How AI is Challenging Data Privacy Laws in Bangladesh

Imagine applying for a job, booking a ride or shopping online, only to discover that your national identity number, phone number, photograph and home address may have been exposed without your consent. In an era when artificial intelligence can analyse vast amounts of personal information in seconds, a data breach is no longer just a technical failure, it can become a threat to privacy, security and human dignity. Recent reports of alleged data exposure in Bangladesh, including claims involving Pathao users, highlight a pressing question: Are our laws keeping pace with the technologies that collect and process our personal information?

In a digital-first world, where online interactions and data generation are ubiquitous, data privacy has become a critical issue. Consumers increasingly demand transparency in how their data is collected, stored, and used. A recent study found that 87 per cent of consumers consider data privacy a fundamental human right, urging companies to prioritise ethical data practices. 

In Bangladesh, reports of data breaches involving digital platforms and businesses have highlighted the risks associated with storing large amounts of personal information. One recent example is Pathao, which confirmed that malicious actors had obtained some users’ personal information following a cybersecurity incident on October 4, 2026. The incident temporarily disrupted the platform’s services.

Bangladesh should consider introducing an “AI Privacy Impact Receipt” for organisations that use AI to process sensitive personal data or large volumes of personal information. This proposed mechanism would provide individuals with a short, accessible explanation of what data was collected, why it was needed, how it would be used, how long it would be retained and how they could challenge its misuse.

Another major incident involved Shwapno, one of Bangladesh’s largest supermarket chains. Following a cyberattack in August 2025, more than 410 gigabytes of data were reportedly leaked on the dark web in March 2026. The exposed information included customer names, phone numbers and purchase histories, alongside supplier details, business documents and internal records. The incident raised concerns about the protection of customer information and the risks associated with retaining large volumes of data.

The risks are not confined to Bangladesh. The Cambridge Analytica scandal exposed how personal information obtained through Facebook could be used for political profiling and targeted messaging. Similarly, the 2021 Facebook data leak, which reportedly exposed personal information associated with 533 million users, highlighted the scale of risks arising from the collection and handling of personal data. Although these incidents were not necessarily caused by AI, they demonstrate how personal information can be exploited when safeguards fail.
What Law Says?

Several national and international legal instruments are relevant to data privacy in the AI era. In Bangladesh, Article 43 of the Constitution protects the privacy of the home and correspondence and other means of communication, subject to reasonable restrictions imposed by law.
The Personal Data Protection Act, 2026, establishes a legal framework for the processing and protection of personal data. The National Data Management Act, 2026, addresses data governance, while the Cyber Security Act, 2026, and the Information and Communication Technology Act, 2006, are also relevant to aspects of cybersecurity and digital activity.

Internationally, Article 17 of the International Covenant on Civil and Political Rights (ICCPR) protects individuals against arbitrary or unlawful interference with their privacy. The European Union’s General Data Protection Regulation (GDPR), adopted in 2016 and applicable since 2018, establishes rules for processing personal data and provides individuals with specific rights. The EU Artificial Intelligence Act, which entered into force in 2024, introduces a risk-based framework for regulating AI systems.

In Bangladesh, limited technical expertise, institutional capacity and public awareness may complicate the enforcement of data protection rules. Monitoring digital platforms and investigating complex cyber incidents require specialised skills and resources. Another concern is the potential imbalance between individuals and organisations that collect their data. Companies may have extensive information about their users, while individuals often have little visibility into how that information is used or shared. 
The central problem, therefore, is not simply whether laws exist, but whether they provide meaningful protection in practice. Without effective oversight, adequate resources, transparent data practices and proportionate penalties for violations, legal safeguards may fail to prevent harm or provide timely remedies.

Bangladesh should consider introducing an “AI Privacy Impact Receipt” for organisations that use AI to process sensitive personal data or large volumes of personal information. This proposed mechanism would provide individuals with a short, accessible explanation of what data was collected, why it was needed, how it would be used, how long it would be retained and how they could challenge its misuse.
Bangladesh should also establish a coordinated complaint mechanism through which individuals can report suspected data protection violations without having to navigate multiple agencies. Complaints could be referred to the appropriate authority for investigation, with clear procedures for follow-up, independent review and access to remedies.

Organisations should be required to adopt appropriate technical and organisational safeguards, disclose breaches in accordance with applicable law and demonstrate accountability for their handling of personal information. Public awareness is equally important. Individuals should be able to understand their privacy rights, recognise potential risks and make informed decisions about sharing personal information. 

The legal challenges of data privacy in the AI era show that technological progress must not come at the expense of fundamental rights. Existing laws and international standards provide an important foundation, but their effectiveness depends on enforcement, institutional accountability and public awareness.
For Bangladesh, the priority should be to ensure that legal protections remain effective as AI technologies evolve. That requires clear responsibilities for organisations, capable oversight institutions, transparent data practices and accessible remedies for individuals whose information is misused.
Ultimately, public trust in AI will depend not only on what the technology can achieve, but also on whether people can retain meaningful control over their personal information. Innovation and privacy need not be competing goals.