TRW Knowledge / Technology, data & IP
IT Law Compliance in Bangladesh: Legal Framework and Practical Guidance (2026)
This article provides an explanatory overview of IT law compliance in Bangladesh as of mid-2026. It summarizes the principal statutory frameworks, common compliance challenges, practical steps organisations often take, and sources for further, context-specific advice. The content is intended for general informational purposes and does not constitute legal advice; entities with specific c
2026 reviewThis article retains its original publication date. It has been structurally and substantively refreshed for 2026; readers should verify current rules, court practice and primary materials before acting on a particular matter.
Legal and regulatory framework: outline
IT-related legal obligations in Bangladesh arise from several sources, including primary legislation, subordinate regulation, and administrative direction from sector regulators. The key statutes frequently referenced in discussions of IT compliance are:- The Information and Communication Technology (ICT) Act, 2006 (as amended);
- The Digital Security Act, 2018 (and any later amendments or rules implementing it);
- Sector-specific rules and licences enforced by the Bangladesh Telecommunication Regulatory Commission (BTRC) and other administrative bodies.
Primary regulators and authorities
Regulatory responsibility for different aspects of IT law is distributed. Entities commonly interact with the following authorities:- Bangladesh Telecommunication Regulatory Commission (BTRC) — telecommunications licensing, certain internet service obligations, and related directions. See the BTRC website for official guidance: https://www.btrc.gov.bd/.
- Administrative units and law-enforcement agencies that may receive complaints or investigate offences under the Digital Security Act and related laws.
- Sectoral regulators (for example, financial regulators for fintech providers) that impose conduct, confidentiality, or reporting requirements specific to regulated activities.
Key compliance subject areas
Organisations operating digital services in Bangladesh commonly encounter compliance issues in several recurring subject areas. The discussion below explains those areas at a high level and identifies practical considerations. This is explanatory and not exhaustive.Data protection and personal data
Bangladesh does not have a fully-enacted, consolidated national data protection statute in the form some other jurisdictions use (as of the date of publication). Discussions and legislative proposals relating to a Data Protection Act have been active in recent years. Until such time as specific legislation is enacted and comes into force, organisations typically rely on applicable provisions in existing laws, contractual obligations, sectoral guidance, and best-practice standards when handling personal data.Practical considerations for handling personal data include:- Identify categories of personal data processed and map flows, including cross-border transfers;
- Determine lawful bases for processing under applicable law and document those bases; where consent is used, ensure it is informed and documented;
- Implement technical and organisational measures proportionate to the risks (for example, access controls, encryption at rest and in transit, and periodic review of user privileges);
- Prepare retention and deletion schedules consistent with legal and business requirements; and
- Review contracts with third-party processors and vendors to allocate responsibilities for security and incident response.
Cybersecurity and incident response
The Digital Security Act and other instruments reference offences and obligations tied to digital security. Organisations should design an incident response capability that aligns with their risk profile and sectoral obligations. A proportionate programme typically includes:- Documented incident-response procedures, including roles and escalation paths;
- Technical detection, logging, and monitoring systems that support timely identification of incidents;
- Forensic preservation measures to retain evidence consistent with legal and operational needs;
- Communication plans that address internal stakeholders, affected data subjects, regulators, and, where relevant, law enforcement; and
- Post-incident review and remediation processes.
Electronic transactions and records
The ICT Act and subordinate instruments address the legal recognition of electronic records and signatures for certain transactions. Entities relying on electronic contracting and digital signatures should:- Examine the legal recognition of electronic evidence and signatures for the particular transaction;
- Adopt technical standards and authentication methods that are defensible in dispute scenarios; and
- Maintain audit trails and retention mechanisms required by sectoral law or good practice.
Intellectual property and content moderation
IT compliance also intersects with intellectual property (IP) concerns, intermediary liability, and content-moderation obligations. Platform operators and content hosts frequently balance removal or blocking requests against legal thresholds and procedural fairness. Practical steps include:- Developing clear notice-and-takedown and content-review procedures;
- Preserving records of moderation decisions and the legal basis for content actions; and
- Coordinating with legal counsel when interception of content or cooperation with law enforcement is requested, to ensure any disclosure complies with legal requirements.
