Bangladesh Personal Data Protection Act 2026: what clinics and diagnostic centres should do now

Every clinic, hospital and diagnostic centre in Bangladesh holds personal data that is private by nature: names, phone numbers, test results, diagnoses, prescriptions. A new law now sets rules for handling it. This guide explains it in plain language and gives you a practical list of steps for your facility.

Last checked: 22 October 2026. This is a plain-language summary based on published reports, not legal advice. We found no authentic English text of the Act, and the sources we read disagree on several points. Where they do, we say so. Confirm anything that matters with a Bangladesh-qualified lawyer and the official gazette.

What the law is

The Personal Data Protection Act 2026 is Act No. 63 of 2026, recorded as published by the Bangladesh Government Press on 10 April 2026 (Offlist). It follows the Personal Data Protection Ordinance 2025, issued in November 2025 (Securiti).

It applies to processing of personal data in Bangladesh, and to processing abroad that is connected to offering services to people in Bangladesh, according to the summaries.

What it says, in plain language

These points come from the secondary summaries we could read, so treat them as a guide to the main themes rather than the exact wording of the law.

Topic	What the summaries describe
Consent	Clear, specific, freely given and revocable. People must be told the purpose, how long data is kept and who it is shared with.
Sensitive data	A higher standard of consent. The 2025 ordinance listed health data as sensitive. Exceptions include medical emergencies and legal duties.
Children	Under 18 needs a parent or guardian’s consent.
Rights	Access, correction, erasure and withdrawal of consent.
Security	Measures such as encryption and pseudonymisation, tested regularly.
Records	Processing records kept for at least five years.
Breaches	Serious breaches must be reported to the regulator. The deadline was not stated.
Larger organisations	“Significant” data controllers must appoint a Chief Data Officer.
Vendors	If you use a processor, you remain responsible. A valid contract is needed.

What is still unclear

Be careful with claims you read online, including blog posts like this one. These points were unconfirmed or inconsistent in our sources:

• When the Act takes effect, and whether there is a transition period.
• Where data may be stored. The 2025 ordinance required confidential and restricted data to be kept in Bangladesh. A summary of the 2026 Act describes limits on large transfers of some identifiers but not a blanket rule.
• The exact penalties. One summary gives fixed fines, another describes percentage-of-turnover fines and prison terms for the earlier ordinance.
• Which body enforces it. Different sources name different bodies.

What a clinic or diagnostic centre can do now

None of these steps depends on the unclear points above. They are good practice under almost any reading of the law.

1. Write down what you collect. List the data you hold (registration, test results, prescriptions, bills, photos) and why you need each item.
2. Tell patients and ask for consent. Use a short, clear notice at registration. Record that the patient was informed. Ask a lawyer how emergency and legal-duty exceptions apply to you.
3. Limit who sees what. Reception does not need lab results; the lab does not need billing history. Give each role only what it needs.
4. Keep an access log. If a record is opened or changed, you should be able to say who did it and when.
5. Secure the basics. Strong passwords, two-factor sign-in for owners and admins, no shared logins, screen locks, and prompt removal of access when staff leave.
6. Be careful with WhatsApp and printouts. Send reports only to the patient’s own number, and do not leave reports on open counters.
7. Decide how long you keep records and who handles patient requests to see or correct their data.
8. Check your vendors. See the questions below.
9. Plan for a breach. Know who to call, how to tell affected patients and what you would report.

Questions to ask your software vendor

If your records live in cloud software, you are still the one responsible for them. Ask:

• Where is our data stored, and which sub-processors (hosting, backup, messaging, AI) touch it?
• Is it encrypted in transit and at rest?
• Is each facility’s data kept separate from other customers’?
• Is there a signed data processing agreement that says the vendor acts only on your instructions?
• Can we export or delete our data, and how quickly?
• Is there an audit log, role-based access and two-factor sign-in?
• What happens if there is a breach, and how fast will we hear?

For Hospify Pro, our privacy policy and data processing agreement cover these in writing: each facility has its own encrypted database, role-based access and audit logs, and Flexify Ltd acts as the processor for patient records. The policy also states that our service providers may store or process data in other countries, so if a localisation rule applies to you, raise it with us and your lawyer before you sign. A current list of sub-processors is available on request. We do not claim that using any software makes a facility compliant. Compliance depends on how you run the facility.

Where to check the details

• The gazetted Act, from the Bangladesh Government Press or the ICT Division’s law page.
• A Bangladesh-qualified lawyer who works with healthcare providers.
• DGHS for any health-sector guidance that follows.

See also our guide to what the 2-year licence changes for another recent rule change.

Sources

• Securiti: Bangladesh Personal Data Protection Act 2026 overview
• Offlist: status of Act No. 63 of 2026
• Mahbub Law: key highlights of the Personal Data Protection Ordinance 2025