§ 1Short title and introduction
Sections60
LanguageEnglish
The Cyber Security Act, 2023 is Bangladesh’s current legislation addressing cybercrime and digital security. It repeals and replaces the Digital Security Act, 2018, which had attracted significant domestic and international criticism over its impact on freedom of expression. The Act applies to any person who commits a cyber offence within Bangladesh or, through a computer system located in Bangladesh, causes harm outside the country. Its key mechanisms include the establishment of a Cyber Security Agency to investigate and prevent cybercrime, the criminalisation of unauthorised access to computer systems, data theft, identity fraud, and the dissemination of false or defamatory digital information. Penalties range from substantial fines to imprisonment of up to fourteen years for the most serious offences. Notable provisions include the power of the Cyber Security Agency to intercept, monitor, and decrypt digital communications with judicial authorisation, the requirement for critical information infrastructure operators to report cyber incidents, and the extradition provisions for cyber criminals. Critics have noted that certain provisions — particularly those relating to the dissemination of ‘false’ information — could still be used to restrict legitimate speech. The Act was repealed on 21 May 2025 by the Cyber Security Ordinance, 2025. It represented Bangladesh’s legislative framework for cyber governance during its brief period in force.
Full text · showing key sections
§ 2Definition
(1)Unless there is anything contrary to the subject or context in this Act,
(a) “Appellate Tribunal” means
Information and Communication Technology Act, 2006
Cyber Appellate Tribunal constituted under section 82 of (Act No. 39 of 2006);
(b) “database” means information, knowledge, facts, concepts or instructions presented in text, image, audio or video form, which—
(b) is or has been formally prepared by any computer or computer system or computer network; And
(a) prepared for use on any computer or computer system or computer network;
(c) “Agency” means the National Cyber Security Agency constituted under section 5;
(d) “Computer Emergency Response Team” or “Computer Incident Response Team” means the Computer Emergency Response Team or Computer Incident Response Team referred to in sub-section (2) of section 9;
(e) “computer system” means an interconnected system of one or more computers or digital devices capable of receiving, transmitting or storing data, individually or in conjunction with each other;
(f) “Council” means the National Cyber Security Council constituted under section 12;
(g) “Critical Information Infrastructure” means any such external or virtual information infrastructure as declared by the Government which controls, processes, transmits or stores any data or any digital or electronic information and which, if damaged or endangered—
(n) public safety or economic security or public health; And
(a) national security or state integrity or sovereignty,
It can have harmful effects;
(h) “National Computer Emergency Response Team” means the National Computer Emergency Response Team referred to in sub-section (1) of section 9;
(j) “Tribunal” has the meaning
Information and Communication Technology Act, 2006
Cyber Tribunal constituted under section 68 of (Act No. 39 of 2006);
(j) “digital” means an even-number (0 and 1/binary) or digit-based operation system, and for the purposes of this Act, includes electrical, digital magnetic, optical, biometric, electrochemical, electromechanical, wireless or electro-magnetic technology;
(k) “digital device” means any electronic, digital, magnetic, optical or data processing device or system, which uses electronic, digital, magnetic or optical impulses to perform logical, arithmetic and memory operations, and is connected to any digital or computer device system or computer network, and shall include all input, output, processing, storage, digital device software or communication facilities;
(l) “Digital Forensic Lab” means the Digital Forensic Lab described in section 10;
(d) “police officer” means any such police officer not below the rank of Inspector;
(d) “program” means instructions expressed in sound, signal, record or in any other form in a machine-readable medium, by means of which any particular function may be effected or effected by a digital device;
(n) “Criminal Procedure Code” has the meaning;
Code of Criminal Procedure, 1898
(Act No. V of 1898);
(v) "person" means any person or institution, company, partnership, firm or other body, in relation to a digital device, its controller and includes any entity or artificial legal entity created by law;
(th) “unlawful access” means access to any computer or digital device or digital network or digital information system without the permission of any person or authority or in violation of the conditions of such permission, or by such access to obstruct the exchange of any data in the said information system or to suspend or interrupt or stop its processing, or to change or amplify or add to or remove the said data or collect any data through any digital device;
(d) “Director-General” means the Director-General of the Finance Agency;
(d) “defamation” means defamation as defined in section 499 of the Penal Code (Act No. XLV of 1860);
(n) “Malware” means any digital or electronic instructions, data, programs or apps which—
(n) alter, distort, destroy, damage or impair the performance of or adversely affect the performance of any computer or digital device;
(a) connects itself with any other computer or digital device and becomes active during the execution of any program, data or instructions of the said computer or digital or electronic device and causes any harmful change or event in the said computer or digital or electronic device; or
(e) steals or creates automated access to information on any digital or electronic device;
(c) “spirit of liberation war” means those ideals of nationalism, socialism, democracy and secularism which motivated our brave people to dedicate themselves and sacrifice their lives as brave martyrs in the national liberation struggle;
(f) “cyber security” means the security of any digital device, computer or computer system;
(b) “service provider” means—
(n) any person who enables any user to communicate through a computer or digital process; or
(a) any such person, entity or organization that processes or stores computer data for or on behalf of the Service or users of the Service;
(a) “Appellate Tribunal” means
Information and Communication Technology Act, 2006
Cyber Appellate Tribunal constituted under section 82 of (Act No. 39 of 2006);
(b) “database” means information, knowledge, facts, concepts or instructions presented in text, image, audio or video form, which—
(b) is or has been formally prepared by any computer or computer system or computer network; And
(a) prepared for use on any computer or computer system or computer network;
(c) “Agency” means the National Cyber Security Agency constituted under section 5;
(d) “Computer Emergency Response Team” or “Computer Incident Response Team” means the Computer Emergency Response Team or Computer Incident Response Team referred to in sub-section (2) of section 9;
(e) “computer system” means an interconnected system of one or more computers or digital devices capable of receiving, transmitting or storing data, individually or in conjunction with each other;
