BD-PDPA-2026
Personal Data Protection Act, 2026
National Data Management Authority
National Data Management Authority
The Personal Data Protection Act, 2026 (Act No. 63 of 2026) received presidential assent and was published on 10 April 2026. It replaced the 2025 ordinance and deems most provisions effective from 6 November 2025. The controls use the enacted 2026 Act, not the superseded ordinance or earlier drafts.
The Act establishes rules for lawful processing, consent and sensitive data, processors, children's data, access and portability, accountability, security, retention, breach response, audits and security planning, regulatory oversight and cross-border transfers.
Map every processing activity to a lawful ground, maintain notices and proof of consent where used, contractually control processors, implement rights and incident workflows, and identify data that may be subject to localisation or transfer restrictions.