Bangladesh has no cookie-specific law, but the Personal Data Protection Ordinance (PDPO) promulgated in November 2025 requires explicit consent before personal data is processed, and tracking cookies like _ga and _fbp collect personal data. If your website reaches visitors in Bangladesh, the practical answer is a banner that asks before non-essential cookies run. One caveat matters: an ordinance is temporary, so check whether the PDPO has been passed as an Act of Parliament before relying on its exact sections and dates.
Bangladesh's first data protection law
The Personal Data Protection Ordinance (PDPO) of November 2025 was Bangladesh's first comprehensive data protection law. Before it, there was no standalone privacy law governing personal data. The Cyber Security Act 2023, which came into force on 18 September 2023 and repealed the Digital Security Act 2018, made it an offence to collect or use another person's identification information without lawful authority, but said nothing about cookies, consent banners or lawful processing in general.
The PDPO, as promulgated, changes that. It makes consent the primary lawful basis for processing personal data, creates a National Data Governance Authority (NDGA) to enforce the rules, and introduces fines of up to 5% of annual turnover for serious violations.
An ordinance needs Parliament to last
The PDPO was made as an ordinance while Parliament stood dissolved. Under Article 93(2) of the Constitution of Bangladesh (archived copy of the official text), an ordinance must be laid before Parliament at its first meeting after it is made. It then ceases to have effect 30 days after it is laid, or earlier if Parliament passes a resolution disapproving it, unless Parliament enacts it in the meantime.
So the PDPO's future depends on what the next Parliament does with it at its first meeting. As of October 2026, an official record of a Personal Data Protection Act could not be confirmed for this update. Before relying on a section number, a penalty or a start date, check the official gazette or the Laws of Bangladesh site for the instrument in force. The consent-first approach in this guide holds either way.
How a Bangladeshi ordinance becomes, or stops being, law
What the PDPO covers
The PDPO borrows heavily from European data protection models. It calls organisations that determine the purpose and means of processing "data fiduciaries", the equivalent of GDPR data controllers, and those processing on their behalf "data processors".
Article 5 of the PDPO establishes that consent must be voluntary, specific, explicit and revocable. This applies to any collection of personal data, including information gathered through cookies and similar tracking technologies. The ordinance also introduces stricter rules for sensitive personal data and cross-border transfers.
The law applies extraterritorially. Any processing related to Bangladeshi individuals falls within scope, wherever the processing takes place.
Cookie rules under the PDPO
The PDPO does not mention cookies by name. Bangladesh has no equivalent of the EU's ePrivacy Directive, which regulates storing information on a user's device directly.
Cookies do, however, collect personal data. A tracking cookie like _ga or _fbp holds a unique identifier tied to a visitor's browsing behaviour, and that counts as personal data under the PDPO. Functional cookies such as PHPSESSID that store session data may also fall within scope if they can be linked to an identifiable person.
Because the PDPO requires explicit consent before processing personal data, the safest approach is to treat non-essential cookies as needing prior consent. Strictly necessary cookies, those the website needs to work, can be argued to fall under the contractual necessity exemption, but analytics and advertising cookies need a cookie banner with a clear opt-in.
The National Data Governance Authority
Under the ordinance, the NDGA is Bangladesh's data protection authority. It has powers to register and classify data fiduciaries, conduct audits, investigate complaints and impose penalties.
As promulgated, the sections on the Chief Data Officer appointment and on complaints, investigations and penalties start 18 months after the gazette notification, around May 2027. If Parliament has re-enacted the law as an Act, the Act's own commencement provisions decide those dates. Until enforcement starts, it remains limited.
That is not a reason to wait. Organisations that build sound data practices now avoid the rush when enforcement begins, as the GDPR's early years showed.
Penalties and enforcement
The PDPO, as promulgated, introduces both criminal and administrative penalties.
| Violation type | Penalty |
|---|---|
| General non-compliance | Administrative fine of 1 to 2% of annual turnover |
| Significant data fiduciary violations | Administrative fine of 2 to 5% of annual turnover |
| Unauthorised collection, use or disclosure of personal data | Up to 7 years' imprisonment, a fine of up to BDT 20,000,000, or both |
| Non-compliance with NDGA or court orders | Criminal liability for responsible officers |
Companies are not exempt. If a company commits an offence, its directors, managers or responsible officers face personal liability unless they can show due diligence.