(f) “Council” means the National Cyber Security Council constituted under section 12;
(g) “Critical Information Infrastructure” means any such external or virtual information infrastructure as declared by the Government which controls, processes, transmits or stores any data or any digital or electronic information and which, if damaged or endangered—
(n) public safety or economic security or public health; And
(a) national security or state integrity or sovereignty,
It can have harmful effects;
(h) “National Computer Emergency Response Team” means the National Computer Emergency Response Team referred to in sub-section (1) of section 9;
(j) “Tribunal” has the meaning
Information and Communication Technology Act, 2006
Cyber Tribunal constituted under section 68 of (Act No. 39 of 2006);
(j) “digital” means an even-number (0 and 1/binary) or digit-based operation system, and for the purposes of this Act, includes electrical, digital magnetic, optical, biometric, electrochemical, electromechanical, wireless or electro-magnetic technology;
(k) “digital device” means any electronic, digital, magnetic, optical or data processing device or system, which uses electronic, digital, magnetic or optical impulses to perform logical, arithmetic and memory operations, and is connected to any digital or computer device system or computer network, and shall include all input, output, processing, storage, digital device software or communication facilities;
(l) “Digital Forensic Lab” means the Digital Forensic Lab described in section 10;
(d) “police officer” means any such police officer not below the rank of Inspector;
(d) “program” means instructions expressed in sound, signal, record or in any other form in a machine-readable medium, by means of which any particular function may be effected or effected by a digital device;
(n) “Criminal Procedure Code” has the meaning;
Code of Criminal Procedure, 1898
(Act No. V of 1898);
(v) "person" means any person or institution, company, partnership, firm or other body, in relation to a digital device, its controller and includes any entity or artificial legal entity created by law;
(th) “unlawful access” means access to any computer or digital device or digital network or digital information system without the permission of any person or authority or in violation of the conditions of such permission, or by such access to obstruct the exchange of any data in the said information system or to suspend or interrupt or stop its processing, or to change or amplify or add to or remove the said data or collect any data through any digital device;
(d) “Director-General” means the Director-General of the Finance Agency;
(d) “defamation” means defamation as defined in section 499 of the Penal Code (Act No. XLV of 1860);
(n) “Malware” means any digital or electronic instructions, data, programs or apps which—
(n) alter, distort, destroy, damage or impair the performance of or adversely affect the performance of any computer or digital device;
(a) connects itself with any other computer or digital device and becomes active during the execution of any program, data or instructions of the said computer or digital or electronic device and causes any harmful change or event in the said computer or digital or electronic device; or
(e) steals or creates automated access to information on any digital or electronic device;
(c) “spirit of liberation war” means those ideals of nationalism, socialism, democracy and secularism which motivated our brave people to dedicate themselves and sacrifice their lives as brave martyrs in the national liberation struggle;
(f) “cyber security” means the security of any digital device, computer or computer system;
(b) “service provider” means—
(n) any person who enables any user to communicate through a computer or digital process; or
(a) any such person, entity or organization that processes or stores computer data for or on behalf of the Service or users of the Service;
(2)All words or expressions used in this Act which are not defined
Information and Communication Technology Act, 2006
It shall apply in the sense in which it is used.
Information and Communication Technology Act, 2006
It shall apply in the sense in which it is used.
§ 3Enforcement of laws
(1)If any provision of any other Act is inconsistent with any provision of this Act, the provisions of this Act shall prevail in so far as the provision of this Act is inconsistent with the provision of any other Act.
(2)Notwithstanding anything contained in sub-section (1), in respect of matters relating to the right to information
Right to Information Act, 2009
(Act No. 20 of 2009) shall remain in force.
Right to Information Act, 2009
(Act No. 20 of 2009) shall remain in force.
§ 4Transnational application of law
(1)If any person commits an offense under this Act outside Bangladesh which if committed in Bangladesh would have been punishable under this Act, the provisions of this Act shall apply as if the offense had been committed by him in Bangladesh.
(2)If any person commits an offense under this Act within Bangladesh with the help of a computer, computer system, computer network or digital device located in Bangladesh from outside Bangladesh, then the provisions of this Act shall apply against such person as if the entire process of said offense was committed in Bangladesh.
(3)If any person commits an offense under this Act outside Bangladesh from within Bangladesh, the provisions of this Act shall apply as if the entire process of said offense had been committed in Bangladesh.
§ 5Formation of agencies, offices, etc
(1)For the purposes of this Act, the Government shall, by notification in the Official Gazette, constitute an agency to be called the National Cyber Security Agency consisting of 1 (one) Director General and such number of Directors as may be prescribed by rule.
(2)The head office of the Agency shall be at Dhaka, but the Government may, if necessary, establish its branch office at any place in the country outside Dhaka.
(3)The Agency shall be administratively attached to the Department of Information and Communication Technology.
(4)The powers, duties and functions of the Agency shall be determined by rules.
§ 6Appointment of Director General and Directors, etc
(1)The Director General and Directors shall be appointed by the Government from amongst persons having expertise in computer or cyber security and their terms of service shall be prescribed by the Government.
(2)The Director-General and the Directors shall be whole-time employees of the Agency, and shall, subject to the provisions of this Act and the rules made thereunder, perform such functions, exercise powers and perform such duties as may be directed by the Government.
(3)If the post of Director General becomes vacant, or if the Director General is unable to perform his duties due to absence, illness or any other reason, the senior Director shall temporarily perform the duties of the Director General until the newly appointed Director General takes over the vacancy or until the Director General is able to perform his duties again.
§ 7Agency manpower
(1)The Agency shall have the necessary manpower as per the organizational structure approved by the Government.
(2)The terms and conditions of employment of the agency's workforce shall be determined by rules.
