Overview

Primary legal framework

• Digital Security Act, 2018 — addresses offences and obligations concerning digital systems and information security;
• Information and Communication Technology Act, 2006 — provides a legal basis for electronic transactions and certain cyber offences (note: some provisions have been amended or superseded and may be read together with later instruments);
• Consumer Rights Protection Act, 2009 — establishes consumer protections relevant to online sales, advertising and remedies; and
• Tax and VAT laws and attendant rules — including obligations under the Income Tax Ordinance and VAT legislation that apply to digital sales, platform operators and service providers.

Key regulatory actors

• Registrar of Joint Stock Companies and Firms (RJSC) — corporate registration and business entity records (see the RJSC website for registration processes: https://www.roc.gov.bd/).
• National Board of Revenue (NBR) — tax and VAT administration.
• Sectoral regulators or authorities — depending on the service (for example, payment service providers and banking interfaces may implicate the Bangladesh Bank regulatory framework).
• Law enforcement and prosecutorial bodies — enforcement of cyber security and criminal offences under the Digital Security Act and other laws.

2026 update

Registration and structuring

1. Choosing an entity type (private limited company, public limited company, partnership, sole proprietorship) appropriate to the business strategy and financing plan;
2. Registering the chosen entity with the RJSC and obtaining attendant documents such as a certificate of incorporation and memorandum and articles; visit the RJSC site for procedure and forms: https://www.roc.gov.bd/;
3. Securing required local trade licenses and municipal permits where a physical presence or warehousing is involved;
4. Registering for tax identification (TIN) and, where thresholds are met, VAT registration with the National Board of Revenue;
5. Ensuring any regulated activities (for example, financial services or payment processing) have the necessary approvals from sectoral regulators.

Data protection and cybersecurity

• Mapping personal data flows — identify what categories of personal data you collect, the lawful basis for processing, storage locations and retention periods;
• Technical and organisational measures — implement proportionate security controls (access controls, encryption, secure development practices, incident response procedures) and keep records of those measures;
• Privacy notices and terms — publish clear information for users about data collection, use, retention and rights (subject access, correction and deletion where applicable);
• Third‑party vendors — conduct vendor due diligence and reflect security and compliance obligations in contracts with payment gateways, cloud providers and fulfilment partners;
• Incident reporting — establish internal procedures to detect, contain and report incidents, bearing in mind that some incidents could trigger law enforcement or regulatory notifications.

Consumer protection and platform obligations

• Transparent pricing and clear disclosure of total costs, including taxes, shipping and fees;
• Clear return, refund and cancellation policies, including any statutory remedies that may apply;
• Labelling and product safety information where applicable;
• Accessible and timely customer service channels, and a record of communications that may be relevant in a dispute;
• Mechanisms to address consumer complaints and escalate unresolved matters to appropriate dispute resolution forums.

Payment gateways, settlement and financial compliance

• Selection of a payment service provider that has the necessary approvals and contractual arrangements for settlement and chargebacks;
• Compliance with anti‑money laundering (AML) and know‑your‑customer (KYC) rules where these apply to the payment flows or beneficiary accounts;
• Allocation of liability for fraud, unauthorised transactions and data breaches in contracts with payment service providers;
• Reconciliation and recordkeeping to support tax reporting and customer refunds.

Taxation and VAT

• Registration for tax (TIN) and for VAT when the taxable turnover threshold is exceeded;
• Determination of the place of supply for VAT purposes for digital goods and cross‑border services;
• Appropriate collection and remittance of VAT on sales to consumers, and documentation to support input tax claims where relevant;
• Recordkeeping to support income tax compliance and to respond to any tax authority enquiries.

Contracts, website terms and marketplace arrangements

• Terms of service and acceptable use policies that set out the contractual relationship with users;
• Privacy policies describing data practices and the rights of data subjects;
• Supplier and vendor agreements (including fulfilment, logistics and returns handling);
• Marketplace agreements that allocate responsibilities between platform operators and third‑party sellers; and
• Dispute resolution clauses (including jurisdiction, governing law and arbitration provisions) that reflect enforceability constraints in cross‑border disputes.

Dispute resolution and enforcement risk

• Internal complaint handling procedures and timeframes for response;
• Escalation pathways for potential enforcement matters; and
• Alternative dispute resolution mechanisms, where suitable, to manage costs and timelines.

Practical step‑by‑step checklist for market entry

1. Decide on a business model (direct retailer, marketplace operator, platform for services) and select an entity type;
2. Register the business with RJSC and obtain required permits and municipal trade licenses (https://www.roc.gov.bd/);
3. Register for TIN and, if required, VAT with the National Board of Revenue;
4. Draft website and platform terms, privacy policy and returns policy; publish conspicuously on the website;
5. Engage vetted payment gateways and put in place contracts allocating liability and responsibilities;
6. Implement data security measures proportionate to the personal data processed and maintain incident response procedures;
7. Set up customer support and complaint handling processes consistent with consumer protection expectations;
8. Maintain transaction records, stock and tax documentation to meet statutory retention and audit requirements;
9. Monitor regulatory developments and update policies and contracts as required.

Common mistakes and how to avoid them

• Neglecting data security: failing to implement basic controls and incident response plans;
• Inadequate consumer disclosures: unclear pricing, terms or refund policies that provoke complaints or enforcement action;
• Failure to register or to account for VAT and tax obligations in pricing and reporting;
• Insufficient vendor contracts that leave platform operators exposed to liability for third‑party seller conduct;
• Failure to keep accurate transactional records and reconciliation documents, which complicates tax compliance and dispute resolution.

Cross‑border sales and international considerations

• Determine customs duties and import regulations that apply to goods sold from abroad into Bangladesh;
• Consider whether the business presence in Bangladesh triggers permanent establishment or other tax nexus concerns;
• Consider contractual and operational measures for cross‑border fulfilment, returns and dispute management;
• Review data transfer arrangements and whether additional safeguards are required when data moves across borders.

Engaging advisors and in‑house compliance functions

When to seek legal advice

• During entity selection and registration, to ensure alignment with commercial and tax objectives;
• When drafting terms of service, supplier contracts and privacy policies;
• Before launching payment integrations or wallets that may raise regulatory questions;
• In the event of a data breach, regulatory inquiry or potential criminal allegation under digital security laws;
• When dealing with cross‑border supply chains and tax planning that may create nexus issues.

How TRW Law Firm can assist (scope of services)

Practical compliance checklist

• Entity registration and local trade licences: complete and retain certificates;
• TIN and VAT registration: monitor turnover thresholds and register timely;
• Terms, privacy policy and returns policy: publish and review annually or after material system changes;
• Payment contracts: verify KYC/AML provisions and chargeback processes;
• Data security: maintain basic technical safeguards and an incident response playbook;
• Recordkeeping: ensure transaction, inventory and tax records are accurate and retrievable;
• Staff training: run periodic training on customer service, fraud prevention and privacy obligations;
• Vendor due diligence: document security and compliance obligations in written contracts.

Frequently asked questions

Next steps and further resources

Contact and call to action