Govt issues gazettes of 2 landmark ordinances on data protection, governance

Govt issues gazettes of 2 landmark ordinances on data protection, governance

Online Desk

Published: 2025-11-09 19:25:27

The government has issued gazette notifications on two groundbreaking laws — the Personal Data Protection Ordinance, 2025, and the National Data Governance Ordinance, 2025, marking a historic step towards ensuring the privacy, security, and ownership of citizens' personal data in Bangladesh.

The Law, Justice and Parliamentary Affairs Ministry issued separate notifications on the two ordinances on Thursday (6 November), said a press release of the Information and Communication Technology (ICT) Division on Sunday evening.

Earlier, the Council of Advisers gave final approval to both ordinances on 9 October.

Under the new ordinances, every citizen has been recognised as the rightful owner of their personal data, making their explicit consent mandatory before collection, storage, transfer, or use of any data.

Besides, sensitive data, including financial, health, genetic, and biometric information, will receive enhanced protection, while violations of data security will incur administrative penalties, compensation, fines, and other punishments.

To oversee these provisions, a high-powered national authority has been proposed.

Rights and Consent:
The Personal Data Protection Ordinance establishes citizens' full ownership over their personal data. Government and private entities will act only as data custodians or processors, not owners.

As per the ordinance, citizens will have the right to access, correct, delete, and restrict automated decisions made using their data.

The ordinance emphasises transparency, accountability, and informed consent, in line with international standards, while it ensures strong measures to prevent misuse of data.

Protection of Children and Sensitive Data:
The ordinance includes special safeguards for children and minors. Regarding processing data belonging to children or minors, consent must be obtained from a parent or legal guardian, while the new ordinance explicitly prohibits profiling, behavioural tracking, or targeted advertising directed at minors, recognising the potential risks of digital exploitation.