Insights · Data protection
What the new data protection Act means for your documents.
Super Intelligence (SI) answers from documents, and documents hold personal data. Here is what the Personal Data Protection Act 2026 asks, as we read it, and how to start an SI assistant without putting a single personal record at risk.
The law
An Act with an 18-month clock
The Personal Data Protection Act 2026 is Act 63 of 2026, dated 10 April 2026. The text is on the Ministry of Law's site (bdlaws.minlaw.gov.bd, read 10 October 2026). It sorts personal data into classes, including personal, sensitive and confidential data; the full list and the names need confirming against the gazetted text. The regulator is the National Data Management Authority.
The duties are the ones a modern data law carries. Consent must be clear, specific and revocable. People must be told what you hold and why. You must keep technical and organisational security measures. A breach must be reported to the regulator and to the people affected within the time the rules set. People have rights to access, correction, erasure, portability and withdrawal of consent. Sending certain identifiers and biometric data abroad is limited.
Two things make boards pay attention. Organisations the Act calls significant data controllers must appoint a Chief Data Officer. Fines run up to BDT 25 lakh, and up to BDT 50 lakh for significant data controllers. As we read the Act, the officer and fine sections start on a gazetted date after an 18-month transition, which is around October 2027 if counted from April 2026. The rules under the Act had not been issued when this was written. Confirm each of these points with counsel before you act on them.
Your documents
Three piles of paper
Most organisations keep three kinds of document. Policies, manuals, circulars, SOPs and product files hold no personal data. HR files, customer files and application forms hold personal data about named people. A smaller set holds data the Act treats as sensitive or confidential, such as health records or identity numbers; confirm the classes with counsel.
The first pile is where an SI assistant starts. It is the pile staff search most, and it is the pile the Act barely touches. That is why every Bahlul SI engagement begins with policies and manuals, not personal data. It is written into the third of our three promises: the first phase uses policies and manuals, and your data stays in Bangladesh by default.
The second and third piles are not out of reach for good. They need the Act's duties in place first: a record of what you hold and why, access limited by role, and a way to answer a person who asks what you hold about them. The data protection readiness package, six weeks for BDT 9.5 lakh, builds that record and the policies around it, with a partner law firm reading the legal parts.
The server
Where the documents sit matters
A document pasted into a public AI tool travels to a server abroad. For a published policy that is a choice. For a customer file it may run into the Act's limits on sending identifiers abroad, and for a bank it also meets Bangladesh Bank's cloud guideline, which keeps customers' financial data out of cross-border clouds without prior approval. A Bahlul SI server sits in your building or in a Bangladesh data centre. It has no internet route. Nothing leaves unless you decide it should.
Three features of the server line up with the Act's security duties. Answers come only from files the person asking may open, because permissions are linked to your existing staff accounts. Every question is logged with the user, the time and the sources used, so you can show who saw what. And identity numbers typed into a question are masked in the log, so the log does not become a new store of identifiers.
The log is itself a record about your staff. Decide how long it is kept, and say so in your notice to staff. A server does not make you compliant; only your own duties, met and evidenced, do that. What the server changes is how easy they are to meet.
First steps
Before October 2027
Name the person who will own data protection, even before the Act forces the choice. List what you hold. For the documents an SI assistant would read, a data inventory takes about a day; for the whole organisation it is the six-week package. Decide which pile the first SI workflow draws from, and keep it to the first pile.
Then prove the assistant on those documents. A three-week SI proof for BDT 5.5 lakh scores about 200 questions from your own files, and 20 of them are requests the system must refuse, such as a question about another person's data. You see how it behaves before any personal data is near it.
If you are likely to be a significant data controller, budget for the Chief Data Officer and for the records that role must keep. A data office retainer at BDT 1.2 lakh a month keeps the processing records current between audits. None of this is legal advice. Your lawyer reads the Act for you; we make sure the documents, the permissions and the log are ready when the reading comes back.
FAQ
Questions we are asked
Do we need a Chief Data Officer?
The Act requires one for organisations it calls significant data controllers. Whether you are one depends on the rules, which had not been issued when this was written. Ask counsel, and budget as if the answer is yes.
Can Bahlul SI read files that hold personal data?
Yes, once the Act's duties are in place and a named person at your organisation approves the collection. The first phase uses policies and manuals, so you learn the system before the stakes rise.
Does the Act stop us using public AI tools?
That is a question for counsel. What we can say is that a document pasted into a public AI tool leaves Bangladesh, and the Act limits sending certain identifiers and biometric data abroad.
Start with the pile that holds no personal data
Bring one workflow and ten documents that are not confidential. The first call is free, in Bangla or English.