The Personal Data Protection Ordinance 2025 establishes a DPO-equivalent requirement under Art. 23, requiring "significant" data controllers to appoint qualified Chief Data Officers (the word "significant" is not defined in the law). The Chief Data Officer represents the controller before the Authority, reports significant matters, serves as the contact point for the exercise of data-subject rights, receives complaints concerning the misuse or ineffective management of sensitive personal data, and supports remedial action.
However, this requirement is not yet enforceable. Section 1(3) provides that Section 23, together with Sections 31–46, does not enter into force immediately. These provisions will only come into force after 18 months from the promulgation of the Ordinance and on such date as the Government may appoint by notification in the Official Gazette.

Section 35 of the Cyber Protection Ordinance, 2025 grants police officers the authority to seize computers and related hardware without requiring a warrant.

Under Section 97A of the Telecommunication Regulatory Authority Act, the Ministry of Home Affairs may, on grounds of national security or public order and with ministerial approval, authorise intelligence, national security, investigative, or law enforcement bodies to record or collect user information relating to subscribers of telecommunications services. Telecommunications operators must provide full cooperation to the authority vested with these powers. This access obligation is reinforced in sector-specific licensing rules.
Section 33 of the Bangladesh Telecommunication Regulatory Commission (BTRC) Regulatory and Licensing Guideline for Internet Service Providers (ISP) in Bangladesh requires ISP operational systems to be compatible with lawful interception and to enable the identification of Wi-Fi subscribers.
Similarly, under Sections 25.03 and 25.05.01–25.05.02 of the BTRC Regulatory and Licensing Guidelines for Cellular Mobile Services in Bangladesh, 2024, cellular mobile licensees must provide connectivity and information to the BTRC Telecommunication Monitoring System (TMS), connect with the National Telecommunication Monitoring Centre (NTMC) lawful interception system, and provide access to CDR, IPDR, PDR, ETSAF data, customer and retailer information, call and radio-location information, recharge information, and other required data. Sections 25.07.01–25.07.02 further authorise BTRC, or its authorised representatives, to inspect licensees’ premises and take copies of records, documents, and other business information.

Under Section 30 of the Information and Communication Technology Act, the ICT Controller—an officer appointed under this Act responsible for overseeing its implementation—is authorised to access any computer system, apparatus, data, or other material associated with a computer system for the purpose of conducting or facilitating a search to obtain information contained within or accessible to the system. The ICT Controller may, by order, require any individual responsible for, or otherwise involved in the operation of, the computer system, data apparatus, or related material to provide such reasonable technical and other assistance as they deem necessary.
In addition, under Section 46, if the ICT Controller determines that it is necessary or expedient in the interests of the sovereignty, integrity, or security of Bangladesh, international relations, public order, or for the prevention of incitement to commit a legally recognised offence, they may direct any government law enforcement agency to intercept information transmitted through any computer resource. Additionally, they may instruct the subscriber or any individual responsible for a computer resource to provide all necessary assistance in decrypting the relevant information.
Pursuant to Section 29, the ICT Controller or an authorised officer possesses the same authority as that conferred upon a Civil Court under the Code of Civil Procedure of Bangladesh. These powers encompass the authority to conduct "discovery and inspection" as well as to "compel the production of any document."

Bangladesh's legal framework and jurisprudence lack a comprehensive provision on intermediary liability for copyright infringement. Section 82 of the Copyright Act 2023 merely states that if it is determined that the copyright or other rights of a work’s creator or legal licensee have been infringed by a network service provider or any other third party, the creator, legal licensee, network service provider, or third party must, upon receiving a written objection, remove all copies of the disputed work from any medium under their control as soon as possible and notify the complainant in writing. Failure to comply renders the network service provider, institution, individual, or third party liable for copyright infringement. For this section, a "service provider" is defined as a network, individual, or institution that disseminates, publishes, or broadcasts content through any medium, including information technology, the Internet, and digital platforms.

Section 37 of the repealed Cyber Security Act stipulated that a service provider would not be held liable under the Act or any associated regulations for enabling access to data or information, provided that it could demonstrate either a lack of knowledge regarding the relevant offence or breach, or that it had undertaken all reasonable efforts to prevent it. However, reports indicated that, even when this provision was in force, it failed to provide sufficient protection for intermediaries with respect to user-generated content. The Cyber Security Act has now been repealed by the Cyber Protection Ordinance, 2025, which does not include this explicit safe-harbour clause in the same form. Consequently, the current framework provides even less express protection for intermediaries in this regard.

