Personal Data Protection Act, 2026: A New Legal Framework for Protecting Citizens’ Privacy
 |
| Legal Review | BD Law Post |
Definition of Personal and Sensitive Data
Under Section 2(17), personal data refers to information through which an individual can be identified directly or indirectly. This includes names, identification numbers, telephone numbers, financial information, and location data. Sensitive personal data includes genetic and biometric information, health records, political or religious beliefs, and criminal records. Such information requires particular care and protection.
Consent and the Rights of Individuals
Section 5 generally requires the consent of the relevant individual for the processing of personal data, subject to specific exceptions recognised by the Act. These exceptions may include the performance of contracts, the establishment or defence of legal claims, and the protection of vital interests. The burden of proving that valid consent has been obtained rests on the relevant data controller.
Sections 11–13 recognise several rights of individuals, including the right to access their personal data, request corrections or updates, and, subject to applicable conditions, withdraw consent, object to processing, or request the deletion of information. However, the right to deletion may be subject to legal obligations and other exceptions prescribed by law.
Responsibilities of Data Controllers and Processors
Sections 15–20 impose responsibilities on data controllers and processors to ensure transparency, establish clear purposes for data collection and use, maintain data security, and avoid retaining personal information longer than necessary. The Act also requires records of data processing to be maintained for at least five years.
In cases involving data breaches or security violations, the responsible parties must take the measures required by law. Section 9 provides additional safeguards for children’s personal data, including the importance of obtaining consent from a parent or legal guardian where applicable.
Cross-Border Data Transfers and Data Security
Section 29 addresses the classification and transfer of personal data. The Act provides for categories including public, internal, confidential, and restricted data. Cross-border transfers may be subject to requirements concerning consent, contractual arrangements, and adequate technical infrastructure. The Act also provides for notifying the relevant authority in cases involving the transfer of large volumes of data.
Penalties and Compensation for Violations
Section 32 provides for administrative fines of up to Tk 25 lakh for specified violations of data subjects’ rights. In certain circumstances, important data controllers may face fines of up to Tk 50 lakh. Section 33 provides for fines of up to Tk 25 lakh for failures to ensure data security.
Under Section 35, compensation may also be claimed where applicable, in addition to administrative penalties. Section 36 addresses potential liability involving directors, managing directors, and employees connected with violations. Section 37 provides an appeal mechanism, with a prescribed period of 30 days.
Commencement and Implementation
Under Section 1(3), provisions other than Sections 23 and 31–35 are deemed to have come into effect on 6 November 2025. The excluded provisions are to take effect after 18 months from promulgation, on a date specified by the government through a notification in the official Gazette. The relevant Gazette notification should therefore be consulted to confirm the actual commencement date of those provisions.
Legal Review
The Personal Data Protection Act, 2026 establishes an important legal framework for protecting individual privacy, promoting transparency in data processing, and strengthening institutional accountability. However, its effectiveness will depend on proper enforcement, adequate technological capacity, effective oversight, and public awareness of data protection rights.
Maintaining a balance between protecting personal privacy and permitting the lawful use of information will be one of the principal challenges in implementing the Act.
BDLAWPOST/MASUM
