Introduction

Verified 2026 legal context

2026 update

Scope and purpose of this guide

Legal framework in Bangladesh: primary instruments and sources

• The Information and Communication Technology Act, 2006 (ICT Act) and related rules and notifications.
• Sector-specific rules and guidelines issued by regulators such as the Bangladesh Telecommunication Regulatory Commission (BTRC).
• Contractual obligations, industry codes of practice, and international standards adopted by organisations as part of their compliance programmes.

How the principal instruments are commonly applied (summary)

• Prohibitions on specified cyber activities (for example, unauthorised access, fraudulent use of IT systems and similar conduct) are incorporated in primary statutes; enforcement may involve criminal and administrative processes.
• Obligations to protect information and to prevent unauthorised access may be implemented through organisational policies (access control, encryption, backup, logging) and through technical controls.
• Regulators may issue sectoral guidance (for example, telecommunications or critical infrastructure) that adds operational compliance steps such as audits, reporting and record-keeping requirements.
• Incident reporting obligations may arise from statute, regulator guidance, or contractual duties to customers, vendors or counterparties.

Key compliance components and practical requirements

Governance and accountability

• Designate accountable senior management owners for cybersecurity and data protection within the organisation.
• Establish a cross-functional governance forum (legal, IT, HR, operations, procurement) to coordinate policy, incident response and compliance monitoring.

Risk assessment and asset inventory

• Maintain an inventory of information assets, critical systems, and third-party connections; assess likely impact of compromise on confidentiality, integrity and availability.
• Apply a risk-based approach to prioritise controls where resources are limited.

Policies and procedures

• Document cybersecurity and acceptable use policies, incorporate relevant statutory references, and update policies in response to regulatory guidance.
• Establish incident response, business continuity and data retention policies, with clear escalation pathways and legal hold procedures.

Technical and operational controls

• Implement access controls, network segmentation, patch management, logging and monitoring, secure configuration and data encryption where appropriate.
• Where third-party cloud or managed services are used, evaluate provider controls and contractually allocate responsibilities for security and breach notification.

Training and human factors

• Provide regular, role-specific security awareness training for employees and contractors; include the legal and contractual consequences of non-compliance.
• Simulate common threats (e.g., phishing) and measure the effectiveness of training over time.

Monitoring, auditing and reporting

• Establish log collection and retention aligned with regulatory or contractual expectations; use monitoring to detect anomalous activity.
• Plan periodic audits (internal and external) to test controls and ensure compliance with applicable regulations.

Incident response and breach management

• Develop and document an incident response plan that addresses legal, technical, communications and recovery tasks; define roles for legal counsel and external advisors.
• Ensure procedures specify when to escalate incidents internally and when to notify regulators, affected parties or law enforcement, subject to applicable legal obligations.

Step-by-step practical compliance guide

1. Initial assessment: Map your IT environment and data flows; identify where personal, sensitive or business-critical data resides.
2. Legal review: Identify statutory obligations and regulator guidance that apply to your business model, including any sectoral rules issued by the BTRC or other ministries.
3. Prioritisation: Use risk assessment outputs to prioritise technical controls and governance steps, focusing first on high-impact assets.
4. Policy drafting: Draft or update cybersecurity, incident response and data handling policies; ensure they reflect statutory reporting timeframes and requirements where applicable.
5. Implementation: Deploy technical controls and contractual safeguards with vendors; document responsibilities for monitoring and patching.
6. Training and exercises: Train staff and run tabletop/technical exercises of the incident response plan.
7. Monitoring and audit: Implement continuous monitoring and schedule regular audits; remediate findings promptly.
8. Review and update: Review governance and technical measures at least annually and after any incident or regulatory change.