§ 8Ability to remove or block certain data
(1)The Director General may request the Bangladesh Telecommunication Regulatory Commission, hereinafter referred to as BTRC, to remove or, as the case may be, block said information, if any information published or disseminated through digital or electronic means poses a threat to cyber security.
(2)If the law enforcement agencies, subject to data analysis, have reason to believe that any data published or disseminated through digital or electronic means undermines the unity, economic activity, security, defense, religious values or public order of the country or any part thereof, or promotes ethnic hatred and hatred, then the law enforcement agencies to remove or block the said data, Through the Director General, may request BTRC.
(3)On receipt of any request under sub-sections (1) and (2), the BTRC shall, by intimation to the Government concerned, forthwith remove or, as the case may be, block the said data.
(4)For the purposes of this section, such other matters as may be necessary shall be prescribed by rule.
§ 9Computer Emergency Response Team
(1)For the purposes of this Act, there shall be a National Computer Emergency Response Team under the Agency.
(2)Any critical information infrastructure declared under section 15 may, if necessary, with the prior approval of the Agency, constitute its own Computer Emergency Response Team or Computer Incident Response Team.
(3)The National Computer Emergency Response Team and the Computer Emergency Response Team or the Computer Incident Response Team shall consist of cyber security experts and, where necessary, members of law enforcement agencies.
(4)The National Computer Emergency Response Team and the Computer Emergency Response Team or the Computer Incident Response Team shall, in the manner prescribed by the rules, function round the clock.
(5)Without prejudice to the generality of sub-section (4), the National Computer Emergency Response Team and the Computer Emergency Response Team or the Computer Incident Response Team shall perform the following duties, namely:-
(a) ensuring emergency security of critical information infrastructure;
(b) promptly take necessary measures to remedy cyber or digital attacks and cyber or digital security breaches;
(c) taking necessary measures to prevent possible and imminent cyber or digital attacks;
(d) for the purposes of this Act, with the approval of the Government, undertaking general cooperative activities, including exchange of information, with any similar foreign team or organization; And
(e) performing other functions prescribed by rules.
(a) ensuring emergency security of critical information infrastructure;
(b) promptly take necessary measures to remedy cyber or digital attacks and cyber or digital security breaches;
(c) taking necessary measures to prevent possible and imminent cyber or digital attacks;
(d) for the purposes of this Act, with the approval of the Government, undertaking general cooperative activities, including exchange of information, with any similar foreign team or organization; And
(e) performing other functions prescribed by rules.
(6)The Agency shall coordinate and supervise the National Computer Emergency Response Team, Computer Emergency Response Team or Computer Incident Response Team.
§ 10Digital Forensic Lab
(1)For the purposes of this Act, there shall be, under the control and supervision of the Agency, one or more Digital Forensic Labs.
(2)Notwithstanding anything contained in sub-section (1), if any digital forensic lab has been established under any Government authority or organization prior to the commencement of this Act, subject to the achievement of the standards prescribed under section 11, the agency shall grant recognition thereof and in that case the said lab shall be deemed to have been established under this Act.
(3)The Agency shall coordinate among digital forensic labs.
(4)Establishment, use, management and other matters of Digital Forensic Lab shall be determined by the rules.
§ 11Quality Control of Digital Forensic Labs
(1)The Agency shall, in accordance with the criteria prescribed by rule, ensure the quality of each digital forensic laboratory.
(2)In ensuring the quality standards prescribed under sub-section (1), every digital forensic laboratory shall, inter alia—
(a) conduct its operations by suitably qualified and trained manpower;
(b) ensure its physical infrastructural facilities;
(c) take necessary steps to maintain the security and confidentiality of information stored thereunder;
(d) use quality equipment to maintain technical standards for digital forensic testing; And
(e) carry out the work in the manner prescribed by the rules, following the scientific process.
(a) conduct its operations by suitably qualified and trained manpower;
(b) ensure its physical infrastructural facilities;
(c) take necessary steps to maintain the security and confidentiality of information stored thereunder;
(d) use quality equipment to maintain technical standards for digital forensic testing; And
(e) carry out the work in the manner prescribed by the rules, following the scientific process.
§ 12National Cyber Security Council
(1)For the purposes of this Act, there shall be constituted a National Cyber Security Council consisting of the following members, namely:-
(a) the Prime Minister, Government of the People's Republic of Bangladesh, who shall also be its Chairman;
(b) Ministers, Ministers of State and Deputy Ministers of the Ministry of Posts, Telecommunications and Information Technology;
(c) the Minister, Ministry of Law, Justice and Parliamentary Affairs;
(d) Advisor to the Prime Minister on ICT;
(e) the Principal Secretary to the Prime Minister;
(f) the Governor, Bangladesh Bank;
(g) Secretary, Department of Posts and Telecommunications;
(h) Secretary, Department of Information and Communication Technology;
(j) Secretary, Department of Public Safety;
(j) Foreign Secretary, Ministry of Foreign Affairs;
(k) Inspector General of Police, Bangladesh Police;
(l) Chairman, Bangladesh Telecommunication Regulatory Commission;
(d) the Director General, Directorate General of Defense Intelligence;
(d) Director General, National Security Intelligence Agency;
(n) the Director General, National Telecommunication Monitoring Centre; And
(r) Director General, National Cyber Security Agency.
(a) the Prime Minister, Government of the People's Republic of Bangladesh, who shall also be its Chairman;
(b) Ministers, Ministers of State and Deputy Ministers of the Ministry of Posts, Telecommunications and Information Technology;
(c) the Minister, Ministry of Law, Justice and Parliamentary Affairs;
(d) Advisor to the Prime Minister on ICT;
(e) the Principal Secretary to the Prime Minister;
(f) the Governor, Bangladesh Bank;
(g) Secretary, Department of Posts and Telecommunications;
(h) Secretary, Department of Information and Communication Technology;
(j) Secretary, Department of Public Safety;
(j) Foreign Secretary, Ministry of Foreign Affairs;
(k) Inspector General of Police, Bangladesh Police;
(l) Chairman, Bangladesh Telecommunication Regulatory Commission;
(d) the Director General, Directorate General of Defense Intelligence;
(d) Director General, National Security Intelligence Agency;
(n) the Director General, National Telecommunication Monitoring Centre; And
(r) Director General, National Cyber Security Agency.
