Inside Bangladesh’s Cyberspace
Inside Bangladesh’s CyberspaceAnalysis

The security-first thread.

Read together, three laws give the state wide access to personal data, with limited independent oversight.

Three laws, one thread.

  1. Personal Data Protection Act§24

    The state is exempted

    State processing can go ahead without consent on grounds including national security, public order and crime investigation.

  2. Data Management Act (NDMA)§§30(6), 32

    Records are joined

    National ID, passport, tax, address, birth-registration and driving-license databases connect to one national exchange.

  3. Telecommunication Act (BTA)§97A

    Communications can be intercepted

    A central platform under the Ministry of Home Affairs is open to multiple agencies, and a review council looks only afterwards.

  4. Read together

    What it adds up to

    A centralized surveillance architecture with broad scope, expansive state access and limited independent oversight.

What it means for you.

Exceptional access can become routine.

Exemptions meant to be exceptional may become normal and discretionary, risking arbitrary interference with privacy, expression and association.

Your records can add up to a profile.

Joined-up databases may enable highly granular, long-term citizen profiles, with risks of function creep and secondary use of personal data.

Monitoring can start before anyone independent approves it.

The review council no longer authorizes interception in advance, and in an emergency the government’s designated authority can approve it by itself.

Follow the thread, law by law.

  1. Personal Data Protection Act 2026

    What protects you

    • An exemption waives consent only: every other rule on handling your data still applies.§24(2)

    Too wide

    Exemptions that open the door

    §24

    State authorities can rely on undefined grounds such as “national security,” “public interest” and “public order” to use personal data without consent, with no prior approval, which risks normalizing broad state access.

    Read the full Personal Data Protection Act analysis

  2. National Data Management Act 2026

    What protects you

    • A public employee involved in violating your data rights can face disciplinary action for misconduct.§34
    • Zero-trust architecture, privacy-preserving principles, auditability and minimization are named in the law.§§2, 33

    Who decides

    An executive-centered data authority

    Nothing in the law makes the authority independent. It is attached to the Prime Minister’s Office and must follow government policy guidelines, and its policy board, chaired by the prime minister, has 17 ministers, officials and members of parliament and 7 government-nominated members.

    17Ministers, officials and members of parliament
    7Experts and a civil-society member, chosen by the government
    Read the full Data Management Act (NDMA) analysis

  3. Bangladesh Telecommunication Act 2001

    What protects you

    • In most cases, interception needs prior approval from a court or an authority the government sets up, and must be necessary, proportionate, time-limited, a last resort and fully logged.§97A
    • An independent review council periodically checks past interceptions for legality, necessity and accountability.§97A(7)

    Order reversed

    Review that follows the interception

    §97A

    The enacted law dropped prior authorization by an independent council. Approval can now come from an authority the government sets up, in an emergency that authority can approve interception on its own, and the independent council only reviews it afterwards.

    Ministry of Home AffairsCentral interception platform
    Multiple agenciesAccess to communications and data
    Review councilAfter the fact
    Read the full Telecommunication Act (BTA) analysis

Who checks the power?

  1. Use of an exemption

    No one approves it in advance, though the other data-protection rules still apply.§24

  2. The data authority

    Attached to the Prime Minister’s Office, with a policy board of 17 ministers, officials and parliamentarians, and 7 government-nominated experts and civil-society members.§§5, 8

  3. Interception

    A review council examines it after it takes place.§97A

  4. Day-to-day monitoring

    The NTMC remains the principal monitoring body, within executive-controlled institutions.