Inside Bangladesh’s Cyberspace

Inside Bangladesh’s Cyberspace: Their Rules, Your Rights

Unpacking How a Web of Laws is Governing Your Life Online

Find your situationSee network of laws
Read the white paper

Your life runs on rules in which you have little say.

  1. You live part of your life online.

    You post, message, shop, bank and share personal details through your devices.

  2. Laws set the rules.

    The government decides what you can say, who can see your data, and what happens when something goes wrong.

  3. The rules do not always protect you.

    Many use vague words and give officials wide powers with few human rights safeguards, while lacking adequate rules to regulate platforms and hold them accountable. That can put your rights and interests at risk.

  4. We explain the main ones in plain language.

    For each: what it says, what it protects and where it falls short.

Start with your digital life.

Open any situation to see what Bangladesh’s laws say, what they protect and where they fall short.

When you speak up

What happens to what you post, and to what others post about you?

You post something online.

Posting online is not, by itself, an offense.

What the law says

While the cyber law (CPA) covers sexual harms, blackmail and religious, communal or ethnic hate speech, the penal code keeps colonial-era speech offenses on sedition, religious feelings and public order.

What it protects

  • Both speech offenses are bailable as a matter of right.§§25, 26 (CPA)
  • Arrest for the hate-speech offense requires a warrant.§§26, 46 (CPA)

Where it falls short

  • “Hatred,” “fear” and “disorder” are undefined, and proving their connection to actual harm can be difficult.
  • A mere attempt or likelihood can be enough, with penalties the same as the main offense.

Main laws involved

Go deeper

When police can arrest you for a postSpeech offenses in the Penal CodeOnline speech across the main laws

Your post is removed or blocked.

Who ordered removal, and when does a tribunal review it?

What the law says

The cyber agency’s chief can remove or block content, or ask the telecom regulator to, and law-enforcement agencies act through the chief. A tribunal must approve within three days.

What it protects

  • If a tribunal has not approved a removal in time, the content must be restored.§8(4) (CPA)
  • The government must publish information about all the content it has blocked.§8(3) (CPA)

Where it falls short

  • The removal can happen before any judge has looked at it, and it remains unclear how the content can be restored.
  • There is no route for users to report harmful content, and no notice, challenge or appeal.

Main laws involved

Go deeper

Removal, review and restorationA telecom law that now reaches platformsContent takedown across the main laws

Someone files a complaint about you.

A complaint, an arrest and a conviction are three different things.

What the law says

Only a person directly affected, someone authorized to act for them, or a law-enforcement officer may file a case under the cyber law (CPA). One speech offense allows arrest without a warrant; the other needs one.

What it protects

  • Filing a case to harm someone, knowing it has no lawful grounds, is itself an offense, punished like the offense it alleged.§28 (CPA)
  • Within 24 hours of a complaint being filed, the detainee must be presented before a magistrate, who then has 24 hours to order an investigation or dismiss the complaint and order release.§31(3)–(4) (CPA)
  • Pending cases under the speech sections of the 2023 and 2018 cyber laws are dropped, and sentences already passed under them are void.§50 (CPA)

Where it falls short

  • No evidentiary threshold applies before an investigation, arrest or other coercive step begins.
  • The law does not define a “lawful” or “just” complaint, which weakens the penalty for false ones.
  • The legal requirement for an aggrieved person or an authorized representative to file cases is not routinely followed.

Main laws involved

Go deeper

Who may complain, and what the law providesWhat happens to cases under the old laws

Someone says your post harmed their reputation.

A statement about someone can become a criminal case.

What the law says

Criminal defamation carries up to two years’ imprisonment and/or a fine. The Code sets out ten exceptions, including truth for the public good and comment on the conduct of public servants.

What it protects

  • Criminal defamation carries ten exceptions, including truth for the public good and comment on public servants.§499 (PC)

Where it falls short

  • Those exceptions do not remove the threat of criminal proceedings.
  • How they are interpreted varies, which leaves people discussing matters of public interest uncertain.

Main laws involved

Go deeper

Criminal defamation in the Penal CodeOnline speech across the main laws

Someone shares an intimate image of you.

Two laws cover this act, with different penalties and bail rules.

What the law says

While the cyber law (CPA) covers content used for sexual harassment, revenge porn, child sexual abuse material, sextortion and blackmail, a separate pornography law (PCA) also covers some of these materials, with separate penalties. Meanwhile, the penal code punishes insulting a woman’s “modesty.”

What it protects

  • Threats to publish intimate material are covered, not only publication.§25 (CPA)
  • Penalties are graded, with heavier punishment for child pornography than for adult material.§8 (PCA)

Where it falls short

  • These harms count only if they have a “harmful or intimidating” effect.
  • “Revenge porn” is defined narrowly and requires proving intent to cause harm.