(2)The Director General shall provide secretarial assistance in the conduct of the Council.
(3)For the purpose of sub-section (1), the Council may, on the advice of the Chairman, at any time, by notification in the Official Gazette, co-opt any expert as its member for such period and conditions as may be prescribed.
§ 13Powers of Council, etc
(1)The Council shall, for the purpose of carrying out the provisions of this Act and the rules made thereunder, give necessary directions and advice to the Agency.
(2)The Council shall, inter alia, perform the following functions, namely:-
(a) providing necessary guidance for remediation of cyber security threats;
(b) advising on cyber security infrastructure development and manpower augmentation and upgrading;
(c) formulation of inter-institutional policies aimed at ensuring cyber security;
(d) taking necessary measures to ensure proper enforcement of laws and rules made thereunder; And
(e) perform any other function prescribed by law.
(a) providing necessary guidance for remediation of cyber security threats;
(b) advising on cyber security infrastructure development and manpower augmentation and upgrading;
(c) formulation of inter-institutional policies aimed at ensuring cyber security;
(d) taking necessary measures to ensure proper enforcement of laws and rules made thereunder; And
(e) perform any other function prescribed by law.
§ 14Council meetings, etc
(1)Subject to the other provisions of this section, the Council may determine the procedure for its meetings.
(2)The meeting of the Council shall be held on such date, time and place as may be fixed by its Chairman.
(3)The Chairman may call a meeting of the Council at any time.
(4)The Chairman shall preside at all meetings of the Council.
(5)No action or proceeding of the Council shall be invalid merely because of a vacancy in the office of any member of the said Council or a defect in the constitution of the Council and no question shall be raised in connection therewith.
§ 15Critical Information Infrastructure
For the purposes of this Act, the Government may, by notification in the Government Gazette, declare any computer system, network or information infrastructure to be a critical information infrastructure.
§ 16Security monitoring and inspection of critical information infrastructure
(1)The Director General shall, from time to time, inspect and inspect any important information infrastructure and submit a report thereon to the Government to ascertain whether the provisions of this Act are being duly complied with.
(2)The critical information infrastructures declared under this Act shall, in the manner prescribed by the rules, submit an inspection report to the Government every year after inspecting its internal and external infrastructure and inform the Director General of the contents of the said report.
(3)If the Director General has reason to believe that the activities of any person in any matter under his jurisdiction are threatening or harmful to the critical information infrastructure, he may, on his own initiative or on receiving any complaint from anyone, investigate the same.
(4)For the purposes of this section, security monitoring and inspection activities shall be carried out by a person who is an expert in cyber security.
§ 17Penalty for illegal access to critical information infrastructure, etc
(1)If any person willfully or knowingly in any critical information infrastructure—
(a) enters unlawfully; or
(b) damages or destroys or disables it by unlawful entry or attempts to do so,
If such act of such person shall be an offence.
(a) enters unlawfully; or
(b) damages or destroys or disables it by unlawful entry or attempts to do so,
If such act of such person shall be an offence.
(2)If any person in sub-section (1)—
(a) commits an offense under clause (a), he shall be punished with imprisonment for a term not exceeding 3 (three) years, or with a fine not exceeding 25 (twenty five) lakhs, or with both; And
(b) commits any offense under clause (b), then he shall be punished with imprisonment not exceeding 6 (six) years, or with fine not exceeding 1 (one) crore, or with both.
(a) commits an offense under clause (a), he shall be punished with imprisonment for a term not exceeding 3 (three) years, or with a fine not exceeding 25 (twenty five) lakhs, or with both; And
(b) commits any offense under clause (b), then he shall be punished with imprisonment not exceeding 6 (six) years, or with fine not exceeding 1 (one) crore, or with both.
§ 18Unlawful access to computers, digital devices, computer systems, etc. and penalties
(1)If any person willfully—
(a) unlawfully accesses or facilitates access to any computer, digital device, computer system or computer network; or
(b) unlawfully accesses, or assists in the entry of, any computer, digital device, computer system or computer network for the purpose of committing an offence, such act by such person shall be an offence.
(a) unlawfully accesses or facilitates access to any computer, digital device, computer system or computer network; or
(b) unlawfully accesses, or assists in the entry of, any computer, digital device, computer system or computer network for the purpose of committing an offence, such act by such person shall be an offence.
(2)If any person in sub-section (1)—
(a) commits an offense under clause (a), shall be punished with imprisonment not exceeding 6 (six) months, or with fine not exceeding two (two) lakhs of rupees, or with both;
(b) commits any offense under clause (b), then he shall be punished with imprisonment not exceeding 3 (three) years, or with fine not exceeding 10 (ten) lakhs, or with both.
(a) commits an offense under clause (a), shall be punished with imprisonment not exceeding 6 (six) months, or with fine not exceeding two (two) lakhs of rupees, or with both;
(b) commits any offense under clause (b), then he shall be punished with imprisonment not exceeding 3 (three) years, or with fine not exceeding 10 (ten) lakhs, or with both.
(3)If the offense committed under sub-section (1) is committed in relation to any computer, digital device, computer system or computer network protected by critical information infrastructure, he shall be punished with imprisonment not exceeding 3 (three) years, or with fine not exceeding 10 (ten) lakh rupees, or with both.