How the PDPO compares with the GDPR
The PDPO shares structural similarities with the GDPR but differs in several key areas.
| Feature | Bangladesh PDPO 2025 | EU GDPR |
|---|---|---|
| Consent standard | Voluntary, specific, explicit, revocable | Freely given, specific, informed, unambiguous |
| Cookie-specific rules | None (general consent rules apply) | ePrivacy Directive addresses cookies directly |
| Maximum fine | Up to 5% of annual turnover | Up to 4% of global annual turnover or EUR 20 million |
| Criminal penalties | Up to 7 years' imprisonment | Left to EU member states |
| Data protection authority | NDGA (not yet enforcing) | National authorities in each member state |
| Extraterritorial scope | Yes | Yes |
| Right to erasure | Yes | Yes |
| Data breach notification | Required | 72 hours to the authority |
The PDPO's criminal penalties are harsher than the GDPR's approach, which relies on administrative fines. Broad exemptions for law enforcement and intelligence agencies have drawn criticism from privacy advocates.
Checklist for website owners
Audit your cookies
Run a cookie scan to identify every cookie your website sets. Classify each one as strictly necessary, functional, analytics or advertising. You cannot manage consent for cookies you do not know about.
Add a consent banner
Display a cookie consent banner that loads before any non-essential cookies fire. It should offer granular choices, not just "Accept all", and let visitors decline tracking without penalty. Pre-ticked boxes do not meet the PDPO's explicit consent standard.
Maintain a cookie policy
Publish a cookie policy that lists every cookie by name, purpose, duration and whether it is first-party or third-party. Link to it from your consent banner.
Respect consent choices
Block analytics scripts like Google Analytics and advertising pixels like the Meta Pixel until the visitor grants consent. If you use Google tags, Google Consent Mode v2 lets them follow the visitor's choice.
Record and store consent
Keep a log of each visitor's consent decision, including what was consented to and when. Because the PDPO requires consent to be revocable, you also need a way for visitors to withdraw it at any time.
Review cross-border transfers
If you use third-party services that transfer data outside Bangladesh, as most analytics and advertising tools do, check those transfers against the PDPO's cross-border provisions.
GDPR consent rules as a working baseline
The NDGA has not issued cookie-specific guidance. Until it does, treating the GDPR cookie consent requirements as your baseline is a practical strategy. The GDPR's consent standard is well documented, widely understood and at least as strict as the PDPO's.
A website that already follows GDPR consent rules, with prior opt-in for non-essential cookies, granular category choices and easy withdrawal, is well placed for the PDPO too. The reverse is less certain, because the GDPR has years of regulatory guidance and case law that the PDPO lacks.
If your site serves visitors in several countries, a geo-targeted cookie banner applies the consent model you set for each region, and the guide to privacy laws around the world covers the other jurisdictions.
Questions about cookie consent in Bangladesh
Does Bangladesh have a cookie consent law?
Bangladesh has no cookie-specific law. The Personal Data Protection Ordinance of November 2025 requires explicit consent for processing personal data, which includes data collected through tracking cookies like _ga and _fbp.
Is the PDPO still in force in 2026?
An ordinance lapses 30 days after it is laid before the new Parliament unless Parliament enacts it, under Article 93(2) of the Constitution. As of October 2026, check the official gazette for a Personal Data Protection Act before relying on the ordinance's exact sections and dates.
When does enforcement under the PDPO start?
As promulgated, the complaint, investigation and penalty provisions start 18 months after the gazette notification, around May 2027. If the law was re-enacted as an Act, the Act's commencement provisions decide.
What are the penalties for non-compliance with the PDPO?
As promulgated, administrative fines range from 1 to 2% of annual turnover for general violations to 2 to 5% for significant data fiduciaries. Criminal penalties include up to seven years' imprisonment and fines of up to BDT 20,000,000.
Do I need a cookie banner for a website targeting Bangladesh?
Yes. If your website uses non-essential cookies that collect personal data from Bangladeshi visitors, the PDPO's consent requirements mean you should display a cookie banner with an opt-in before those cookies fire.
What is the National Data Governance Authority?
The NDGA is the data protection authority the PDPO creates. It is to register data fiduciaries, conduct audits and impose penalties, and its enforcement powers start later than the rest of the law.
Ask before tracking visitors from Bangladesh
If your site has visitors in Bangladesh, the first step is knowing which cookies it sets. Kukie.io scans your site, blocks non-essential scripts until visitors accept them, applies the consent rules you set for each country and records every choice.
