Bangladesh Information Technology (IT) and Cyber Law: A Complete Legal Guide

Bangladesh’s Information Technology (IT) and Cyber Law framework governs digital transactions, cybersecurity, cybercrime, data protection, electronic evidence, and online business activities. It provides the legal foundation for protecting individuals, businesses, and government institutions from cyber threats while promoting a secure and compliant digital ecosystem.

Bangladesh, Information Technology (IT) and Cyber Law

IT and Cyber law matter: Today we often come across terms like ‘cyber crimes’, ‘net crimes’, ‘computer-fraud’, ‘cyber extortion’ etc. With the advent and advancement of internet, a new type of crime has developed. It is most commonly known as the cyber crimes. The term cyber generally means computer network or virtual reality. So, cyber crime can simply be defined as crime which involves cyberspace or computer network or a protected computer system. As our modern age is entirely dependent on network based facilities, a slight inconvenience on its part can cause a lot of problems. A single misplacement of information or a single wrong stroke on a keyboard button can literally cause great havoc and destruction. Though these technologies have empowered us to do a great deal of things, it has also put us in a vulnerable position. We have created these things but now we are sometimes helpless in front of our own creation. Honest mistakes may happen but some people are intentionally taking advantages of these weaknesses. What they are doing is called cyber- crime. They become active in the cyberspace and then use trickeries and evil methods to materialize their malicious desires which are often very harmful to individuals and group of individuals. These cyber-crimes are dangerous in nature and always pose serious threat to privacy at personal, public or national level.

In Bangladesh, Information Technology (IT) and Cyber Law are currently undergoing a historic transition. The legal framework has shifted away from the controversial Digital Security Act (DSA) towards a more specialized and procedural regime designed to balance national security with data privacy.

The Personal Data Protection Act (PDPA)

This is the most critical update for corporate and tech clients. It introduces strict obligations for Data Controllers and Data Processors.

Data Residency: Certain categories of sensitive personal data (such as health or financial records) must now be stored on servers physically located within Bangladesh.
Rights of Subjects: Individuals now have the statutory right to access, correct, and port their data.
Chief Data Officer (CDO): Large organizations are now required to appoint a CDO to oversee compliance.
Penalties: The Act removed many imprisonment sanctions for data violations, shifting toward heavy administrative fines instead.

Cyber Crimes and Prosecution

Cyber offenses are tried in specialized Cyber Tribunals. The most common matters in 2026 include:

Financial Fraud: Phishing and unauthorized access to digital payment systems (MFS).
Identity Theft: Creation of fake profiles or deep fakes for extortion.
Section 57 Legacy: While the old Section 57 of the ICT Act was largely moved to the CSA, the 2026 legal climate is more restrictive on what constitutes online defamation, favoring civil remedies over criminal arrest.