Your identity records become connected across public services.
National ID, passport, tax, address, birth registration and driving-license databases must connect to a national exchange, with storage in national data centers where deemed expedient. Connected bodies may reuse the data for further purposes.§§30, 32
What it protects
- Linking databases is intended to improve public-service delivery and coordination.
Where it falls short
- Linked records make it easier to build detailed profiles across different parts of your life.
- A breach or misuse of access could expose linked information, while safeguards against unrelated reuse remain limited.
- The law appears to mandate data localization in Bangladesh.
- Law enforcement and intelligence agencies can access this information with limited procedural safeguards.
A public body or a company misuses your data.
The data authority can give binding directions to any public or private body. It sits within the Prime Minister’s Office and must follow the government’s policy guidelines.§§8, 27
What it protects
- You can complain to the data authority when your data rights are violated; it can impose fines up to BDT 2,500,000 and award you compensation.§§42, 44
- A public employee involved in violating your data rights can face disciplinary action for misconduct.§34
Where it falls short
- The government shapes its appointments, funding and administration.
- An accountability mechanism for public bodies by a data regulator that itself is not independent and is part of the government would be ineffective.
- A fine of BDT 2,500,000 would severely impact small businesses and would be inadequate for large corporations.
A system reliant on future regulations.
The law covers security and interoperability for national digital infrastructure such as the data exchange, and leaves detailed standards to future rules.§§23, 30, 33
What it protects
- Zero-trust architecture, privacy-preserving principles, auditability and minimization are named in the law.§§2, 33
Where it falls short
- Incident response, penetration testing, encryption standards and vulnerability disclosure are left undefined or to future regulations.
- Joining many identity databases raises the stakes of a single compromise.
