Bangladesh - Cyber Security Act (2023)

Overview

The Cyber Security Act, 2023 (Act No. 46 of 2023) was enacted by the Jatiya Sangsad on 13 September 2023 as part of a legislative overhaul of Bangladesh’s digital security framework. It replaces many operative provisions of the Digital Security Act, 2018 and consolidates cybercrime, critical information infrastructure protection and agency governance under a single statutory instrument. The Act establishes a national competent authority for cyber security (often referenced as the Cyber Security Agency) with investigatory, supervisory and directive powers and sets out offences, penalties and compliance duties for public and private entities. The full official text and consolidated copy are available on government legal repositories such as the national legislation portal and the laws database; see the official law text and legislative citation at legislative division PDF of the Cyber Security Act, 2023 and the laws portal entry at Laws of Bangladesh – Cyber Security Act (Act No. 46 of 2023).

Definitions

The Act defines core terms used throughout the text, including "critical information infrastructure" (CII), "cyber security incident", "service provider", "computer system" and "unauthorised access." Definitions are broad and purpose-driven: CII is described by reference to sectors and services essential to national functions (energy, communications, finance, health, utilities), and an incident is defined to include theft, modification, deletion, denial-of-service, and other unauthorized acts affecting confidentiality, integrity and availability. The Act also adopts an expansive definition of digital devices and networks to capture cloud, IoT, and infrastructure providers.

Governance and Institutional Framework

The CSA creates or reconstitutes a central supervisory body—referred to in the Act as the Cyber Security Agency—and empowers it to identify CII, issue mandatory directions, coordinate incident response, conduct audits, and prescribe standards. The Agency’s remit includes issuing guidance to public sector departments and private operators, maintaining a national incident response capability, and liaising with law enforcement and intelligence agencies. The law sets out appointment and oversight mechanisms for agency leadership, and contemplates inter-ministerial coordination with the Ministry of Posts, Telecommunications and Information Technology and the Ministry of Law, Justice and Parliamentary Affairs. Implementation duties include capacity-building, national exercises, and maintenance of a CIRT (computer incident response team) function; see the Agency’s public pages for operational updates: National Cyber Security Agency (NCSA).

Key Focus Areas

The Act concentrates on five key policy areas: (1) Protection of Critical Information Infrastructure (CII) – designation processes, mandatory resilience measures, and recovery planning; (2) Cybercrime – criminalizing unauthorized access, sabotage, data breaches, malware distribution, hacking, identity-related offences and cyberterrorism; (3) Incident reporting and mandatory cooperation – timelines for reporting breaches to the Agency and CIRT and duties to preserve forensic evidence; (4) Regulation of service providers and conformity assessment – powers to require registration, certification and technical audits for specific classes of providers and digital products; and (5) Safeguards and rights – procedural protections for suspects and limits on agency powers, together with limited provisions addressing data protection and judicial oversight. The law also touches on content offences where digital acts intersect with national security and public order, drawing criticism from rights groups for perceived breadth.

Implementation Framework

Operationalizing the CSA requires secondary legislation, agency rules, standards and technical guidelines. The Act authorizes the Agency to issue rules on incident reporting forms and timelines, classification criteria for CII, minimum security controls (patching, logging, encryption, access control), and standards for forensic evidence preservation. The law envisages a mixture of administrative orders, binding directions and sector-specific codes developed with relevant ministries, regulators (like the Bangladesh Telecommunication Regulatory Commission and Bangladesh Bank for the financial sector) and private stakeholders. Implementation priorities typically include (a) CII mapping, (b) baseline technical security standards, (c) incident reporting channels and SLAs, and (d) compliance timelines for different classes of entities.

Monitoring and Evaluation

The Act mandates periodic reviews, reporting and audits. The Agency must maintain an incident registry, publish summary reports on national cyber threats and compliance activities, and conduct audits of designated CII operators. There are requirements for internal oversight and external review mechanisms to ensure the Agency’s actions align with legal limits; the law also contemplates cooperation with international partners and information-sharing arrangements to enhance threat intelligence and to benchmark national metrics against global best practice.

Penalties, Liability, and Appeals

The CSA sets a range of administrative, civil and criminal penalties: fines, orders to remediate, suspension of services, and imprisonment for certain offences. A subset of offences deemed most serious (for example cyber terrorism, large-scale sabotage of CII, and severe hacking of national systems) are treated as non-bailable in line with the Act’s public-order rationale. The law provides rights of appeal against administrative orders and specifies procedural routes for judicial review of agency actions. It also contains provisions for compensation and liability where negligence leads to demonstrable harm, and mechanisms for withdrawing or amending agency directions on appeal.

Relationship to Other Instruments

The CSA expressly amends and replaces parts of the Digital Security Act, 2018 and incorporates relevant sections of the Information and Communication Technology Act, 2006 as consolidated in national law. It provides cross-references to sectoral regulators (telecom, banking, energy) and contemplates MoUs and memoranda of cooperation to align enforcement. Where other laws (data protection, telecommunications, criminal procedure) apply, the CSA sets out primacy in matters of national cyber security while preserving fundamental procedural safeguards embodied in the constitution and criminal procedure laws.

International Alignment

The Act acknowledges the need for international cooperation: it empowers the Agency to enter into mutual assistance arrangements, exchange cyber-threat intelligence, and participate in cross-border investigations. The law references international best practice principles (cooperation, proportionality, and respect for privacy) and invites alignment with global frameworks on incident response and critical infrastructure protection. Stakeholders have urged harmonization with international human rights standards and data-protection norms.

Implementation Timeline

Sources and References