§ 19Damages and penalties for computers, computer systems, etc
(1)If any person—
(a) collects any data, database, information or excerpt thereof from any computer, computer system or computer network, or collects information from such computer, computer system or computer network, including transferable stored data, or collects copies or parts of any data;
(b) intentionally introduces or attempts to introduce any infectious, malware or harmful software into any computer, computer system or computer network;
(c) intentionally damages, or attempts to damage, any computer, computer system, computer network, data or computer database or damages or attempts to damage any other program stored on such computer, computer system or computer network;
(d) obstructs or attempts to obstruct any authorized or authorized person's access to any computer, computer system or computer network;
(e) knowingly generates or attempts to generate or market spam or send unsolicited electronic mail for the purpose of marketing any product or service, without the consent of the sender or subscriber; or
(f) wrongfully interferes with or tampers with any computer, computer system or computer network, accepts the services of any person or collects or attempts to collect charges as another,
If such act of such person shall be an offence.
(a) collects any data, database, information or excerpt thereof from any computer, computer system or computer network, or collects information from such computer, computer system or computer network, including transferable stored data, or collects copies or parts of any data;
(b) intentionally introduces or attempts to introduce any infectious, malware or harmful software into any computer, computer system or computer network;
(c) intentionally damages, or attempts to damage, any computer, computer system, computer network, data or computer database or damages or attempts to damage any other program stored on such computer, computer system or computer network;
(d) obstructs or attempts to obstruct any authorized or authorized person's access to any computer, computer system or computer network;
(e) knowingly generates or attempts to generate or market spam or send unsolicited electronic mail for the purpose of marketing any product or service, without the consent of the sender or subscriber; or
(f) wrongfully interferes with or tampers with any computer, computer system or computer network, accepts the services of any person or collects or attempts to collect charges as another,
If such act of such person shall be an offence.
(2)If any person commits an offense under sub-section (1), he shall be punished with imprisonment for a term not exceeding seven (7) years, or with a fine not exceeding ten (10) lakhs, or with both.
§ 20Offenses and penalties related to modification of computer source code
(1)If any person willfully or knowingly conceals, destroys or alters the computer source code used in any computer program, computer system or computer network, or attempts to conceal, destroy or alter the said code, program, system or network through any other person, and if the said source code is storable or maintainable, such act by such person shall be an offence.
(2)If any person commits an offense under sub-section (1), he shall be punished with imprisonment for a term not exceeding 3 (three) years, or with fine not exceeding 3 (three) lakhs, or with both.
§ 21Punishment for hatred, misinformation and defamatory propaganda about the Liberation War, the spirit of the Liberation War, Father of the Nation Bangabandhu Sheikh Mujibur Rahman, the National Anthem or the National Flag.
(1)If any person conducts or supports the propaganda of hatred, misinformation and slander about Bangladesh's liberation war, the spirit of the liberation war, Father of the Nation Bangabandhu Sheikh Mujibur Rahman, the national anthem or the national flag through digital or electronic means, then such act of such person shall be an offence.
(2)If any person commits an offense under sub-section (1), he shall be punished with imprisonment for a term not exceeding 5 (five) years, or with a fine not exceeding 1 (one) crore rupees, or with both.
§ 22Digital or electronic fraud
(1)If any person commits fraud by using digital or electronic means, such act by such person shall be an offence.
(2)If any person commits an offense under sub-section (1), he shall be punished with imprisonment for a term not exceeding 2 (two) years, or with fine not exceeding five (five) lakhs of rupees, or with both.
Explanation-For the purposes of this section, “digital or electronic fraud” means the manipulation by any person of any improper data or program, information or false operation, information system, computer or digital network by preparing, altering, erasing and concealing the input or output of any computer or digital device without or in excess of granted rights or through unauthorized exercise.
§ 23Digital or electronic fraud
(1)If any person commits fraud by using digital or electronic means, such act by such person shall be an offence.
(2)If any person commits an offense under sub-section (1), he shall be punished with imprisonment for a term not exceeding 5 (five) years, or with fine not exceeding 5 (five) lakhs, or with both.
Explanation-For the purposes of this section, “digital or electronic fraud” means any person intentionally or knowingly or without permission altering, deleting, adding new information or distorting any information in any computer program, computer system, computer network, digital device, digital system, digital network or social media to reduce its value or usefulness, to attempt to obtain any advantage or damage to himself or any other person or resorting to deception.
§ 24Identity fraud or impersonation
24 (1) If any person intentionally or knowingly uses any computer, computer program, computer system, computer network, any digital device, digital system or digital network-
(a) impersonates another person or misrepresents any other person's personal information with intent to defraud or deceive; or
(b) intentionally falsely assumes the identity of any person, living or dead, for the purposes set out below,-
(b) benefiting or causing to be benefited by himself or any other person;
(a) acquiring any property or interest in property;
(e) harming any person or entities;
If such act of such person shall be an offence.
(2)If any person commits an offense under sub-section (1), he shall be punished with imprisonment for a term not exceeding 5 (five) years, or with fine not exceeding 5 (five) lakhs, or with both.
§ 25Offensive, false or threatening, transmission of information, publication, etc
(1)If any person on the website or any other digital or electronic medium—
(a) knowingly or knowingly transmits, transmits, publishes or disseminates any information that is offensive or intimidating or is intended to annoy, insult, defame or degrade any person, whether or not known to be false; or
(b) publishes, or disseminates or assists in the dissemination of, any information in a wholly or partially distorted form, whether defaming the image or reputation of the State, or spreading misinformation, or otherwise, whether known to be slanderous or false,
If such act of such person shall be an offence.
(a) knowingly or knowingly transmits, transmits, publishes or disseminates any information that is offensive or intimidating or is intended to annoy, insult, defame or degrade any person, whether or not known to be false; or
(b) publishes, or disseminates or assists in the dissemination of, any information in a wholly or partially distorted form, whether defaming the image or reputation of the State, or spreading misinformation, or otherwise, whether known to be slanderous or false,
If such act of such person shall be an offence.
(2)If any person commits an offense under sub-section (1), he shall be punished with imprisonment for a term not exceeding 2 (two) years, or with fine not exceeding 3 (three) lakhs, or with both.
