The technology startup landscape in Bangladesh has undergone a significant transformation, evolving into a dynamic ecosystem that attracts both domestic and international interest. As the nation moves toward its "Smart Bangladesh" vision, the role of technology-driven enterprises has become central to economic diversification. However, the rapid pace of innovation often outstrips traditional legal understanding, creating a complex environment for founders. Navigating these complexities requires a comprehensive understanding of the statutory requirements that govern the sector. The ecosystem is characterized by a growing number of fintech, edtech, and software-as-a-service (SaaS) companies, all of which must operate within a multi-layered regulatory framework to ensure long-term viability and investor confidence.For a technology startup to transition from a concept to a viable corporate entity, it must align with various legal standards. These are designed to ensure market stability, protect consumer interests, and provide structured dispute resolution. In Bangladesh, startup requirements are distributed across several legislative acts rather than a single consolidated law. Entrepreneurs must identify which laws apply to their specific models, whether they are building platforms for digital commerce or developing complex financial algorithms. The legal foundation not only provides a shield against liabilities but also acts as a catalyst for growth by establishing a clear governance structure that is recognizable to global partners.Compliance is a foundational element of business scalability. Startups prioritizing legal integrity are better positioned for venture capital funding and strategic partnerships. Conversely, neglecting legal dimensions can lead to significant liabilities, including intellectual property disputes, regulatory fines, and operational disruptions. This guide provides an in-depth analysis of the legal considerations essential for technology startups in Bangladesh, incorporating recent legislative changes that have redefined the digital and labor landscapes in 2025 and 2026. For specific guidance on your startup's legal needs, you can contact our experts or learn more about our firm.

Primary Legal Framework Governing Technology Startups

The legal foundation for any business entity in Bangladesh is built upon several key statutes. These acts provide the rules for formation, intangible asset protection, and digital regulation. Understanding these statutes is the first step in establishing a legally compliant enterprise that can withstand the rigors of the modern digital economy. The primary legislation includes the Companies Act, the ICT Act, and various intellectual property laws.

The Companies Act, 1994

The Companies Act, 1994 is the primary legislation for corporate governance in Bangladesh, dictating incorporation, director duties, and shareholder rights. For technology startups, the choice of corporate structure—most commonly a private limited company—is governed by this Act. It ensures the startup is recognized as a separate legal entity, providing limited liability protection to founders and creating a structured mechanism for equity distribution and capital raising. The Act also outlines the requirements for annual general meetings, statutory audits, and the maintenance of corporate records at the Registrar of Joint Stock Companies and Firms (RJSC).

Information and Communication Technology (ICT) Act, 2006

The Information and Communication Technology (ICT) Act, 2006 remains a cornerstone of digital regulation, particularly concerning electronic transactions and digital signatures. For startups handling digital data and conducting online business, the ICT Act sets the standards for integrity and security in electronic communication. It provides the legal basis for the validity of digital contracts, which is essential for any modern software-driven business. However, founders must be aware that certain provisions of this Act have been superseded by the Cyber Security Act 2023, particularly those relating to cyber offenses.

Intellectual Property Laws

Regarding intangible assets, the Copyright Act, 2000 and the Trademarks Act, 2009 are vital. Technology startups rely heavily on proprietary software, unique algorithms, and brand identity. The Copyright Act protects source code as a literary work, while the Trademarks Act safeguards brand names, logos, and slogans. Given that a significant portion of a tech startup's value often resides in its intellectual property, strict adherence to these laws is non-negotiable for securing the company's future. For detailed IP strategies, startups should consult our intellectual property practice.

Incorporation and Registration Procedures

The journey of a technology startup begins with formal incorporation. This process is not merely administrative; it is a legal requirement that establishes the company's identity and governs its internal operations. In Bangladesh, the RJSC is the central authority for company registration.

