Disputes & Regulatory
Privacy & Data
Data governance, cross-border transfer and cyber incident response in a regime that is still taking shape.
Bangladesh does not yet have a consolidated data protection statute in force. Obligations instead sit across sectoral rules, telecoms and financial regulator directions, and the cyber security legislation — while group-level obligations under the GDPR and similar laws usually bind the client anyway.
We advise on data mapping and governance, cross-border transfer structures for outsourcing and shared services, employee and customer data handling, and incident response when something goes wrong.
How we help
- Data governance frameworks and privacy policies
- Cross-border data transfer and outsourcing structures
- Employee and customer data handling
- Cyber incident response and regulator notification
- Technology and cloud services contracting
- Cybercrime complaints and defence
Mandates in this practice
Thaicom · Counsel
Mediation of a satellite claim during UNCITRAL arbitration
Recent changes in the law
Personal Data Protection Act 2026
Parliament replaced the Personal Data Protection Ordinance of November 2025 with an Act. It reaches organisations outside Bangladesh that offer goods or services to people in the country, requires specific and revocable consent, and regulates large cross-border transfers of sensitive personal data.
Cyber Security Ordinance 2025 replaces the Cyber Security Act 2023
The Cyber Security Ordinance 2025 took effect on publication in the gazette and cancelled the Cyber Security Act 2023, removing several of its speech-related offences. Compliance policies that still cite the 2023 Act need updating.