§ 26Penalties for collection, use, etc. of contact information without permission
(1)It shall be an offense for any person to collect, sell, possess, supply or use the identity information of another person without lawful authority.
(2)If any person commits an offense under sub-section (1), he shall be punished with imprisonment for a term not exceeding 2 (two) years, or with fine not exceeding 5 (five) lakhs, or with both.
Explanation-For the purposes of this section, "identifying information" means any external, biological or physical information or any other information which, singly or collectively, identifies a person or system, including name, photograph, address, date of birth, mother's name, father's name, signature, national identity card, birth and death registration number, fingerprint, passport number, bank account number, driving license, e-TIN number, electronic or digital signature, username, credit or debit card number, Voyage Prints, Retina Images, Iris Images, DNA Profiles, Security Questions or any other identification that is readily available for technology excellence.
§ 27Crime and Punishment of Cyber Terrorism
(1)If any person—
(a) interferes with lawful access to or unlawfully accesses any computer or computer network or Internet network with intent to endanger national integrity, security and sovereignty and to instill fear among the public or any section thereof;
(b) causes contamination of any digital device or introduces malware which causes or is likely to cause death or serious injury to any person; or
(c) impairs or disrupts the provision of essential goods and services to the public or adversely affects any critical information infrastructure; or (d) willfully or knowingly enters or accesses any computer, computer network, Internet network, stored data or computer database or accesses any such stored data or computer database which may be used for any purpose prejudicial to friendly relations or public order with a foreign state or for the benefit of a foreign state or any person or group,
In that case, the similar act of the person will be a cyber terrorism crime.
(a) interferes with lawful access to or unlawfully accesses any computer or computer network or Internet network with intent to endanger national integrity, security and sovereignty and to instill fear among the public or any section thereof;
(b) causes contamination of any digital device or introduces malware which causes or is likely to cause death or serious injury to any person; or
(c) impairs or disrupts the provision of essential goods and services to the public or adversely affects any critical information infrastructure; or (d) willfully or knowingly enters or accesses any computer, computer network, Internet network, stored data or computer database or accesses any such stored data or computer database which may be used for any purpose prejudicial to friendly relations or public order with a foreign state or for the benefit of a foreign state or any person or group,
In that case, the similar act of the person will be a cyber terrorism crime.
(2)If any person commits an offense under sub-section (1), he shall be punished with imprisonment for a term not exceeding 14 (fourteen) years, or with fine not exceeding 1 (one) crore rupees, or with both.
§ 28Publication, transmission, etc. of any such information offensive to religious values or sentiments on the website or in any electronic format
(1)If any person or group intentionally or knowingly publishes or disseminates on the website or any other electronic format anything which offends religious sentiments or religious values with the intention of inciting or offending religious sentiments, such act by such person shall be an offence.
(2)If any person commits an offense under sub-section (1), he shall be punished with imprisonment for a term not exceeding two (2) years, or with fine not exceeding five (five) lakhs of rupees, or with both.
§ 29Publication, dissemination, etc. of defamatory information
If a person publishes or disseminates defamatory information as described in section 499 of the Penal Code (Act No. XLV of 1860) on a website or in any other electronic format, then such act of such person shall be an offense and he shall be punished with a fine not exceeding 25 (twenty five) lakhs of rupees.
§ 30Offenses and penalties for unauthorized e-transactions
(1)If any person—
(a) conducts e-transactions without lawful authority using any digital or electronic medium from any bank, insurance or other financial institution or mobile financial service provider; or
(b) carry out e-transactions notwithstanding that any e-transaction issued by the Government or Bangladesh Bank, from time to time, has been declared invalid,
If such act of such person shall be an offence.
(a) conducts e-transactions without lawful authority using any digital or electronic medium from any bank, insurance or other financial institution or mobile financial service provider; or
(b) carry out e-transactions notwithstanding that any e-transaction issued by the Government or Bangladesh Bank, from time to time, has been declared invalid,
If such act of such person shall be an offence.
(2)If any person commits an offense under sub-section (1), he shall be punished with a fine not exceeding 25 (twenty five) lakhs of rupees.
Explanation-For the purpose of this section, "e-transaction" means any instruction, order or authority given by a person to transfer his funds to any bank, financial institution or any specified account number by digital or electronic means, instructions, order or authority to deposit or withdraw funds and any money transfer by any digital or electronic means.
§ 31Offenses and punishments for disturbing law and order, etc
(1)If a person intentionally publishes or broadcasts on a website or in digital format anything that creates enmity, hatred or enmity between the various classes or communities concerned or destroys communal harmony or creates instability or disorder or deteriorates law and order or is about to do so, such act by such person shall be an offence.
(2)If any person commits an offense under sub-section (1), he shall be punished with imprisonment for a term not exceeding 5 (five) years, or with a fine not exceeding 25 (twenty five) lakhs, or with both.
§ 32Crimes and penalties related to hacking
If any person commits hacking, it shall be an offense and shall be punishable with imprisonment not exceeding 14 (fourteen) years, or with fine not exceeding 1 (one) crore rupees, or with both.
Explanation-For the purposes of this section, “hacking” means—
(a) steal, destroy, destroy, alter or reduce the value or usefulness of or otherwise damage any information in a computer database; or
(b) causing damage to any computer, server, computer network or other electronic system not owned or occupied by the user.
§ 33Aiding and abetting crime and its punishment
(1)If any person assists in the commission of any offense under this Act, such act by such person shall be an offence.
(2)If any person commits an offense under sub-section (1), he shall be punished with the same punishment as is prescribed for the original offence.
§ 34Crime and Punishment of False Cases, Filing of Complaints, etc
(1)If any person files or makes a suit or complaint against that person with the intention of injuring another person under any other section of this Act without having any just or lawful cause for filing a suit or complaint, it shall be an offense and the person filing the suit or complaint and the person who filed the complaint shall be punished with the penalty prescribed for the original offence.
