Bangladesh now has a comprehensive data protection law. The Personal Data Protection Act, 2026 (Act No. 63 of 2026), dated 10 April 2026, replaced the Personal Data Protection Ordinance, 2025 and its February 2026 amendment. It is enforced by the National Data Management Authority, established under the National Data Management Act, 2026.
Most of the Act is treated as having been in force since 6 November 2025. Two parts come later. Section 23, which requires significant data fiduciaries (to be identified by regulation) to appoint a Chief Data Officer, and Sections 31 to 35, which cover complaints, administrative fines and compensation, take effect on a date the government sets by gazette notification once 18 months have passed since the law was issued.
In other words, most obligations are treated as already applying, while the complaints, fines and compensation provisions wait for a government notification. That gap is the window to get ready.
Why HR holds the most sensitive data
The Act defines sensitive personal data to include biometric data, health data, trade union membership, religious belief and real-time location.
Look at that list from HR’s side. Fingerprint and face recognition attendance systems collect biometric data. Medical certificates and insurance claims hold health data. Union check-off deductions, which employers must now make for members of any registered union under the Labour Act, reveal membership. Field-force apps track location.
HR and payroll may hold more sensitive data than any other function in the organisation.
What the Act requires
A lawful basis. Processing generally requires consent that is free, specific, clear and revocable, given after the person is told the purpose, retention period, any transfers and how to withdraw. The Act also allows processing without consent in defined cases, including the performance of a contract and the exercise of legal rights relating to employment, labour and social security.
Sensitive data conditions. Sensitive data may be processed with specific consent or where needed to perform obligations under employment and social security law, among other grounds.
Notice. Employees must be told what categories of data are collected, why, how to exercise their rights, how to complain to the Authority, and whether data is transferred elsewhere.
Security. Controllers and processors must apply appropriate technical and organisational measures, including pseudonymisation and encryption, with regular testing.
Retention and records. Data may not be kept longer than the prescribed period for its purpose. Records of processing must be kept in a register for at least five years.
Breach notification. Where a breach is likely to cause significant harm, the Authority must be notified in the form and time prescribed by regulation.
Processors. Processing by a vendor on the employer’s behalf is treated as processing by the employer, which remains liable.
Automated decisions. Under Section 13, a data subject may withdraw consent, in whole or in part, to automated decisions relating to their personal data, through a simplified procedure to be set by regulation. The Act also bars data fiduciaries from carrying out processing by automated means without informing the data subject.
The cross-border question
Many Bangladeshi employers run payroll on regional or global platforms hosted abroad.
The Act allows transfers in defined cases, including with consent or for the performance of a contract. But it requires mandatory notification to the Authority for cross-border transfers of large volumes of sensitive personally identifiable data, which an explanation to Section 29(6) defines as government identifiers such as national ID, passport and taxpayer identification numbers, biometric identifiers, genetic data and criminal records. The Act does not define what counts as a large volume.
A payroll file holds exactly those fields. Regional HR and payroll architectures should be reviewed now.
The penalties to come
Once Sections 31 to 35 take effect, failing to honour data subject rights can attract an administrative fine of up to Tk 25 lakh under Section 32, or Tk 50 lakh for a significant data fiduciary. Failing to provide the required protection and security for personal data can attract a fine of up to Tk 25 lakh under Section 33. Repeat violations can bring further fines, and the Authority can order compensation.
Eight steps before enforcement
1. Map your HR data: what you hold, where, why and who can see it.
2. Tag sensitive data: biometrics, health, union membership, location.
3. Set the lawful basis for each purpose, and stop relying on blanket consent clauses.
4. Rewrite employee privacy notices to cover the Act’s required content.
5. Set retention periods and delete what you no longer need.
6. Review vendors and transfers, especially payroll and attendance data hosted abroad.
7. Prepare a breach response plan with clear roles.
8. Name an owner now, even if your Chief Data Officer obligation is not yet in force.
Where systems help
Data protection depends on control: role-based access, audit trails, retention rules and secure hosting. MiHCM Enterprise, supported locally by MiHCM in Bangladesh, is built with these controls, and MiHCM holds ISO/IEC 27001, ISO/IEC 27701, and SOC 2 Type II certifications.
Frequently Asked Questions
Is Bangladesh’s Personal Data Protection Act in force?
Yes. The Personal Data Protection Act, 2026 (Act No. 63 of 2026) is treated as in force from 6 November 2025, except Section 23 and Sections 31 to 35, which take effect on a date the government sets by gazette notification once 18 months have passed since the law was issued.
Does the Act apply to employee data?
Yes. It applies to personal data processed in Bangladesh, including employee records, payroll data and attendance data.
Is biometric attendance data sensitive under the Act?
Yes. Biometric data is defined as sensitive personal data, as are health data, trade union membership and real-time location.
Can payroll data be transferred outside Bangladesh?
Transfers are allowed in defined cases, such as with consent or to perform a contract. Large-volume cross-border transfers of sensitive identifiers such as national ID, passport and tax numbers must be notified to the Authority.
What are the fines under Bangladesh’s data protection law?
Once the penalty provisions take effect, up to Tk 25 lakh for failing to honour data subject rights or protect data, and up to Tk 50 lakh for a significant data fiduciary.
Sources
• Personal Data Protection Act, 2026 (Act No. 63 of 2026), official Bangla text, Laws of Bangladesh – Sections 1, 2, 5, 7, 8, 13, 15, 17 to 20, 23, 29, 32 and 33
• Securiti, An Overview of Bangladesh’s Personal Data Protection Act, 2026
• Digital Policy Alert, Personal Data Protection (Amendment) Ordinance, 2026
• MiHCM, The Bangladesh Labour (Amendment) Act 2026 – union check-off under Section 204
