It is reported that mobile network operators must collect and validate users' personal information and proof of identity to sell SIM cards. This also includes biometric registration.

As stipulated in Section 4.2 of the "Approval Procedure of Payment System Operator (PSO)/Payment Service Provider (PSP)", payment service providers are required to establish a technological infrastructure within Bangladesh. According to Annexure-B, this infrastructure comprises hardware, software, network communication, integration with banks and other institutions, as well as additional components. It is reported that, due to local banks and government regulations, foreign online transaction platforms such as PayPal cannot operate in the country, which negatively affects the expansion of e-commerce.

It has been reported that some provisions of the Cyber Security Act of 2023 categorise the mere transmission of certain content as an offence, and that their broad scope could impose liability on intermediaries even in the absence of malicious intent. In the absence of an explicit mens rea requirement, a service provider transmitting such content without criminal intent could still have been prosecuted. These provisions included Section 21, which criminalised the dissemination of online propaganda, Section 28, which penalised the publication of content deemed to offend religious values or sentiments, and Section 29, which criminalised the dissemination of defamatory material online or in any electronic format. The Cyber Security Act has since been repealed and replaced by the Cyber Protection Ordinance, 2025, Ordinance No. 25 of 2025. However, it is not clear whether the new Ordinance retains equivalent requirements in the same form

Section 10.1 of the Guidelines to Establish Digital Bank stipulates that digital banks shall maintain at least a Tier III data centre and a disaster recovery site, each located in a different seismic zone. Section 10.2 further provides that, although digital banks may utilise cloud services, the physical location of such cloud infrastructure must be within Bangladesh's territory.

Reports indicate that authorities have blocked certain websites, news outlets, social media platforms, and communication services, particularly during periods of political tension. Notably, several news media websites, including Manab Zamin, Samakal, Jamuna Television, and Voice of America (VOA) Bangla, were rendered inaccessible in the lead-up to and during the general elections in Bangladesh in January 2024. In addition, in July 2024, authorities restricted access to major social media and communication platforms, including Facebook, YouTube, WhatsApp, and Signal. Similar restrictions were reimposed in August 2024. Additionally, reports suggest that the Sweden-based website Netra News has remained inaccessible since 2020.

Section 29 of the Data Protection Ordinance provides that personal data, including public or open personal data, internal personal data, confidential personal data, and limited personal data as defined in the Schedule, may be transferred abroad subject to the conditions set out in Section 29 itself. Such transfers are permitted where the consent of the relevant data subject has been obtained, where the transfer is necessary for the exchange of goods or services under a contract to which the data subject is a party, or where, with the consent of the data subject, the transfer relates to matters concerning the data subject’s interests, such as business, education, emigration, or immigration. Also, personal data that is lawfully transferable may be transferred only to countries that possess appropriate technological and infrastructural safeguards for the storage of personal data, as prescribed by regulation. In cases involving the cross‑border transfer of large volumes of sensitive personally identifiable data, notification to the competent authorities is mandatory. For the purposes of this section, sensitive personally identifiable data refers to data whose large‑scale cross‑border transfer may pose risks to national sovereignty, national security, or financial stability, including government‑issued unique identification numbers such as national identity card numbers, passport numbers, and taxpayer or TIN or PAN numbers; biometric identifiers such as fingerprints, facial recognition data, and iris scans; genetic or DNA‑related information; and records of criminal convictions or criminal history.

Bangladesh has not joined any agreement with binding commitments to open transfers of data across borders.

The Data Protection Ordinance establishes a comprehensive framework for data protection in Bangladesh, although the competent authority has yet to be constituted. Section 1.3 stipulates that, with the exception of section 23 and sections 31 to 46, the Ordinance shall enter into force immediately. The excepted provisions are to come into operation on such date as the Government may determine by notification in the Official Gazette, following the expiry of 18 months from the date of promulgation of the Ordinance. The provisions subject to deferred commencement primarily concern the appointment of the chief data officer, the mechanisms for lodging complaints, and the imposition of administrative penalties.
Other relevant legislation includes the Cybersecurity Ordinance 2025, the Information and Communication Technology Act 2006, the Telecommunications Act 2001, the Contract Act 1872, the Consumers’ Rights Protection Act, the Penal Code 1860, and the Copyright Act 2000.