(2)If any person files a suit or complaint under sub-section (1) under more than one section of this Act, the amount of penalty for the main offense for which the amount of penalty is higher among the offenses mentioned in the said section shall be determined as the amount of penalty.
(3)The Tribunal may, on the written complaint of any person, entertain and try cases of offenses committed under sub-section (1).
§ 35Offenses committed by the company
(1)In the case of the commission of any offense under this Act by any company, every such owner, chief executive, director, manager, secretary, partner or any other officer or employee or representative of the company who is directly connected with the said offense shall be deemed to have committed the said offence, unless he is able to prove that the said offense was committed without his knowledge or that he made every effort to prevent the said offence.
(2)If the company mentioned in sub-section (1) is an organization with legal personality, apart from the person being charged and convicted, the said company may be separately charged and convicted in the same proceedings, but only fine shall be imposed on it as per the relevant provisions.
Explanation-For the purposes of this section,-
(a) “company” shall include any commercial establishment, partnership, association, association or organization;
(b) in the case of a commercial enterprise, “director” shall include any partner or member of the board of directors thereof.
§ 36Power to order compensation
If a person causes financial loss to another person by digital or electronic fraud under section 22, digital or electronic fraud under section 23 or impersonation or impersonation under section 24, the Tribunal may order compensation to be paid to the affected person by way of compensation equal to the loss caused or such amount as it deems fit.
§ 37Service provider not liable
A service provider shall not be liable under this Act or the rules made thereunder for having arranged to obtain information, if he is able to prove that the offense or violation concerned was committed without his knowledge or that he has made every effort to prevent the said offense from being committed.
§ 38Investigation, etc
(1)The Police Officer, hereinafter referred to in this Chapter as the Investigating Officer, shall investigate any offense committed under this Act.
(2)Notwithstanding anything contained in sub-section (1), if it appears at the commencement of any case or at any stage of investigation that it is necessary to constitute an investigation team for the proper investigation of the case, the Tribunal or the Government may by order, under the control and conditions of the authority or body specified in the order, constitute a joint investigation team consisting of investigating agencies, law enforcement agencies and agencies.
§ 39Time limit for investigation, etc
(1)Investigating Officer-
(a) complete the investigation within 90 (ninety) days from the date of receipt of responsibility for the investigation of any crime;
(b) if he fails to complete the investigation within the time prescribed under clause (a), he may, subject to the approval of his controlling officer, extend the period of investigation by an additional fifteen (15) days;
(c) If he fails to complete any investigation work within the time prescribed under clause (b), he shall inform the Tribunal in the form of a report recording the reason thereof, and with the permission of the Tribunal, complete the investigation work within the next 30 (thirty) days.
(a) complete the investigation within 90 (ninety) days from the date of receipt of responsibility for the investigation of any crime;
(b) if he fails to complete the investigation within the time prescribed under clause (a), he may, subject to the approval of his controlling officer, extend the period of investigation by an additional fifteen (15) days;
(c) If he fails to complete any investigation work within the time prescribed under clause (b), he shall inform the Tribunal in the form of a report recording the reason thereof, and with the permission of the Tribunal, complete the investigation work within the next 30 (thirty) days.
(2)If the investigating officer under sub-section (1) fails to complete any inquiry, the Tribunal may extend the period of inquiry, by a reasonable time.
§ 40Powers of Investigating Officer
(1)In connection with the investigation of any offense under this Act, the Investigating Officer shall have the following powers, namely:-
(a) take possession of any computer, computer program, computer system, computer network or any digital device, digital system, digital network or any program, data stored on any computer or compact disc or removable drive or by any other means;
(b) taking necessary steps to collect traffic data from any person or organization; And
(c) performing such other functions as may be necessary for carrying out the purposes of this Act.
(a) take possession of any computer, computer program, computer system, computer network or any digital device, digital system, digital network or any program, data stored on any computer or compact disc or removable drive or by any other means;
(b) taking necessary steps to collect traffic data from any person or organization; And
(c) performing such other functions as may be necessary for carrying out the purposes of this Act.
(2)While conducting an investigation under this Act, the Investigating Officer may take the assistance of any expert person or specialized organization for the purpose of investigation of any offence.
§ 41Search and seizure by warrant
If any police officer has reason to believe that—
(a) any offense under this Act has been committed or is likely to be committed; or
(b) any computer, computer system, computer network, data or evidence relating thereto is kept at any place or with any person in connection with an offense committed under this Act,
If so, he may, by recording reasons for such belief, obtain a search warrant by applying to the Tribunal or, as the case may be, the Chief Judicial Magistrate or the Chief Metropolitan Magistrate and perform the following functions,
(b) interception of any traffic data in the possession of any service provider;
(a) Interference with any wire or electronic communication, including customer information and traffic data, at any stage of communication.
§ 42Search, seizure and arrest without warrant
(1)If any police officer has reason to believe that any offense under this Act has been or is being committed or is likely to be committed at any place or that evidence has been lost, destroyed, erased, altered or otherwise made scarce, he may, recording such belief, perform the following functions,
(a) enter and search the said place and, if the entry is obstructed, take necessary action in accordance with the Code of Criminal Procedure;
(b) confiscation of any computer, computer system, computer network, data or other equipment used in the commission of the crime found during the search of the said place and any document helpful in proving the crime;
(c) searching the body of any person present at the said place;
(d) arrest any person present at the said place if it is suspected that he has committed or is committing any offense under this Act.
(a) enter and search the said place and, if the entry is obstructed, take necessary action in accordance with the Code of Criminal Procedure;
(b) confiscation of any computer, computer system, computer network, data or other equipment used in the commission of the crime found during the search of the said place and any document helpful in proving the crime;
(c) searching the body of any person present at the said place;
(d) arrest any person present at the said place if it is suspected that he has committed or is committing any offense under this Act.