Selecting the Corporate Structure

Choosing the right structure is critical for future scalability. While partnership firms and sole proprietorships exist, the Private Limited Company is the gold standard for tech startups. This structure allows for multiple shareholders, clear equity division, and a professional board of directors. It also facilitates the issuance of shares to investors, which is crucial for venture capital rounds. Founders must decide on the authorized and paid-up capital, keeping in mind that while there is no minimum capital requirement for local companies, foreign-owned startups may face different banking and BIDA requirements.

Name Clearance and Drafting Constitution

The first step at the RJSC is obtaining Name Clearance. The proposed name must not be identical or deceptively similar to any existing company. Once cleared, the founders must draft the Memorandum of Association (MoA) and Articles of Association (AoA). The MoA defines the company's objectives—which for tech startups should include software development, digital services, and any other intended activities. The AoA governs internal management, such as the appointment of directors, voting rights, and the transfer of shares. It is advisable to include specific clauses related to board control and investor rights if external funding is anticipated.

Post-Incorporation Formalities

After receiving the Certificate of Incorporation, the startup must complete several other registrations. These include obtaining an e-TIN (Taxpayer Identification Number) from the National Board of Revenue (NBR) and a Trade License from the relevant City Corporation or local government authority. For startups intending to import equipment or engage in foreign trade, an Import Registration Certificate (IRC) or Export Registration Certificate (ERC) may be required. Furthermore, membership in relevant industry bodies like BASIS (Bangladesh Association of Software and Information Services) is highly recommended for tech startups to access industry benefits and networking opportunities.

Licensing and Sector-Specific Regulations

Beyond basic incorporation, technology startups often operate in regulated sectors that require additional licenses. Failure to obtain these can lead to operational shutdowns and legal penalties. The regulatory landscape varies significantly depending on the startup's core business model.

Fintech and Digital Payments

Fintech startups are among the most heavily regulated. Any entity providing digital payment services, mobile financial services (MFS), or digital lending must comply with Bangladesh Bank regulations. This includes obtaining a Payment Service Provider (PSP) or Payment System Operator (PSO) license. The central bank's guidelines focus on capital requirements, data security, and anti-money laundering (AML) compliance. Founders must ensure their platforms meet the technical standards for transaction security and consumer protection as mandated by the central bank.

E-commerce and Digital Commerce

E-commerce platforms must adhere to the National Digital Commerce Policy and the Digital Commerce Management Guidelines. These regulations require platforms to be transparent about pricing, delivery timelines, and return policies. Additionally, e-commerce entities must obtain a unique Business ID (UBID) and register with the Ministry of Commerce. Compliance with consumer protection laws is paramount, as the Directorate of National Consumers' Right Protection (DNCRP) actively monitors digital marketplaces for unfair trade practices.

Edtech and Telehealth

Startups in the education and healthcare sectors face unique challenges. Edtech companies must ensure their content aligns with national curriculum standards if they target the formal education sector. Telehealth platforms must navigate the regulations set by the Directorate General of Health Services (DGHS), ensuring that medical consultations and data handling meet the required professional and ethical standards. For guidance on navigating these sector-specific rules, visit our services page.

Intellectual Property (IP) Strategy for Tech Startups

For a technology startup, IP is often its most valuable asset. A robust IP strategy involves not just registration but also active enforcement and management. In Bangladesh, the legal framework provides several avenues for protecting different types of innovation.

Software and Copyright

Under the Copyright Act, 2000, software source code is protected as a literary work. Startups should register their core software versions with the Copyright Office to establish a public record of ownership. This is particularly important when dealing with third-party developers or when entering into licensing agreements. Founders must ensure that all employment and contractor agreements include "work-for-hire" clauses, explicitly stating that all IP created during the engagement belongs to the company. Without these clauses, ownership of the code may remain with the individual developer, creating significant legal risks during an acquisition or funding round.