Contractual and third-party considerations
Contracts are central to allocating IT compliance risk. Standard contractual measures that organisations commonly adopt include:- Data-processing agreements that describe the roles and responsibilities of data controllers and processors;
- Service-level agreements that include security, availability, and monitoring obligations;
- Audit and inspection rights to verify vendor compliance; and
- Indemnities and liability caps tailored to the parties' bargaining positions and regulatory obligations.
Practical, step-by-step compliance process
The following structured approach is commonly used to move from an initial compliance awareness phase to an implemented programme. It is an illustrative process; requirements vary by entity size, sector, and risk profile.1. Scope and governance
Define the scope of IT compliance: which systems, data categories, and business processes are in scope. Assign executive sponsorship and establish governance, including a compliance lead and cross-functional representation (legal, IT, HR, operations).2. Inventory and risk assessment
Prepare a data and systems inventory, and carry out a risk assessment that considers confidentiality, integrity, and availability risks. Identify high-risk data flows and critical infrastructure.3. Gap analysis and prioritisation
Compare current practices against legal requirements, sector guidance, and recognised standards (for example, relevant ISO standards). Prioritise gaps for remediation using a risk-based approach.4. Policy and procedure development
Develop or update policies on data protection, acceptable use, access control, incident response, retention, and vendor management. Ensure policies are actionable and aligned with operational practice.5. Technical and operational controls
Implement controls that match the risk appetite and regulatory expectations. Controls may include multifactor authentication, network segmentation, encryption, logging, endpoint protection, and backup routines.6. Training and awareness
Deliver role-based training for staff, including secure-development practices for engineering teams and phishing awareness for all employees. Maintain records of training completion.7. Monitoring, testing and audits
Adopt continuous monitoring and periodic testing (vulnerability scanning, penetration testing, and compliance audits). Use test results to refine controls and governance arrangements.8. Documentation and recordkeeping
Document compliance decisions, risk assessments, and remediation work. Keep incident logs and audit trails sufficient to demonstrate that a reasonable compliance programme was in place, while recognising that documentation alone does not guarantee legal protection.9. Review and improvement
Set periodic review cycles to account for legislative change, new threats, and organisational growth.Common compliance shortcomings and practical mitigations
Organisations often make recurring mistakes. Below are typical shortcomings and practical mitigations that can be considered.- Neglecting regulatory updates: maintain an internal legal/regulatory watch or subscriptions to official sources and consult counsel when changes look likely to affect operations.
- Poor vendor oversight: perform pre-contract due diligence and build contractual audit rights into supplier agreements.
- Insufficient incident planning: establish and regularly test an incident response plan with clear escalation to legal and communications functions.
- Overlooking documentation: retain records of compliance activities and decisions to support regulatory enquiries or litigation defence.
- One-off training: implement recurring, targeted training rather than one-time sessions.
Enforcement, penalties and dispute considerations
Penalties for non-compliance depend on the legal provision engaged and on the facts of a case. The Digital Security Act and other instruments include criminal and civil provisions for certain conduct, while regulatory bodies may have administrative remedies. Organisations that face regulatory enquiries or enforcement should promptly seek legal advice to assess procedural rights, potential defences, and remedial steps. This article does not attempt to catalogue all possible penalties; consult authoritative sources for up-to-date information.2026 update
As of mid-2026, debates on strengthening data protection and cybersecurity standards in Bangladesh have continued. Some public reports and stakeholder consultations have discussed amendments to the Digital Security Act and proposals for a Data Protection Act. The effect of any amendment or new law will depend on the final enacted text, implementing rules, and the schedule for compliance. Entities should monitor official publications from the relevant authority, such as the BTRC (https://www.btrc.gov.bd/), and seek tailored legal advice to understand any new obligations that apply to their operations.Regulators may issue guidelines, codes of practice, or sector-specific notices that have practical implications even before legislation is amended. Organisations should treat such materials as part of their compliance monitoring process and validate their status with the issuing body or legal counsel.Sector-specific notes
Certain sectors face additional rules. Examples include:- Financial services: banks and payment providers are often subject to specific confidentiality, reporting, and operational resilience obligations enforced by financial regulators.
