Act 2026
ব্যক্তিগত উপাত্ত সুরক্ষা আইন, ২০২৬ (Personal Data Protection Act, 2026)
Plain-English summary
Act No. 63 of 2026, dated 10 April 2026, which repeals the Personal Data Protection Ordinance 2025 (Ordinance No. 61 of 2025). Covers consent and other grounds for processing, data subject rights, duties of data fiduciaries and processors, breach reporting and audits. Under s.1(3) it is deemed effective from 6 November 2025, except section 23 and sections 31 to 35, which start on a date the Government sets by gazette notification.
Who it applies to
All industries
Topics
Data Protection & Privacy
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Lawful basis, notice and data subject rights | Ongoing | — | source | |
PDPA 2026 s.5 makes consent the main lawful basis: it must be voluntary, specific, clear and withdrawable, the data subject must be told the purpose, retention period, transfers and withdrawal process, and the fiduciary must prove it. Section 5(3) lists cases needing no consent. Data subjects have access and portability (s.11), correction (s.12, concerned parties told within 30 days of a correction) and withdrawal of consent and erasure (s.13). Section 15(2) adds transparency information. Response times for access and erasure are left to regulations. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.