Brand and Trademarks

A startup's brand identity—its name, logo, and slogan—should be protected under the Trademarks Act, 2009. Registering a trademark gives the company exclusive rights to use the mark in connection with its products and services. It prevents competitors from using similar marks that could cause consumer confusion. Tech startups should consider registering their marks in relevant classes, such as Class 9 (software) and Class 42 (IT services). A thorough trademark search should be conducted before launching a brand to ensure the chosen name is available and enforceable.

Patents and Industrial Design

While less common in software, patents are essential for startups developing novel hardware, manufacturing processes, or biotech innovations. The Patents and Designs Act (and the newer Patents Act, 2022) provides protection for inventions that are new, involve an inventive step, and have industrial application. Patenting provides a 20-year monopoly on the invention, but the process is rigorous and requires full disclosure. Startups should maintain strict confidentiality (using NDAs) until a patent application is filed to preserve the "novelty" of the invention. For more information, check our practice areas.

Taxation and Incentives for the ICT Sector

Bangladesh offers an attractive tax environment for technology startups, but compliance is essential to access these benefits. The National Board of Revenue (NBR) oversees taxation, and startups must stay abreast of annual budget changes.

Tax Holidays and Exemptions

The government provides significant tax holidays for companies engaged in software development and IT-enabled services (ITES). These exemptions can last for several years, significantly boosting the startup's cash flow during its early stages. To qualify, companies must be registered with the relevant authorities and maintain proper books of account. The specific list of eligible services is updated periodically, so startups should verify their eligibility with a tax professional. However, even tax-exempt companies must file annual tax returns and comply with withholding tax (TDS) requirements.

VAT and BIN Registration

Most digital services are subject to Value Added Tax (VAT). Startups must obtain a Business Identification Number (BIN) if their annual turnover exceeds the statutory threshold. Even if below the threshold, a BIN is often required for participation in tenders and for opening a corporate bank account. The VAT Act requires companies to issue proper VAT invoices and file monthly VAT returns. Technology startups should be particularly careful with the "VAT at source" rules, where the service recipient is required to deduct VAT before making payment to the startup.

Employment Law and Human Resources

Managing a tech team requires balancing flexibility with legal compliance. The Bangladesh Labour Act, 2006 and its subsequent amendments set the minimum standards for employment. Tech startups, often characterized by remote work and non-traditional hours, must ensure their HR policies are legally sound.

Employment Contracts and Benefits

Every employee must be provided with a formal Letter of Appointment that outlines their role, salary, working hours, and benefits. The Labour Act mandates certain benefits, including festival bonuses, earned leave, and maternity benefits. The Labour Act (Amendment) 2025 has further enhanced maternity leave provisions, and startups must ensure their policies reflect these changes. For tech startups, it is also crucial to include clauses on confidentiality, non-compete, and intellectual property assignment to protect the company's proprietary information.

Termination and Dispute Resolution

The Labour Act provides specific procedures for the termination of employment, whether through resignation, discharge, or dismissal for misconduct. Failure to follow these procedures can lead to cases in the Labour Court. Startups should maintain clear records of employee performance and any disciplinary actions. In the event of a dispute, mediation is often the preferred first step, but the legal framework provides a structured path for resolution through the labor judicial system. For employment legal support, visit our contact page.

Data Protection and Privacy Regulations

In the digital age, data is a critical asset, and its protection is a major legal priority. Bangladesh has recently introduced comprehensive data protection legislation that tech startups must navigate carefully.

The Personal Data Protection Act 2026

The Personal Data Protection Act 2026 is the primary law governing the collection, processing, and storage of personal data. It introduces concepts like data controllers, data processors, and data subjects' rights. Startups must obtain explicit consent from users before collecting their data and must ensure the data is used only for the purpose for which it was collected. The Act also includes provisions for data localization, requiring certain types of sensitive data to be stored within Bangladesh. Startups must implement robust technical and organizational measures to prevent data breaches and must notify the regulatory authority in the event of a leak.