Common mistakes and practical pitfalls

• Underestimating third-party risk: Contracts often omit clear security obligations or verification rights; mitigate by incorporating specific security SLAs, audit rights, and incident notification clauses.
• Insufficient incident escalation: An unclear escalation ladder can delay legal or regulatory notifications; mitigate by pre-defining roles for legal, IT and communications stakeholders.
• Failure to document decisions: Lack of documentation on why particular controls were chosen may complicate defence to regulatory enquiries; mitigate by keeping decision memos and risk acceptance records.
• Neglecting retention and deletion policies: Excessive retention of sensitive information can increase exposure; mitigate by adopting and enforcing data minimisation and deletion schedules.
• Overreliance on a single control: Defence-in-depth is usually preferable; combine procedural, technical and contractual measures.

Sectoral considerations

• Telecommunications providers and infrastructure operators commonly face regulator-issued obligations concerning network security, lawful interception interfaces and audit requirements. Consult the BTRC for sector-specific rules: https://www.btrc.gov.bd/.
• Financial services firms typically operate under regulator expectations for operational resilience and incident reporting; compliance teams should coordinate with sector regulators and consider internationally recognised frameworks.
• Organisations processing personal data should consider data protection and privacy obligations that may arise from statute, contract or regulatory guidance.

International standards and voluntary frameworks

Regulatory interaction and enforcement considerations

Practical incident response checklist

1. Activate the incident response team and assign an incident manager.
2. Contain the incident to prevent further damage (isolate affected systems where feasible).
3. Preserve evidence in a forensically sound manner; document contemporaneous actions.
4. Assess the nature and scope of the incident and whether personal data or regulated assets are affected.
5. Consider whether immediate notifications to regulators, customers or law enforcement are required or advisable, and prepare draft communications.
6. Engage technical forensic advisers if needed and coordinate legal and communications responses.
7. Remediate vulnerabilities and restore systems according to the recovery plan.
8. Post-incident, conduct root-cause analysis and update policies, procedures and controls.

Contracting and procurement clauses to consider

• Security controls and standards the vendor must meet (reference to specific frameworks can be helpful).
• Audit and inspection rights, including the frequency and scope of audits.
• Obligations to notify and cooperate in the event of a security incident, including timelines.
• Data ownership and return/deletion obligations on termination.
• Liability allocation and limitations, bearing in mind that some statutory obligations cannot be contracted away.

When to seek tailored legal advice

• The organisation faces a significant incident that may trigger statutory reporting or criminal investigation.
• Contracts with significant data or operational exposure are negotiated or renewed.
• The organisation operates in a regulated sector with specific cybersecurity obligations (for example, telecommunications or financial services).
• Regulatory guidance or a statutory change raises uncertainty about compliance obligations.

Practical tools and documentation to develop

• Cybersecurity policy and supporting procedures.
• Incident response plan and playbooks for common scenarios (ransomware, data breach, insider incident).
• Vendor security questionnaire and standard contract clauses.
• Audit plan and training curriculum for staff.

Interactions with other legal areas

• Data protection and privacy law (where personal data is affected).
• Employment law (disciplinary procedures, monitoring and employee data processing).
• Corporate disclosure obligations (board reporting, statutory filings and shareholder communications in some jurisdictions).
• Intellectual property (theft or misuse of proprietary information).

Resources and official sources

Practical examples of measures (non-exhaustive)

• Multi-factor authentication for privileged accounts and remote access.
• Network segmentation to reduce lateral movement risk within an environment.
• Regular patch management cadence linked to vulnerability management metrics.
• Retention limits and routine secure disposal of physical and electronic records.
• Role-based access control and periodic privileged access reviews.

Training and culture

Five practical FAQs

Practical next steps checklist

• Complete an initial legal and technical gap analysis.
• Identify critical assets and data flows to prioritise controls.
• Create or update an incident response plan and run a tabletop exercise.
• Review vendor contracts for security and incident notification clauses.
• Schedule a board-level briefing on cybersecurity risk and compliance obligations.

How TRW Law Firm can support implementation (services and engagement)

When to escalate to regulators or law enforcement

Concluding observations