- Telecommunications: licence conditions and BTRC regulations may impose network security and data-retention obligations.
- Healthcare and education: these sectors typically handle sensitive personal data and should apply heightened protective measures.
Checklist for an initial compliance audit
Use this checklist as a starting point for an internal audit. It does not replace specialist advice.- Inventory personal data and sensitive categories;
- Map third-party processors and data transfers, including cross-border flows;
- Review key contracts and vendor security commitments;
- Assess access controls and privileged account management;
- Verify encryption and backup arrangements;
- Confirm incident response procedures and historical incident logs;
- Document training and awareness programmes;
- Check retention schedules against legal or contractual obligations;
- Identify any sectoral licences or reporting obligations and whether notices have been filed.
Practical examples of reasonable measures (illustrative)
Below are examples of measures that many organisations adopt; they are illustrative and should be tailored to organisational circumstances and legal requirements.- Role-based access controls and least-privilege principles;
- Encrypted backups stored separately from production systems;
- Multifactor authentication for remote and privileged access;
- Formal vendor on-boarding checklists that include security questionnaires and contractual clauses for data processing;
- Periodic tabletop exercises for cyber incidents that involve legal, technical, and communications teams.
Resources and further reading
Organisations should consult primary sources and official guidance. Examples of relevant resources include:- BTRC official website: https://www.btrc.gov.bd/;
- Text of the ICT Act 2006 and the Digital Security Act 2018 (access the official published statutes or gazette postings from government sources for the authoritative text); and
- Sectoral regulator guidance for specific industries (for example, financial-sector circulars).
How TRW Law Firm can assist
TRW Law Firm can provide tailored legal services related to IT law compliance, including compliance audits, drafting data-processing agreements, incident response support, and training. For information about the firm and its service offerings, see TRW's pages on our firm, our practices, and services. To initiate a consultation, use the contact page at https://trw.org/contact/.FAQs
Q: What constitutes IT law compliance in Bangladesh?
A: IT law compliance in Bangladesh generally means aligning an organisation's practices with applicable statutes and regulations governing electronic transactions, data handling, cybersecurity, and related obligations, including licences and sectoral rules; because obligations vary by sector and over time, entities should verify their specific duties with a qualified adviser or the relevant authority.Q: How should my organisation start if it has no existing compliance programme?
A: Start with a scoped inventory and risk assessment to identify data and systems in scope, then adopt a governance structure, document policies, implement proportionate technical controls, and establish incident-response procedures; a staged, risk-based remediation plan is typically more practicable than attempting immediate full-scope compliance.Q: Do I have to report a cyber incident to a regulator in Bangladesh?
A: Reporting obligations depend on the incident type, affected data, sectoral rules, and statutory thresholds; some incidents may trigger mandatory reporting while others do not—organisations should consult the relevant regulator (for example BTRC for network incidents) or legal counsel to determine reporting duties in the specific circumstance.Q: What common mistakes should be avoided when outsourcing IT services?
A: Common mistakes include inadequate due diligence, failure to incorporate clear data-processing obligations in contracts, lack of audit rights, and not verifying the vendor's incident-response readiness; contractually defined security expectations and periodic compliance checks help mitigate these risks.Q: When should I seek tailored legal advice on IT compliance?
A: Seek tailored advice when you need to interpret how specific laws apply to your operations, before responding to regulator enquiries or incidents, when negotiating complex vendor contracts, or when planning significant cross-border data transfers—advisers can assess facts and risks that general guidance cannot.Next steps and contact
If your organisation needs an initial compliance review or help with a specific IT law question, you may arrange a meeting to discuss scope, timelines, and next steps. Use the links above for background on the firm's practice areas and services, or reach out via the contact page. For immediate scheduling, follow the link below.Book consultation or contact info@trw.org for more information.Bring the facts.
We bring direction.
For a focused discussion about a dispute, regulatory issue or procedural question, speak with TRW Law Firm. General information on this page is not legal advice.