Cyber Security Act 2023

The Cyber Security Act 2023 focuses on preventing cybercrimes and ensuring the security of digital systems. For tech startups, this means maintaining high standards of cybersecurity to protect their platforms from unauthorized access. The Act empowers the Digital Security Agency to monitor digital activities and take action against cyber offenses. Startups should conduct regular security audits and implement industry-standard encryption and access controls to remain compliant and protect their users.

Contractual Agreements and Dispute Resolution

Tech startups enter into numerous contracts—with vendors, clients, investors, and partners. The quality of these agreements often determines the company's legal resilience.

Service Level Agreements (SLAs)

For SaaS and service-based startups, Service Level Agreements (SLAs) are vital. These contracts define the expected level of service, such as uptime, performance metrics, and support response times. They also outline the remedies available to the client if the startup fails to meet these standards. A well-drafted SLA manages client expectations and limits the startup's liability in case of technical failures.

Investment and Shareholders' Agreements

When raising capital, the Shareholders' Agreement (SHA) and Share Subscription Agreement (SSA) are the most important documents. These agreements define the rights of investors, including board representation, veto rights over certain decisions, and exit strategies (like IPO or acquisition). Founders must be careful not to sign away too much control during early funding rounds. It is essential to have these documents reviewed by experienced legal counsel to ensure the founders' interests are protected while meeting investor expectations.

Dispute Resolution: Arbitration vs. Litigation

Most tech contracts include a Dispute Resolution Clause. While the court system in Bangladesh is available, many startups prefer Arbitration for its confidentiality, speed, and technical expertise. The Arbitration Act, 2001 provides the legal framework for domestic and international arbitration. Including an arbitration clause allows parties to resolve disputes in a private forum, often with experts who understand the complexities of the technology sector. For more on dispute resolution, see our practices.

Detailed Analysis of the Personal Data Protection Act 2026

The Personal Data Protection Act 2026 (PDPA 2026) represents a paradigm shift in how digital businesses in Bangladesh handle information. For tech startups, this is not just a compliance matter but a fundamental part of their product architecture. The Act defines 'personal data' broadly, encompassing any information that can identify an individual, from names and addresses to IP addresses and biometric data. Startups must appoint a Data Protection Officer (DPO) if they process large volumes of sensitive data, and they must conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities.One of the most debated aspects of the PDPA 2026 is data localization. While it allows for international data transfers under certain conditions, it mandates that a copy of all sensitive personal data must be stored on servers located within the territory of Bangladesh. This has significant implications for startups using global cloud providers. Founders must ensure their cloud architecture supports data residency requirements or work with local data center providers to remain compliant. Furthermore, the Act grants data subjects the 'right to be forgotten' and the 'right to data portability,' requiring startups to build technical features that allow users to delete their data or move it to another service provider easily.

Navigating the Bangladesh Labour Act (Amendment) 2025

The 2025 amendments to the Labour Act have introduced several modernization measures that directly impact the tech sector. Recognizing the shift towards remote and hybrid work, the amendments provide a legal framework for 'work-from-home' arrangements, ensuring that remote employees enjoy the same rights and protections as those in a physical office. This includes regulations on working hours, occupational safety (even in a home environment), and the right to disconnect. Startups must now clearly define remote work policies in their employment contracts to avoid ambiguity regarding overtime and performance monitoring.Another key area is the protection of gig workers and platform-based employees. While the traditional definition of a 'worker' was often narrow, the 2025 amendments have expanded the scope to include certain categories of independent contractors who work primarily through digital platforms. This means startups in the ride-sharing, food delivery, and freelance marketplace sectors may need to provide basic benefits such as insurance and minimum wage protections to their platform partners. These changes aim to provide a social safety net for the growing gig economy while maintaining the flexibility that tech platforms require to operate.