Bangladesh applies passive infrastructure sharing obligations in the telecommunications sector. The Bangladesh Telecommunication Regulatory Commission (BTRC) Guidelines for Infrastructure Sharing, issued under Section 31(2)(r) of the Bangladesh Telecommunication Act, 2001, require telecommunications infrastructure to be shared on a non-discriminatory basis. Under Clause 1.3, infrastructure sharing includes the leasing, renting, or swapping of infrastructure with other service providers.
The Guidelines expressly cover passive infrastructure. Section 2(4) defines passive infrastructure to include physical sites, buildings, shelters, towers or masts, power supply, ducts, trenches, rights of way, in-house wiring, sub-loop facilities, and local-loop facilities. Section 4(1) applies the Guidelines to passive infrastructure sharing among BTRC-licensed telecommunications operators, while Sections 5(2)–5(6) establish the procedure for access requests, responses, refusals, and dispute resolution.
The current framework is complemented by the Telecommunications Network and Licensing Policy 2025, particularly Sections 7.2.3, 7.2.8, 7.7.1, 7.7.2, and 7.7.6, as well as by the National Infrastructure and Connectivity Service Provider (NICSP) Licensing Guidelines.

The Telecommunications Network and Licensing Policy 2025 introduced a new licensing framework for Bangladesh’s telecommunications and digital-connectivity sector, establishing several maximum foreign equity limits.
The Policy sets different foreign ownership caps depending on the licence category, including:
- For Cellular Mobile Service Provider licences, foreign ownership is capped at 85%, with a corresponding requirement of at least 15% domestic participation (Sections 7.2.11.1–7.2.11.2).
- For National Infrastructure and Connectivity Service Provider (NICSP) licences, including existing Nationwide Telecommunications Transmission Network (NTTN) and Tower Sharing licences, foreign ownership is generally capped at 65% (Sections 7.7.12.2–7.7.12.3). However, exceptions may allow foreign equity of up to 85% (Section 7.7.12.5).
- For International Connectivity Service Provider (ICSP) licences, foreign shareholding is limited to 49% (Section 7.8.8).
The 60% foreign ownership cap previously set out in Section 4.06(i) of the Broadband Wireless Access (BWA) Guidelines has been superseded by the ownership limits established under the new licensing policy. Similarly, the previous Tower Sharing regime has been integrated into the NICSP category under Section 7.7.13. More generally, Sections 10.3.3, 13.7, and 14.2 provide that renewals and new applications must be issued under the new licensing categories, while existing licences may continue during their current terms.

The government maintains ownership of shares in specific telecommunications companies. Notably, the government holds full ownership of Bangladesh Telecommunication Company Limited, Teletalk Bangladesh Limited, Telephone Shilpa Sangstha Ltd, and Bangladesh Cable Shilpa Limited. In addition, the government retains a 73.84% shareholding in Bangladesh Submarine Cable Company Limited.

Bangladesh imposes obligations of accounting and functional separation on telecommunications operators with Significant Market Power (SMP). Under the Telecommunications Network and Licensing Policy 2025, Sections 11.8.1 and 11.8.2(d) authorise the Bangladesh Telecommunication Regulatory Commission (BTRC) to identify SMP operators and impose requirements relating to accounting separation and financial transparency.
The Policy further gives BTRC broader separation-related powers. Sections 11.8.5(c) and 11.8.7(b)–(c) allow BTRC to review financial transparency, recommend structural separation where justified, prohibit undue accumulation of licences across distinct functional layers without operational or structural separation, and require accounting separation, firewall mechanisms, and public disclosure for multi-layer licensees.

Under Section 96 of the Bangladesh Telecommunication Regulatory Authority Act, the government is empowered, in the public interest, to assume control of any telecommunication system, along with any necessary arrangements for its operation. This control may be maintained for an indefinite period, during which the operator and the employees of the telecom operator may be required to remain engaged either on a full-time basis or for a specified duration to ensure the continued operation of the apparatus or system.

The Telecommunications Network and Licensing Policy 2025 establishes a new licensing framework for Bangladesh and imposes specific market-entry conditions. Under Section 7.3.4, Cellular Mobile Service Provider licences are subject to a limited licensing framework, with the number of licences determined by the Bangladesh Telecommunication Regulatory Commission (BTRC) based on spectrum availability, market competition, and consumer benefit. For National Infrastructure and Connectivity Service Provider (NICSP) licences, Section 7.7.10 requires applicants to demonstrate minimum investment capacity. However, this minimum investment has not yet been established.

Bangladesh has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.