Bangladesh: passenger data record
- Data protection law
- Personal Data Protection Ordinance 2025, gazetted 6 November 2025 1
- Data protection authority
- National Data Governance Authority, set up under section 8 of the National Data Governance Ordinance 2025 2
- Agency that receives API/PNR
- Not published. A 2020 plan said the Special Branch of police would operate and monitor the system 4
- API/PNR status
- Planned. Still at the discussion stage on 29 April 2025 3
- Biometric collection at entry
- Not confirmed in any source we opened 3
- Date checked
- 21 October 2026
The data protection ordinance
The Council of Advisers gave final approval to the Personal Data Protection Ordinance 2025 and the National Data Governance Ordinance 2025 on 9 October 2025 1. The Law, Justice and Parliamentary Affairs Ministry issued the gazette notifications on Thursday 6 November 2025, as reported by the state news agency BSS 1.
The ordinance says citizens own their personal data and that government and private bodies act only as custodians or processors 1. Explicit consent is required before data is collected, stored, transferred or used 1. People can access, correct and delete their data and restrict automated decisions 1. Sensitive data, including biometric data, gets added protection 1.
- Scope: the ordinance applies to government agencies, autonomous bodies and state-owned enterprises, as reported by Md. Zahidur Rabbi in The Daily Star 2.
- Security exemptions: processing for state security, public order or legal compliance may be exempt if the action is proportionate and necessary 2.
- Cross-border transfers: personal data may leave Bangladesh only if the receiving country or organisation gives equivalent protection 2. Transfers for law enforcement or international cooperation must take place under formal agreements 2.
- Penalties: up to seven years in prison, a fine of up to BDT 20,00,000, or both 2.
- Timing: some sections take effect 18 months after gazette notification 2.
Who oversees the law
The Daily Star reported that the National Data Governance Authority (NDGA) is set up under section 8 of the National Data Governance Ordinance 2025 2. Its listed tasks are to monitor compliance, issue guidelines, investigate, handle complaints, register data fiduciaries, run audits and impose penalties 2. Appeals against NDGA decisions go to an appellate tribunal under the ICT Act 2006 2. Data breaches must be reported to the NDGA 2.
The BSS report of 9 November 2025 described the body as a national data management authority that has been proposed 1. It did not give a date for the authority to begin work 1.
Advance passenger information plans
In June 2018 the National Board of Revenue (NBR) proposed adding a rule to the Customs Act 1969 so that airlines would have to give customs API and PNR data, as reported by Sohel Parvez in The Daily Star 5. The report said customs could not legally require this data without such a rule 5. The sources we opened do not confirm that the rule took effect 5.
In October 2020 an inter-ministerial meeting decided to set up an APIS, as reported by Imran Hossain in the Dhaka Tribune 4. The plan listed name, address, passport number, nationality, date of birth, visa details, origin, destination and travel status as fields airlines would send 4. The report said all data would be stored on an international server, and the agency running that server would get a fee per passenger 4.
The Financial Express reported on 29 April 2025 that the project, started in 2016, was still at the discussion stage 3. The ministry chose UAE firms in January 2022 and a memorandum of understanding was signed in December 2022 3. Under it, the UAE side would use SITA technology and software 3. An ICAO assessment recommended a fee of US$3.50 per international arrival or departure, paid by passengers 3.
Who would see the data
According to the Civil Aviation Authority of Bangladesh (CAAB), as reported by Gulam Rabbani in The Financial Express, the following bodies would have access to APIS data 3.
Chronology
| Date | Event |
|---|---|
| 21 June 2018 5 | NBR proposes an API and PNR rule under the Customs Act 1969 5 |
| October 2020 4 | Inter-ministerial meeting decides to set up APIS 4 |
| January 2022 3 | Ministry chooses UAE firms for a government-to-government deal 3 |
| December 2022 3 | APIS memorandum of understanding signed 3 |
| 29 April 2025 3 | Project reported as still at the discussion stage 3 |
| 9 October 2025 1 | Council of Advisers approves both data ordinances 1 |
| 6 November 2025 1 | Gazette notifications issued 1 |
Common questions
Does Bangladesh have a data protection law?
Yes. The Personal Data Protection Ordinance 2025 was gazetted on 6 November 2025 1.
Does Bangladesh collect API or PNR data from airlines?
No source we opened confirms it. The APIS project was still at the discussion stage on 29 April 2025 3.
Who would pay for the APIS?
An ICAO assessment recommended a fee of US$3.50 per international passenger arrival or departure, paid by passengers 3.
Can personal data be sent abroad under the new ordinance?
Only if the receiving country or organisation gives equivalent protection, and law enforcement transfers need formal agreements 2.
Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email [email protected] with the official link.
Sources
- BSS: Govt issues gazettes of 2 landmark ordinances on data protection, governance (9 November 2025)
- The Daily Star, Md. Zahidur Rabbi: Bangladesh's Personal Data Protection Ordinance 2025, key takeaways (21 October 2025)
- The Financial Express, Gulam Rabbani: CAAB goes slow in setting up APIS (29 April 2025)
- Dhaka Tribune, Imran Hossain: APIS to be set up at Dhaka airport (20 November 2020)
- The Daily Star, Sohel Parvez: NBR seeks air travellers' info (21 June 2018)
Related
- Advance Passenger Information (API) explained
What API data is, which fields airlines send, who receives it, the legal basis, how long it is kept, and examples from four jurisdictions.
- Passenger Name Record (PNR) data explained
What PNR data is, the 19 EU data elements, who sends and receives it, the legal basis, retention rules and the 2022 EU Court of Justice ruling.
- Where passenger data is hosted
Where governments store API, PNR and biometric passenger records, what laws say about servers and location, and how donated and vendor systems fit in.
- Who oversees passenger data
The bodies that check how governments use API and PNR data: data protection authorities, data protection officers, courts and UN standards.
- UN Security Council Resolution 2396 and ICAO Annex 9
What Resolution 2396 (2017) asks of states on API, PNR, watch lists and biometrics, and how ICAO Annex 9 sets the passenger data standards.
- Pakistan: passenger data record
Where Pakistan's data protection bill stands, how the FIA Immigration Wing and IBMS work, NADRA's role, and the status of API and PNR.