Bangladesh Digital Security Act

Framework addressing cybercrimes, data protection, and digital communications security.

JurisdictionBangladesh
CategoryCybersecurity
StatusActive
Latest development

Analysis

Key Requirements

  • Criminalization of Cybercrimes: The Bangladesh Digital Security Act (DSA), now largely replaced by the Cyber Security Act (CSA) of 2023, criminalizes a wide range of cyber activities, including hacking, unauthorized access, cyberbullying, online fraud, and dissemination of false or defamatory information online. These provisions are intended to address threats to digital communications and data integrity. Bangladesh Ministry of Law, Justice and Parliamentary Affairs
  • Data Blocking and Removal Powers: Section 8 of the CSA empowers the Cyber Security Agency and law enforcement to request the Bangladesh Telecommunication Regulatory Commission (BTRC) to block or remove online data or information on broad and vaguely defined grounds, with such requests being binding and not subject to judicial review. Amnesty International Analysis of CSA
  • Search, Seizure, and Data Handling: Authorities are granted powers to search and seize digital devices suspected of being involved in cybercrimes. However, the law lacks clear safeguards on how seized data is stored, used, or destroyed, and does not specify procedures for returning devices to owners. Amnesty International Analysis of CSA
  • Continuation of Pending Cases: The CSA includes a repeal and savings clause that allows all cases filed under the previous DSA and ICT Act to continue, even if investigations or trials have not commenced. Amnesty International Analysis of CSA
  • Lack of Comprehensive Data Protection: While the CSA and previous laws address unauthorized access and some aspects of data misuse, Bangladesh lacks a dedicated, comprehensive data protection law covering collection, processing, and sharing of personal data. Regulatory Adaptation and Challenges in Bangladesh

Compliance Challenges

  • Vague and Broad Provisions: The law’s broad definitions and lack of clear criteria for offenses (such as “defamatory” or “offensive” content) create uncertainty and risk of arbitrary enforcement. Carnegie Endowment Analysis
  • Lack of Judicial Oversight: Powers to block or remove data are exercised without judicial review, raising concerns about due process and potential abuse. Amnesty International Analysis of CSA
  • Ongoing Prosecution under Repealed Laws: Despite the repeal of the DSA and ICT Act, over a thousand cases remain active, creating legal uncertainty for organizations and individuals. Center for Free Journalism Report
  • Insufficient Data Protection Framework: Organizations face challenges in protecting personal data due to the absence of a comprehensive data protection law, increasing exposure to data breaches and regulatory risk. Regulatory Adaptation and Challenges in Bangladesh
  • Real Example: Journalists and political activists have been disproportionately targeted under these laws, with over 1,500 cases filed in three years, leading to a chilling effect on free expression and digital innovation. Carnegie Endowment Analysis

Implementation Best Practices

Recent Updates

  • Repeal of DSA and ICT Act: The Digital Security Act (DSA) and Section 57 of the ICT Act were repealed in 2023, replaced by the Cyber Security Act (CSA). However, pending cases under the old laws continue to be prosecuted. Amnesty International Analysis of CSA
  • Continuation of Pending Cases: As of April 2024, over a thousand cases filed under the DSA and ICT Act remain active, despite the repeal. Center for Free Journalism Report
  • Calls for Dismissal of Old Cases: Human rights organizations and media have called for all pending DSA cases and convictions to be thrown out, but as of October 2024, no comprehensive amnesty has been granted. The Daily Star News

Related Regulations

Industry Impact

  • Chilling Effect on Free Expression: The broad and vague provisions of the DSA and CSA have led to self-censorship among journalists, activists, and ordinary citizens, impacting the media and civil society sectors. Carnegie Endowment Analysis
  • Operational Uncertainty for Businesses: Ongoing prosecutions under repealed laws and lack of clear data protection requirements create compliance uncertainty for businesses, especially those handling personal or sensitive data. Regulatory Adaptation and Challenges in Bangladesh
  • Increased Investment in Cybersecurity: Financial institutions and large organizations have responded by establishing CSUs, SOCs, and adopting international standards like PCI DSS to mitigate risk and demonstrate compliance. Implevista Cybersecurity Threats

Sources

Recent developments

  • — ICNL publishes a detailed handbook on Bangladesh’s Cyber Security Act explaining how the 2023 law formally repealed the Digital Security Act but retained most of its speech‑related offences and intrusive enforcement powers, raising ongoing cybersecurity‑related human rights concerns for media and civil society.[3] (source)
  • — Amnesty International urges Bangladesh’s interim government to repeal the 2023 Cyber Security Act, highlighting that it largely reproduces the repressive provisions of the former Digital Security Act and continues to enable crackdowns on online dissent and civic space.[1] (source)
  • — Amnesty’s briefing emphasizes that 58 of 59 Cyber Security Act provisions are inherited from the Digital Security Act, including key speech‑related offences and broad powers to search, seize devices, and order blanket blocking of online information, underscoring industry and civil society concerns that digital security regulation remains fundamentally unchanged.[1] (source)
  • — Transparency International Bangladesh issues a position paper finding that the draft Cyber Security Act keeps nearly all provisions of the Digital Security Act that restrict freedom of expression and press, noting only limited procedural changes (e.g., more bailable sections, longer investigation periods) and warning of continued risks for journalists and cybersecurity stakeholders.[2] (source)
  • — Rights activists and opposition leaders react to the draft Cyber Security Act, arguing it is “as repressive” as the Digital Security Act it replaces and warning that cybersecurity and digital regulation remain tools for suppressing criticism, despite government claims of reform and better protections.[8] (source)
  • — The Bangladeshi government announces that the much‑criticised Digital Security Act will be replaced by a new Cyber Security Act, with officials claiming reduced penalties for defamation and some changes to non‑bailable offences amid widespread concern from journalists and rights groups over continued risks to digital freedom and cybersecurity governance.[6] (source)
  • — Law Minister Anisul Huq confirms that the Digital Security Act will be redrafted into a Cyber Security Act, abolishing jail terms for defamation and adjusting penalties for religious‑sentiment offences, framed as preventing misuse of the DSA but criticized by observers for leaving core restrictive cyber provisions largely intact.[9] (source)
  • — Carnegie Endowment analysis shows the Digital Security Act has created a “culture of fear” online, with over 1,500 cases and extensive use by authorities to arrest critics, remove content, and deter reporting on human rights abuses, illustrating the act’s long‑term impact on Bangladesh’s cybersecurity and information ecosystem.[4] (source)
  • — Amnesty International publishes a briefing describing the Digital Security Act as an attack on freedom of expression, detailing vague offences, harsh non‑bailable penalties, and expansive surveillance powers that enable the Digital Security Agency to block online content and undermine a secure, rights‑respecting digital environment.[7] (source)
  • — The Digital Security Act formally comes into force after presidential assent, introducing broad powers for warrantless arrests and content blocking that media organizations and digital rights advocates say will seriously curb online free speech and have chilling effects on cybersecurity research and reporting.[5] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates