Cybersecurity law in Bangladesh
High-level guidance for UK and international organisations on the legal and operational considerations when engaging with Bangladesh in relation to cybersecurity, data flows and incident response. Focuses on cross-border risk, contractual protections and practical steps to reduce exposure while noti
Our London office: Holborn Gate, 330 High Holborn, London, WC1V 7QH, England. This note offers a strategic, non-exhaustive overview for organisations in England and Wales and internationally that interact with Bangladesh-based systems, suppliers or data subjects. It does not constitute legal advice.
Overview of the legal landscape
Bangladesh has an evolving legal and enforcement environment addressing cybercrime, digital security and related offences. Regulatory focus in the jurisdiction has widened in recent years to cover online content, cyber-enabled offences and electronic evidence. For UK and international organisations, the practical effect is an environment where legal risk can arise from multiple sources: criminal enforcement, regulatory action, and private litigation. The regulatory architecture and enforcement priorities may differ materially from those in England and Wales.
Cross-border data flows and jurisdictional risks
When personal data or critical systems cross borders, key issues are choice of law, applicable standards for data protection and potential requirements for local access or retention. Organisations governed by the UK Data Protection Act 2018 and the UK GDPR must consider whether transfers to Bangladesh involve appropriate safeguards. Conversely, local law in Bangladesh may impose obligations or permit authorities to compel access to data held by service providers within the country.
Practical risk management and contractual measures
Risk mitigation combines operational controls, contractual allocation and preparedness:
- Due diligence: assess the cybersecurity posture, incident history and regulatory profile of Bangladeshi suppliers and service providers.
- Contractual protections: allocate responsibilities for security controls, breach notification, liabilities and law/venue for disputes. Include clear audit and remediation rights.
- Data governance: map data flows, classify data that may be sensitive under multiple regimes, and plan for localisation or access requests.
- Insurance and indemnities: consider cyber insurance and ensure policy coverage aligns with cross-border exposure.
Incident response and engagement with authorities
Effective incident response in a cross-border context should combine a single crisis playbook with local adaptations. Key elements include rapid internal escalation, preservation of evidence, coordinated communications and clarity on when to notify local authorities or regulators. Where investigations by local law enforcement or regulators may occur, engagement should be coordinated with legal advisers experienced in both the investigating jurisdiction and the organisation’s home jurisdiction.
Practical checklist
- Map systems and data flows to and from Bangladesh.
- Conduct supplier cyber and compliance due diligence.
- Include specific contractual clauses on security standards, notification timelines and audit rights.
- Align incident response playbooks with local reporting obligations and evidence preservation requirements.
- Secure appropriate insurance and review policy exclusions related to foreign investigations.
- Obtain local legal advice before responding to legal process or compelled disclosure requests.
Jurisdiction and sources
For further authoritative information consult official sources, including:
- UK Information Commissioner’s Office (ICO) – https://ico.org.uk
- UK National Cyber Security Centre (NCSC) – https://ncsc.gov.uk
- Legislation for England and Wales – https://www.legislation.gov.uk
- Government of the People’s Republic of Bangladesh – https://www.gov.bd
- Bangladesh Computer Council (BCC) – https://www.bcc.gov.bd
- Bangladesh Telecommunication Regulatory Commission (BTRC) – https://www.btrc.gov.bd
- Parliamentary and government publications for legislation in Bangladesh – https://www.parliament.gov.bd
Where jurisdictional or technical complexity exists, instructing advisers with experience in both the UK and Bangladesh is advisable to reconcile differing obligations and to manage cross-border regulatory engagement.
General information only; not legal advice and not a substitute for advice on a particular matter.
Bring the question into focus.
Contact the London office with a high-level, non-confidential outline of the issue. We can discuss the appropriate next step.