The Personal Data Protection Act, 2026 of Bangladesh, Privacy and Global Data Governance

Abstract

Bangladesh has entered a transformative phase in its digital governance journey with the enactment of the Personal Data Protection Act, 2026, which evolved from the Personal Data Protection Ordinance, 2025, and its subsequent amendment in February 2026. Current research is a comprehensive analysis of Bangladesh's data protection framework, examining its legislative evolution, key statutory provisions, institutional architecture, and implementation challenges. Based on comparative analysis with the European Union's General Data Protection Regulation (GDPR), documented breach incidents involving Bangladesh's National Identity database and private-sector data-fiduciaries, and scholarly and civil-society critiques, the study explores significant structural concerns including regulatory independence, state surveillance risk, and the balance between individual rights and state prerogatives. While the Act is a historic shift by recognizing citizens' personal data as their own property, substantial gaps exist between legislative text and effective implementation, in the absence of a mandatory breach-notification duty to affected individuals and Prime Minister's Office as the enforcing Authority. Strengthening Bangladesh's data protection framework through enhanced institutional independence, and transparent safeguards on state exemptions will offer closer alignment with international human-rights standards.