FROM PAGE 1

obligation for Meta or Facebook to comply with any order of the court.”

However, the law has not made data localisation mandatory for foreign platforms.

He said that since the world is moving toward cloud-based data management, the ordinance does not include a data localisation clause. He explained that global tech giants process their data in the cloud, and enforcing localisation would disrupt business operations.

The new law emphasised the principle of informed consent. It mandates that data fiduciaries must obtain clear, specific, and unambiguous consent from individuals before processing their personal data. This consent must be freely given and can be withdrawn at any time.

The law grants citizens rights over their information. These include the right to access their data, the right to correction and erasure, and the right to data portability.

This portability clause will allow individuals to seamlessly transfer their data between service providers. The individuals will have the right to object to automated decision-making.

The ordinance introduces stringent protections for sensitive personal data, a category that includes financial information, health records, genetic and biometric data, religious beliefs, sexual orientation, and official identifiers like national ID and passport numbers. The processing of such data is subject to much stricter conditions.

Special safeguards are also established for children and individuals incapable of giving consent. For anyone under 18, data processing requires the consent of a parent or legal guardian. The law prohibits tracking, profiling, or targeting advertisements at children.

Data fiduciaries and processors must ensure data is processed lawfully, for specified purposes, and is accurate and secure. The law mandates the implementation of appropriate technical and organisational security measures, including encryption, to prevent data breaches.

In the event of a personal data breach, defined as any unauthorised access, disclosure, or loss of data, data fiduciaries are required to promptly notify the national regulatory authority.

It was also made mandatory to appoint a Chief Data Officer to ensure compliance and act as a point of contact for the regulator.

Violation of data rights of individuals can lead to fines of up to two percent of annual domestic turnover for standard entities and five percent for significant data fiduciaries.

Criminal penalties, including imprisonment of up to seven years and fines, are prescribed for offences like processing data without legal basis, unlawfully sharing sensitive data, or using children’s data without proper consent.

The law classifies data into four categories: public, internal, restricted, and confidential, with escalating levels of control.

The transfer of sensitive data, including national ID numbers, biometrics, and genetic data, outside Bangladesh’s borders will require explicit permission from the authority.

The ordinance operates under the oversight of a data management authority, established under a separate National Data Governance Act, 2025, which the cabinet also passed yesterday.

The authority will be tasked with ensuring data security and privacy and making different government and private sector systems work together seamlessly -- a concept known as interoperability.

There will also be the establishment of the National Responsible Data Exchange (NRDEX), a secure platform that will enable approved, purpose-based data sharing between different entities.

All government and relevant private organisations will be required to connect their data to this system.

For citizens, the law paves the way for a unified electronic identity (e-ID) system, allowing for secure access to a wide range of digital services using a single digital identity.

The law introduces data security measures, including the adoption of a “zero-trust” security architecture, and defines penalties for violations.

Under the law, a high-level National Data Governance Policy Council, to be chaired by the Prime Minister, will provide strategic direction for the new data ecosystem.