Bangladesh's Cyber Security Act, 2026 has not had time to settle. Enacted in April 2026 to replace the Cyber Security Ordinance, 2025 — itself a successor to the widely criticized Digital Security Act, 2018 — the law was amended once in June and is now headed for a third round of changes. A six-member cabinet committee, convened by Posts, Telecommunications and Information Technology Minister Faqir Mahbub Anam under a Cabinet Division notification issued July 2, 2026, met on July 15 to review a new draft amendment, according to Bangladesh's ICT Division and the state news agency BSS. No date has been set for finalizing it; the committee simply agreed to meet again after incorporating recommendations.
What the government says it's fixing
The stated trigger is real and worth taking seriously. Ministers have pointed to a genuine enforcement gap: Bangladesh's existing framework, unlike some regional peers, has no binding deadline compelling platforms to act on harmful content once notified. AI-generated deepfakes, non-consensual intimate imagery, and coordinated disinformation campaigns move faster than voluntary platform moderation, and victims — disproportionately women and minors — bear the cost of delay. The June 2026 amendment responded to this by empowering the Bangladesh Telecommunication Regulatory Commission (BTRC) and other authorized agencies to order content blocked and to request user data directly from platforms, and by requiring international platforms, including Meta, to act on disputed content within a set window. A draft under review for the third amendment would go further, according to Prothom Alo's July 30, 2026 reporting on the text: creating specific offenses for "rumour" and "disinformation," each punishable by up to 10 years' imprisonment and fines up to 4 million taka, with defamatory content targeting women or minors carrying the same maximum. Reasonable people can support faster, clearer takedown obligations for genuinely dangerous synthetic and abusive content. That is not the same as writing the state a blank check.
Why the pace itself is the problem
The difficulty is not any single provision — it's the cadence. Three legislative acts on the same subject in four months is not iterative refinement; it is a law being built in public without the deliberation that content-restriction powers demand. Transparency International Bangladesh's July 2026 analysis put it bluntly: the pattern amounts to old laws being "reintroduced under new names," retaining sweeping device-access powers and drafted, in TIB's assessment, without adequate stakeholder consultation. That criticism lands harder given the baseline TIB cites — more than 4,500 people faced repression under the DSA-era legal regime between 2018 and 2024, a track record the current government came to power promising to end.
A parallel civil-society intervention reinforces the point. On July 28, 2026, eight rights organizations — including Access Now, Amnesty International, ARTICLE 19, and Human Rights Watch — published a joint statement noting that roughly $190 million in public spending built out Bangladesh's surveillance and interception infrastructure between 2015 and 2025, largely without independent oversight. The statement doesn't address the Cyber Security Act by name, but its core demand — a narrowly tailored legal framework grounded in necessity, proportionality, and prior judicial authorization before state agencies can compel data — is exactly the discipline missing from a bill now being redrafted for the third time in a cabinet conference room rather than through open legislative hearings.
The definitional problem doesn't go away with speed
"Rumour" and "disinformation," as reportedly defined in the pending draft, turn on whether information is "unsubstantiated," "unverified," or published with "the aim of deceiving." These are intent- and verification-based standards that courts everywhere struggle to apply consistently — and Bangladesh's own recent history shows what happens when broad, subjective categories meet a low bar for triggering a criminal complaint: cases proliferate, chill reporting, and rarely produce convictions when they do reach trial. A 10-year maximum sentence for a rumor offense is not calibrated to the actual harm most flagged content causes; it is calibrated to deter people from publishing at all.
A narrower path exists
Bangladesh doesn't need to choose between an unaccountable takedown regime and no protection against deepfakes and doxxing. A binding, short response-time obligation for platforms on clearly defined categories — non-consensual intimate imagery, direct incitement to violence, verified child-safety material — can be codified precisely, paired with judicial rather than purely executive authority to compel user data, and reviewed by an independent body rather than a cabinet committee alone. The government's own cited justification — that neighboring jurisdictions already impose enforceable takedown deadlines — argues for narrow, well-defined obligations, not for open-ended "disinformation" offenses layered onto a law still being rewritten every few weeks. Codifying speed without codifying precision just means the next amendment, whenever it lands, will be repairing damage the third one already did.