Main laws involved

Go deeper

When an allegation involves sexual harmThe cyber law’s sexual-harm offenseIntimate-image abuse, law by law

When you share your data

Who can see, keep and link your information, or search your phone?

An organization holds your data.

You gain rights over your data; others gain grounds to use it without asking.

What the law says

The data-protection law makes consent one basis for using your data. It also allows use without consent for reasons such as a contract, a legal claim or protecting life or health.

What it protects

  • You can see your data and who received it, and correct, update or delete it, withdraw consent or object to processing.§§11–13 (PDPA)
  • Approved changes and deletions must carry across connected systems.§14 (PDPA)

Where it falls short

  • Broad alternative grounds can make consent functionally optional.
  • Deletion needs safeguards where personal data appears in journalism or other public-interest content.

Main laws involved

Go deeper

Consent, correction and deletionYour personal data across the main laws

A breach exposes your data.

A breach does not, by itself, have to be reported.

What the law says

An organization must report a breach to the data authority only if it is likely to cause significant damage, and it need not tell you. For national systems such as the data exchange, the data-management law names security principles but leaves detailed standards to future rules.

What it protects

  • A breach likely to cause significant damage must be reported to the data authority.§20 (PDPA)
  • Zero-trust architecture, privacy-preserving principles, auditability and minimization are named in the law.§§2, 33 (NDMA)

Where it falls short

  • An unclear “significant” threshold leaves room for underreporting.
  • Incident response, encryption standards and vulnerability disclosure are left undefined or to future regulations.

Main laws involved

Go deeper

When a breach must be reportedWhen a public system is breachedBreaches and hacking across the main laws

Your child goes online.

Your consent is needed for your child’s data, but the law does not say how it is checked.

What the law says

Using a child’s data needs a parent’s or guardian’s consent, and the child’s rights and interests must be taken into account. The cyber law (CPA) covers child sexual abuse material, and the pornography law (PCA) punishes child pornography more heavily than adult material.

What it protects

  • Your consent as a parent or guardian is needed before an organization collects or uses your child’s data.§9 (PDPA)
  • Penalties are graded, with heavier punishment for child pornography than for adult material.§8 (PCA)

Where it falls short

  • The law leaves how parental consent is given to future regulations, and says nothing on verifying it or assessing age.
  • Parental consent can stay valid until 18, with no step for the young adult’s own consent.

Main laws involved

Go deeper

Children’s data and consentChildren online across the main laws

Your records are linked across public services.

Six foundational records flow into one national exchange.

What the law says

National ID, passport, tax, address, birth registration and driving-license databases must connect to a national data exchange, with storage in national data centers where deemed expedient. The government may classify “nationally important / sensitive data” and restrict its exchange.

What it protects

  • You can complain to the data authority when your data rights are violated; it can impose fines up to BDT 2,500,000 and award you compensation.§§42, 44 (NDMA)
  • Zero-trust architecture, privacy-preserving principles, auditability and minimization are named in the law.§§2, 33 (NDMA)

Where it falls short

  • Linking identity records makes detailed profiles easier to build, with limited safeguards against reuse.
  • The “nationally important” category has no objective criteria, independent review or route to challenge.

Main laws involved

Go deeper

What linking public records changesWho oversees the data authority

Your calls and messages are monitored.

Approval can come from inside government; an independent council looks only afterwards.

What the law says

The telecom law (BTA) sets up a central interception platform under the Ministry of Home Affairs, open to multiple agencies, and lawfully intercepted material can be used as evidence. The data-protection law waives your consent on grounds such as national security and public order.

What it protects

  • In most cases, interception needs prior approval from a court or an authority the government sets up, and must be necessary, proportionate, time-limited, a last resort and fully logged.§97A (BTA)
  • An exemption waives consent only: every other rule on handling your data still applies.§24(2) (PDPA)

Where it falls short

  • The enacted law dropped the draft’s requirement of prior authorization by an independent council.
  • In an emergency, the government’s designated authority can approve interception by itself.
  • It remains unclear how the interception authorization provision will operate in reality, and how it will interact with data protection obligations.

Main laws involved

Go deeper

How interception works nowState use of your data without consentThe security-first thread

Your phone or laptop is searched.

A search for one offense can expose data unrelated to it.

What the law says

Cyber-law investigators can take devices and data, but may search, seize and arrest without a warrant only in hacking cases where evidence could be lost. The pornography law (PCA) also allows search and seizure, and telecom inspectors can seize unlicensed equipment.

What it protects

  • Investigators must promptly tell the court what they have seized, and police must report every warrantless search to the tribunal.§§33(4), 35(2) (CPA)

Where it falls short

  • Police need only record their reasons, and none of these laws sets rules for handling, returning or deleting seized data.
  • Seized devices and data can be presented openly in court, exposing private conduct.
  • Access to national monitoring systems has been reportedly misused in the past: in one reported case, two law enforcement officers’ credentials were used to collect and sell national ID details and call records. Our breach report

Main laws involved

Go deeper

When investigators take your devicesPrivate material and search powersSearch powers across the main laws

When you buy and sell

What protects you when you run a business online or get scammed?