Foreign Direct Investment (FDI) in Bangladesh Tech

Bangladesh is increasingly seen as an attractive destination for foreign venture capital. However, foreign investors and founders must navigate a specific set of rules managed by the Bangladesh Investment Development Authority (BIDA). Foreign-owned companies must register with BIDA to facilitate outward profit repatriation and to obtain work permits for foreign employees. There is also a requirement for a minimum investment amount (currently USD 50,000) to qualify for certain investor visas and work permits. Tech startups should be aware of the foreign exchange regulations managed by the Bangladesh Bank, which govern how capital can be brought into the country and how dividends can be remitted to foreign shareholders.Furthermore, foreign investors often require specific protections in the Shareholders' Agreement, such as anti-dilution clauses, liquidation preferences, and drag-along/tag-along rights. While these are common in global VC deals, they must be drafted carefully to ensure they are enforceable under the Companies Act, 1994. The use of offshore holding companies (e.g., in Singapore or the UAE) is a common strategy for tech startups to facilitate easier investment and exits, but this requires careful tax planning to avoid issues with 'round-tripping' and to ensure compliance with Bangladesh's transfer pricing rules.

The Role of the Cyber Security Act 2023

The Cyber Security Act 2023 (CSA 2023) replaced the controversial Digital Security Act, aiming to focus more on technical cybersecurity and less on content regulation. For tech startups, the CSA 2023 mandates the reporting of significant cyber incidents to the National Computer Emergency Response Team (CERT). This means startups must have an incident response plan in place. The Act also criminalizes unauthorized access to computer systems, data theft, and the spread of malware. While these provisions protect startups from external threats, they also impose a duty of care on the startup to protect its own systems. A startup found to be grossly negligent in its security practices could face civil liabilities if user data is compromised.Compliance with the CSA 2023 involves regular vulnerability assessments and penetration testing (VAPT). Startups should integrate security into their DevOps pipeline (DevSecOps) to identify and fix vulnerabilities early in the development lifecycle. Additionally, the Act emphasizes the importance of digital evidence. Startups should maintain robust logs of all system activities, as these can be crucial in a legal investigation or when defending against an infringement claim. Understanding the interplay between the CSA 2023 and the PDPA 2026 is essential for any startup handling significant amounts of user data.

E-commerce Compliance and Consumer Protection

The digital commerce sector in Bangladesh is governed by the Digital Commerce Management Guidelines 2021 and the National Digital Commerce Policy. These guidelines were introduced to restore consumer trust after several high-profile e-commerce failures. Startups must ensure that their platforms provide clear information about the seller, the product's origin, and the total price including taxes and delivery charges. The use of 'escrow' services for payments is now mandatory for certain types of transactions, where the payment is held by a third party until the customer confirms receipt of the goods. This reduces the risk of fraud but adds a layer of operational complexity for startups.Consumer protection is also a major focus. The Consumers' Right Protection Act, 2009 allows customers to file complaints against businesses for deceptive practices, adulterated goods, or failure to provide promised services. The Directorate of National Consumers' Right Protection (DNCRP) has the power to fine businesses and even shut down platforms that repeatedly violate consumer rights. Tech startups should have a dedicated customer grievance redressal mechanism and clear terms of service that outline how disputes will be handled. Transparency in the use of algorithms for pricing or product recommendations is also becoming an area of regulatory interest, as authorities seek to prevent algorithmic bias and price manipulation.

Conclusion: The Importance of Legal Health

For technology startups in Bangladesh, legal compliance is not a hurdle but a foundation for sustainable growth. By proactively addressing incorporation, licensing, IP protection, and data privacy, founders can build enterprises that are resilient, scalable, and attractive to global investors. The evolving legal landscape, marked by the Personal Data Protection Act 2026 and the 2025 Labour Act amendments, requires continuous vigilance and expert guidance. Startups that prioritize their "legal health" are better equipped to navigate the challenges of the digital economy and contribute to the nation's technological future.

Frequently Asked Questions (FAQ)