Law note · Bangladesh
Personal Data Protection Act, 2026, complaints, penalties and appeals
What it requires
- Bangladesh's complaint, penalty, and appeal machinery for a personal-data violation, including one involving a biometric identifier, is not yet operative; no notification setting its commencement date had issued as of this document's as_of_date. Once in force, an app will answer to the National Data Management Authority for an administrative fine of up to BDT 2,500,000 per violation type, and the Authority may also order compensation to an affected data principal; Bangladesh gives a data principal no standalone civil right of action of their own.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
- Private right of action
- No
What we found
Once operative, a data principal or any person with reason to believe a rights violation occurred may file a complaint with the National Data Management Authority (s.31); the Authority may impose an administrative fine of up to BDT 2,500,000 for a rights violation (s.32) and separately up to BDT 2,500,000 for a security or protection failure (s.33), with factors for setting the fine listed at s.34, plus compensation to the complaining data principal in addition to the fine (s.35).
Section 36 lets the Authority fine individual company officials personally implicated in a rights-violation complaint. Appeal against an Authority fine or compensation order runs to the Tribunal established under section 68 of the Information and Communication Technology Act, within 30 days (s.37).
None of this is currently operative: sections 23 and 31 to 35 are excluded from the Act's own retroactive commencement deeming and await a separate Government gazette notification, expected roughly 18 months after the Act's gazetted predecessor (a date not yet reached or notified as of this document's as_of_date).
No standalone private civil right of action (a direct court suit) was found; the only individual remedy is the Authority's own compensation power under section 35, and that too is deferred.