless search to the tribunal.§§33(4), 35(2)
Anyone arrested in such a search must be brought before a magistrate or the tribunal within 24 hours, as the Constitution requires.§35(3)

Where it falls short

Access to a device can expose personal or business information unrelated to the alleged offense.
There are no sufficiently clear rules for limiting access, securing the data, and returning or destroying what was seized.

Someone accuses you or your company of assisting an offense.

Assisting someone to commit an offense under the law carries the same penalty as the offense itself. When a company or other entity commits one, its owners, managers and staff can be held liable too.§§27, 29

What it protects

Only those directly involved are liable, and each is cleared by showing the offense happened without their knowledge or that they did their best to prevent it.§29

Where it falls short

Company employees can be held liable for corporate actions, reversing the burden of proof and the presumption of innocence.
Aiding and abetting carries the same maximum penalty as the main offense, whatever the degree of involvement.

The law

What the law says.

What it criminalizes: Sexual harms and blackmail^§25
Religious or ethnic hate speech^§26
Aiding an offense^§27
Hacking critical infrastructure^§17
Unauthorized access^§18
Malware, phishing and ransomware^§19
Cyber forgery^§21
Online fraud^§22
Cyber terrorism^§23
Unauthorized e-transactions^§24
What it lets the state do: Remove or block content^§8
Search, seize and arrest^§§33–35
Compel information, under secrecy^{§§38, 39}
Use evidence despite the Evidence Act, 1872^§43
What it exposes you to: Up to 2 years, a fine up to BDT 1,000,000, or bothSexual-harm and hate-speech offenses^{§§25, 26}
Up to 5 years, a fine up to BDT 2,000,000, or bothSexual harms against a woman or a child^§25(3)
Up to 10 years, a fine up to BDT 10,000,000, or bothCyber terrorism^§23
Arrest without a warrant^§25
A warrant is needed to arrest^§26
Company staff involved must show they did not know^§29
What it protects: Bail as a right^{§§25, 26}
Magistrate review within 24 hours^{§31(3)–(4)}
Limits on who may file a case^§40
False complaints are punishable^§28
Restoration if a tribunal does not approve in 3 days^§8(4)
Blocked content must be made public^§8(3)
Old speech cases dropped, their sentences void^§50

Sexual harms and blackmail

§25

It is an offense to publish or circulate any content, including AI-made material, meant for blackmail, sexual harassment, revenge porn, sextortion or child sexual abuse.

Hacking, fraud and other cyber offenses

§§17–24

Other offenses cover illegal access to critical infrastructure and computer systems, phishing, malware and cyber ransom, cyber forgery (which now includes running a gambling portal), online fraud, cyber terrorism and e-transactions without legal authority. The separate online-gambling offense was deleted in 2026.

Search, seizure and arrest powers

§§33–35

An investigator can take control of computers, devices and stored data. Seizing traffic data held by a service provider, or interfering with electronic communications, needs a warrant issued by a competent judicial authority. Without one, police may enter, search, seize equipment and arrest people present only in cases of hacking or attacks on critical infrastructure, if evidence might otherwise be destroyed.

Compelled information, secrecy and evidence

§§38, 39, 43

An investigator can compel any individual or company to hand over information and assist, and everyone involved must keep this secret. Forensic evidence gathered under the law counts as evidence at trial, whatever the Evidence Act, 1872 or other laws say.

What happens to cases under the old laws

§50

The law repeals the Cyber Security Act, 2023. Cases under that law’s speech-related sections, and under the same sections of the Digital Security Act, 2018, are cancelled and sentences under them are void; other cases continue. It does not clarify the status of cases under the Information and Communication Technology Act, 2006.

Analysis

Where the framework falls short.

The Cyber Protection Act 2026 repeats the flaws of its predecessors (Digital Security Act, Cyber Security Act)

Order reversed

Removal before a court reviews it

§8

The removal power is executive-led: it offers no channel for users to report harmful content and no prior judicial check.

1 · RemovalBy an executive authority

2 · Tribunal reviewAfterwards, within three days

The check arrives after the act it is meant to check.

Undefined

Religious, communal and ethnic hate speech

§26

The offense covers posting religious, communal or ethnic hate speech that creates violence or anxiety, or directs disorder or crime, including through a fake or hijacked account. “Hatred,” “fear” and “disorder” are undefined, and so is how directly the post must cause the harm.

Bundled

Different harms, one penalty

§25

One provision gathers distinct harms under a single penalty, whatever their severity.

Too wide

Security research is not distinguished

§§17–19

The illegal-access provisions could expose good-faith security researchers to criminal liability. Identifying a vulnerability to improve security is not clearly distinguished from malicious access.

Too wide

No safe harbor for platforms

The law contains no safe-harbor clause, so nothing in it shields a platform from liability for its users’ content.

Earlier lawsSafe-harbor protection for intermediaries

The 2026 lawPossible liability for users’ content

Burden flipped

Officers carry the burden of proof

§29

Company officers must prove they did not know or tried to prevent the offense, reversing the usual burden of proof.

Who decides

The cyber agency’s independence

§§5, 12

Nothing in the law makes the cyber agency independent: it is an attached office of the ICT Division, the government appoints and directs its members, and its duties are left to future rules.

The national council consists of at least 24 members, chaired by the prime minister.

Doubled

One act, two laws

§25

The same conduct, such as revenge porn or child sexual abuse material, is punishable under this law and under the Pornography Control Act, with different penalties.

Same conduct

Cyber Protection ActPornography Control Act

Different penalties

Recommendation

Amend or replace.

Substantially amendA narrower, rights-respecting framework

ReplaceA comprehensive Online Safety Act

Two alternative reform paths, not current law.

Distinguish between different harms

The offenses should be split into clearly defined categories: CSAM, non-consensual intimate imagery, deepfakes, sextortion, grooming, cyberstalking, doxxing and more.

How others do it

Intermediary duties without blanket liability

Referenced to show different approaches, not as models for adoption.

European Union

Digital Services Act

Keeps conditional liability exemptions for intermediaries while adding due-diligence, notice-and-action, transparency and systemic risk-mitigation duties.

Read the text

United Kingdom

Online Safety Act 2023

Imposes duties of care and risk management scaled to a service’s nature, functionality and size, instead of treating platforms as publishers.

Read the text

Australia

Online Safety Act 2021

Pairs notice-and-removal with review and accountability safeguards.

Read the text

Singapore

Online Safety (Relief and Accountability) Act 2025

Defines incitement of violence by whether a reasonable person would conclude the material incites, or is likely to incite, unlawful force against a group.

Read the text