The Dawn of Digital Autonomy: Navigating Bangladesh’s Personal Data Protection Ordinance, 2025
The Dawn of Digital Autonomy: Navigating Bangladesh’s Personal Data Protection Ordinance, 2025
MD BAYAZID SHEIKH
In the wake of the transformative political and social shifts of 2024, Bangladesh has entered a new frontier of legal evolution. For years, the legal discourse surrounding cyberspace in the country was dominated by the highly controversial Digital Security Act, 2018, and its successor, the Cyber Security Act, 2023. These laws were predominantly viewed through the lens of state surveillance and the curtailment of free speech. However, a highly contemporary and uniquely progressive legal shift occurred with the gazetting of the Personal Data Protection Ordinance, 2025 in November 2025. This landmark legislation marks a paradigm shift from state-centric cyber control to citizen-centric digital autonomy.
At its core, the right to privacy is not a novel concept in Bangladesh. Article 43(b) of the Constitution of the People’s Republic of Bangladesh explicitly guarantees every citizen the right to the privacy of their correspondence and other means of communication. Yet, for decades, this constitutional promise lacked a dedicated statutory framework to protect citizens against the unchecked data harvesting practices of both private corporations and state apparatuses. The 2025 Ordinance bridges this critical legal lacuna.
The most revolutionary aspect of the Personal Data Protection Ordinance, 2025, is its foundational premise: citizens are the absolute owners of their personal data. Under this framework, government and private entities are reclassified merely as “data fiduciaries” or “data controllers.” This upends the traditional power dynamic where tech platforms and agencies unilaterally monetized or utilized user information without oversight.
To operationalize this ownership, the Ordinance heavily emphasizes the doctrine of informed consent. Businesses and agencies must now obtain voluntary, specific, explicit, and revocable consent before processing any personal data.
Furthermore, the Ordinance grants robust, enforceable rights to the “data subjects.” Citizens now possess the statutory right to access their processed data, request corrections to inaccuracies, restrict automated profiling, and invoke the right to demand data deletion. This is a monumental leap for digital human rights in Bangladesh, aligning the nation with global standards like the European Union’s GDPR.
The law also introduces stringent safeguards for sensitive personal data—such as biometrics, health records, and financial status—mandating enhanced security measures and stricter conditions for processing. Notably, it places a heavy emphasis on child protection, prohibiting targeted advertising and profiling directed at minors without explicit legal guardian consent.
Despite its progressive text, the contemporary legal challenge lies in its implementation. While the Ordinance took effect immediately upon its publication, the enforcement of specific procedural sections was delayed. Particularly, Sections 31 through 46, which pertain to the filing of complaints and the establishment of regulatory mechanisms, require the formation of a fully functional regulatory authority. Without a robust grievance redressal mechanism and an appointed Chief Data Officer, the substantive rights granted by the Ordinance risk remaining merely aspirational.
Moreover, local businesses and multinational corporations operating in Bangladesh face a steep compliance curve. Transitioning to infrastructure capable of honoring data subject rights, ensuring mandatory data breach notifications within prescribed time limits, and adhering to strict data retention policies require significant capital and technological investment.
In conclusion, the Personal Data Protection Ordinance, 2025 represents one of the most vital contemporary legal issues in Bangladesh today. It breathes life into the constitutional right to privacy and fundamentally redefines the relationship between the citizen, the state, and the digital economy. As the country moves toward full implementation, the legal fraternity must remain vigilant to ensure that the transition from legislative intent to executive enforcement truly empowers the digital citizen.
MD BAYAZID SHEIKH , Law student, Gopalganj Science and Technology University