(2)After conducting the search under sub-section (1), the police officer shall submit a report of the conduct of the search to the Tribunal.
§ 43Data storage
(1)If the Director General, in his discretion, or on the application of the investigating officer, believes that any information stored in a computer or computer system needs to be preserved for the purpose of investigation under this Act and there is a possibility of such information being lost, destroyed, altered or made scarce, the person or organization in charge of the said computer or computer system to preserve such information for a period of 90 (ninety) days. Can give instructions.
(2)The Tribunal may, on application, extend the retention period of the said data, provided that it shall not exceed a total of 180 (one hundred and eighty) days.
§ 44Do not disrupt the normal use of the computer
(1)The investigating officer shall conduct the investigation in such a manner as not to interfere with the lawful use of the computer, computer system, computer network or any part thereof.
(2)Any computer, computer system, computer network or any part thereof shall be seized, if—
(a) access to the relevant computer, computer system, computer network or any part thereof is not possible;
(b) If the relevant computer, computer system, computer network or any part thereof is not seized for the purpose of preventing crime or ongoing crime, the data is likely to be lost, destroyed, altered or made scarce.
(a) access to the relevant computer, computer system, computer network or any part thereof is not possible;
(b) If the relevant computer, computer system, computer network or any part thereof is not seized for the purpose of preventing crime or ongoing crime, the data is likely to be lost, destroyed, altered or made scarce.
§ 45Assist in investigation
While conducting an investigation under this Act, the investigating officer may request any person or entity or service provider to provide information or assist in the investigation and if any such request is made, the concerned person, entity or service provider shall be obliged to provide necessary assistance including providing information.
§ 46Confidentiality of information obtained in investigation
(1)Any person, entity or service provider providing or disclosing any information for the purpose of investigation shall not be prosecuted under civil or criminal law against such person, entity or service provider.
(2)All persons, entities or service providers concerned with the investigation under this Act shall maintain the confidentiality of information related to the investigation.
(3)If any person contravenes the provisions of sub-sections (1) and (2), such contravention shall be an offense and shall be punishable with imprisonment for a term not exceeding 2 (two) years or with fine not exceeding 1 (one) lakh rupees, or with both.
§ 47Criminal prosecution, etc
(1)Notwithstanding anything contained in the Code of Criminal Procedure, the Tribunal shall not take cognizance of any offense without the written report of a police officer.
(2)The Tribunal shall, subject to consistency with the provisions of this Act, follow the procedure laid down in Chapter 23 of the Code of Criminal Procedure for the trial of an offense under this Act by a Court of Session.
§ 48Criminal trials and appeals
(1)Notwithstanding anything contained in any other law for the time being in force, offenses committed under this Act shall be triable only by the Tribunal.
(2)If a person is aggrieved by the judgment passed by the Tribunal, he may file an appeal in the Appellate Tribunal.
§ 49Application of Criminal Procedure Code
(1)Unless otherwise provided in this Act, the provisions of the Code of Criminal Procedure shall apply to the investigation, trial, appeal and other matters of any offence.
(2)The Tribunal, the Appellate Tribunal and, as the case may be, the Police Officer in the performance of the duties assigned to them, subject to the provisions of this Act, in the following matters
Information and Communication Technology Act, 2006
(Act No. 39 of 2006) shall follow the provisions of Part-2 and Part-3 of Chapter VIII, namely:-
(a) the procedure of the Tribunal and Appellate Tribunal;
(b) time limit for delivery of judgment;
(c) not barring the imposition of any other penalty in respect of fine or confiscation;
(d) power of detention or arrest in public places, etc.;
(e) method of search; And
(f) Jurisdiction of Appellate Tribunal and procedure for hearing and disposing of appeals.
Information and Communication Technology Act, 2006
(Act No. 39 of 2006) shall follow the provisions of Part-2 and Part-3 of Chapter VIII, namely:-
(a) the procedure of the Tribunal and Appellate Tribunal;
(b) time limit for delivery of judgment;
(c) not barring the imposition of any other penalty in respect of fine or confiscation;
(d) power of detention or arrest in public places, etc.;
(e) method of search; And
(f) Jurisdiction of Appellate Tribunal and procedure for hearing and disposing of appeals.
(3)The Tribunal shall exercise all the powers of a Court of Session exercising original jurisdiction under the Code of Criminal Procedure.
§ 50Taking expert opinion, training, etc
50 (1) The Tribunal or the Appellate Tribunal, while conducting the proceedings, may take the opinion of any person experienced in computer science, digital forensics, electronic communication, data protection etc.
(2)The government or agency may provide specialized training in computer science, digital forensics, electronic communication, data protection and other necessary subjects to all persons concerned with the implementation of this Act.
The Cyber Security Act, 2023 is Bangladesh’s current legislation addressing cybercrime and digital security. It repeals and replaces the Digital Security Act, 2018, which had attracted significant domestic and international criticism over its impact on freedom of expression. The Act applies to any person who commits a cyber offence within Bangladesh or, through a computer system located in Bangladesh, causes harm outside the country. Its key mechanisms include the establishment of a Cyber Security Agency to investigate and prevent cybercrime, the criminalisation of unauthorised access to computer systems, data theft, identity fraud, and the dissemination of false or defamatory digital information. Penalties range from substantial fines to imprisonment of up to fourteen years for the most serious offences. Notable provisions include the power of the Cyber Security Agency to intercept, monitor, and decrypt digital communications with judicial authorisation, the requirement for critical information infrastructure operators to report cyber incidents, and the extradition provisions for cyber criminals. Critics have noted that certain provisions — particularly those relating to the dissemination of ‘false’ information — could still be used to restrict legitimate speech. The Act was repealed on 21 May 2025 by the Cyber Security Ordinance, 2025. It represented Bangladesh’s legislative framework for cyber governance during its brief period in force.