You run an online shop, page or platform.

You can be held liable for assisting an offense committed through your service.

What the law says

Under the cyber law (CPA), assisting an offense carries its full penalty, and when a business commits one, staff directly involved must prove they did not know or tried to stop it. The telecom law (BTA) now appears to reach online intermediaries, and the Penal Code bans prizes offered to promote sales.

What it protects

  • Only those directly involved are liable, and each is cleared by showing the offense happened without their knowledge or that they did their best to prevent it.§29 (CPA)

Where it falls short

  • It is unclear how the telecom law’s licensing requirement applies to digital platforms.
  • The ban on sales prizes could reach discount codes, cashback and loyalty programs.

Main laws involved

Go deeper

Liability for assisting an offenseRunning an internet-based servicePromotions under a 1965 rule

Someone hacks your account or scams you online.

Hacking and online fraud are crimes, but one penalty covers very different acts.

What the law says

The cyber law (CPA) criminalizes illegal access to devices, systems and networks, phishing, malware and ransomware, online fraud, cyber forgery and e-transactions without legal authority.

What it protects

  • Hacking into a device or network, phishing, malware, ransomware and online fraud are offenses.§§18, 19, 22 (CPA)

Where it falls short

  • Collecting data without authorization is treated as gravely as spreading malware or sending phishing or ransomware mail.
  • The same broad offenses can catch ethical hacking, penetration testing and security research, which weakens security overall.

Main laws involved

Go deeper

Hacking, fraud and other cyber offensesWhy security research is at riskBreaches and hacking across the main laws

Risk map

Your rights,
law by law.

Explore the overall assessment. Each classification is indicative rather than exhaustive and should not be interpreted as a definitive assessment of the current human rights impact of the statutes. Click on the law or its classification for that law’s fuller analysis.

Every rating is benchmarked against, among others, the International Covenant on Civil and Political Rights (ICCPR), the Constitution of Bangladesh, and comparative laws.

Click here to see how we assessed these laws.
High riskMedium riskNo riskPositive impact
Indicative rights assessment of each law. Law names open each guide; ratings open its analysis.
LawFreedom of expressionCivic participation & democratic processPrivacy & data protection
Personal Data Protection Act2026No riskNo riskPositive impact, with gaps
National Data Management ActData Management Act (NDMA)2026Medium riskNo riskMedium risk
Cyber Protection Act2026Medium riskHigh riskMedium risk
Bangladesh Telecommunication ActTele­com­mu­ni­ca­tion Act (BTA)2001High riskHigh riskHigh risk
Penal Code1860High riskMedium riskNo risk
Pornography Control Act2012High riskNo riskNo risk
The Personal Data Protection Act rates positive for privacy and no risks in other dimensions. Why?

It creates Bangladesh’s first data protection framework, with core rights over your data. On balance, that makes it positive for privacy, but the rating does not mean the law is sound. Meanwhile, no risks were identified in other dimensions as the statute was not yet in force at the time of assessment, but that does not preclude the possibility of impact on rights and freedoms once it operationalizes.

  • Broad exemptions let state authorities use personal data without consent, on undefined grounds such as national security.
  • Doubts remain over the data authority’s independence from government, which risks concentrating power over data in the state.
  • There is no duty to report every data breach. Reporting is required only when damage is likely to be “significant,” a term the law does not define.
Where the Personal Data Protection Act falls short

The bigger picture
is between the laws.

Some powers connect. Others overlap. Some are inherited. Three guides read the laws together.

The security-first thread

Follow the connection between data-protection exemptions, public databases and telecom interception powers.

Follow the thread

How the laws overlap

Everyday subjects, from what you post to who holds your data, mapped to the main laws that reach them. See where the same conduct meets different penalties.

See network of laws

The colonial governance logic

Follow speech offenses written in 1860 to what you post online, and the same pattern in newer laws.

Trace the lineage

Recommendations

Four proposals at a glance.

Three new statutes and a national AI strategy we propose so that Bangladesh’s digital laws protect your rights. These are proposals, not enacted law.

Proposed lawOnline Safety ActOne law for online harms and cybercrime, built on platform duties rather than broad criminal bans.Proposed lawRegulation of Investigatory Powers ActOne law for surveillance and interception, with a judge’s approval first and layered oversight.Proposed lawDigital Commerce ActOne platform-aware law for buying and selling online, from marketplaces to social commerce.Proposed strategyAI StrategyNot a rigid AI law yet: a flexible, principles-based strategy first.
Explore the better-laws roadmap