Compliance

The Data Privacy Act in Bangladesh: What Cloud Customers Need to Know

The Data Privacy Act reshapes how organizations in Bangladesh collect, store, process, and transfer personal data. A practical reading from a cloud operators perspective.

Farhana Karim
·

Bangladesh’s Data Privacy Act moves several long-implicit obligations into binding law and adds new ones. For organisations that touch personal data — which is most of them — the operating model shifts.

9
Categories of personal data covered
Sensitive
Tighter rules for health, biometric, religious, political
Cross-border
Restricted by default; defined legal bases required
DPA
Independent authority with enforcement, breach notice, penalties

Five operational shifts

What changes in the engineering and product organisation
1
Data-flow mapping becomes a first-class artefact Engineering

Where personal data enters, processes, stores, backs up, leaves — including SaaS and logs

2
Cross-border transfers need a documented legal basis Legal/Eng

SCC-equivalents, intra-group agreements, or in-country residency proofs

3
Consent becomes operational state Product

Granted, scoped, withdrawn, re-granted — versioned and auditable per identity

4
Breach notification on a tight clock Security

IR runbooks must scope personal-data exposure in hours, not days

5
DPO becomes a real role with reporting independence Org

Recruitment + reporting line + budget protected from product pressure

Time to leave each Data Privacy Act readiness stage
Stage 1: Inventory
3 mo
Stage 2: Flow mapping
4 mo
Stage 3: Consent rewire
6 mo
Stage 4: Cross-border audit
4 mo
Stage 5: IR & DPO
5 mo

Source: Cloud Digit field observations across early-2026 customer engagements.

Where the realised compliance work actually falls
Application code & data model Consent, classification, retention
41 %
Process & policy work Runbooks, DPO, training
28 %
Infrastructure & cloud config Region binding, KMS, logging
18 %
Vendor / contract renegotiation DPAs, transfer clauses
13 %

Source: Cloud Digit customer engagements, 2026 to date; effort-weighted.