According to Section 33 of the "Regulatory and Licensing Guideline for Internet Service Providers (ISPs) in Bangladesh", ISPs are required to verify the identities of their Wi-Fi subscribers.

It is reported that mobile network operators must collect and validate users' personal information and proof of identity to sell SIM cards. This also includes biometric registration.

As stipulated in Section 4.2 of the "Approval Procedure of Payment System Operator (PSO)/Payment Service Provider (PSP)", payment service providers are required to establish a technological infrastructure within Bangladesh. According to Annexure-B, this infrastructure comprises hardware, software, network communication, integration with banks and other institutions, as well as additional components. It is reported that, due to local banks and government regulations, foreign online transaction platforms such as PayPal cannot operate in the country, which negatively affects the expansion of e-commerce.

It has been reported that some provisions of the Cyber Security Act of 2023 categorise the mere transmission of certain content as an offence, and that their broad scope could impose liability on intermediaries even in the absence of malicious intent. In the absence of an explicit mens rea requirement, a service provider transmitting such content without criminal intent could still have been prosecuted. These provisions included Section 21, which criminalised the dissemination of online propaganda, Section 28, which penalised the publication of content deemed to offend religious values or sentiments, and Section 29, which criminalised the dissemination of defamatory material online or in any electronic format. The Cyber Security Act has since been repealed and replaced by the Cyber Protection Ordinance, 2025, Ordinance No. 25 of 2025. However, it is not clear whether the new Ordinance retains equivalent requirements in the same form

Section 10.1 of the Guidelines to Establish Digital Bank stipulates that digital banks shall maintain at least a Tier III data centre and a disaster recovery site, each located in a different seismic zone. Section 10.2 further provides that, although digital banks may utilise cloud services, the physical location of such cloud infrastructure must be within Bangladesh's territory.

Reports indicate that authorities have blocked certain websites, news outlets, social media platforms, and communication services, particularly during periods of political tension. Notably, several news media websites, including Manab Zamin, Samakal, Jamuna Television, and Voice of America (VOA) Bangla, were rendered inaccessible in the lead-up to and during the general elections in Bangladesh in January 2024. In addition, in July 2024, authorities restricted access to major social media and communication platforms, including Facebook, YouTube, WhatsApp, and Signal. Similar restrictions were reimposed in August 2024. Additionally, reports suggest that the Sweden-based website Netra News has remained inaccessible since 2020.

Section 29 of the Data Protection Ordinance provides that personal data, including public or open personal data, internal personal data, confidential personal data, and limited personal data as defined in the Schedule, may be transferred abroad subject to the conditions set out in Section 29 itself. Such transfers are permitted where the consent of the relevant data subject has been obtained, where the transfer is necessary for the exchange of goods or services under a contract to which the data subject is a party, or where, with the consent of the data subject, the transfer relates to matters concerning the data subject’s interests, such as business, education, emigration, or immigration. Also, personal data that is lawfully transferable may be transferred only to countries that possess appropriate technological and infrastructural safeguards for the storage of personal data, as prescribed by regulation. In cases involving the cross‑border transfer of large volumes of sensitive personally identifiable data, notification to the competent authorities is mandatory. For the purposes of this section, sensitive personally identifiable data refers to data whose large‑scale cross‑border transfer may pose risks to national sovereignty, national security, or financial stability, including government‑issued unique identification numbers such as national identity card numbers, passport numbers, and taxpayer or TIN or PAN numbers; biometric identifiers such as fingerprints, facial recognition data, and iris scans; genetic or DNA‑related information; and records of criminal convictions or criminal history.

Bangladesh has not joined any agreement with binding commitments to open transfers of data across borders.

The Data Protection Ordinance establishes a comprehensive framework for data protection in Bangladesh, although the competent authority has yet to be constituted. Section 1.3 stipulates that, with the exception of section 23 and sections 31 to 46, the Ordinance shall enter into force immediately. The excepted provisions are to come into operation on such date as the Government may determine by notification in the Official Gazette, following the expiry of 18 months from the date of promulgation of the Ordinance. The provisions subject to deferred commencement primarily concern the appointment of the chief data officer, the mechanisms for lodging complaints, and the imposition of administrative penalties.
Other relevant legislation includes the Cybersecurity Ordinance 2025, the Information and Communication Technology Act 2006, the Telecommunications Act 2001, the Contract Act 1872, the Consumers’ Rights Protection Act, the Penal Code 1860, and the Copyright Act 2000.