Eight international and Bangladeshi human rights organizations — Access Now, Amnesty International, ARTICLE 19, CIVICUS, Fortify Rights, Human Rights Watch, the Robert & Ethel Kennedy Human Rights Center, and Tech Global Institute — addressed a joint statement directly to Prime Minister Tarique Rahman on July 28, 2026. Their message: the surveillance architecture built under his predecessors has survived Bangladesh's political transition largely intact, and in one important respect, it has just gotten worse.
A Reform Moment, Partially Reversed
Rahman's Bangladesh Nationalist Party (BNP) swept February 2026's elections — the first since the 2024 student-led uprising that ousted Sheikh Hasina — and Rahman was sworn in as prime minister on February 17, 2026, ending 18 months of interim rule under Muhammad Yunus. That interim government had passed a Telecommunication Regulation (Amendment) Ordinance that, among other things, banned nationwide internet shutdowns and moved to restore the independence of the Bangladesh Telecommunication Regulatory Commission (BTRC) after a 2010 amendment had subordinated it to the ministry.
The new Telecommunication Regulation (Amendment) Act 2026 replaces that ordinance — and, per the joint statement, keeps its core surveillance and interception power (retained as section 97A) while stripping out much of what surrounded it. As the groups put it, the new act "removed or significantly diluted much of the rights-oriented language, accountability and oversight architecture" the interim ordinance had introduced. In other words: the power to intercept communications survived the transition; the guardrails around it did not.
Two Data Laws, One Large Exemption
The same pattern shows up in Bangladesh's parallel data-governance track. Parliament formally passed the permanent Personal Data Protection Act, 2026 in April, replacing an interim ordinance dating to late 2025. The rights groups' central objection is not the law's existence — it is the scope of its carve-outs: "extensive exemptions to data privacy to state authorities on overbroad grounds including national security, defence, public order, public interest, and criminal investigations," which, combined with the National Data Management Act's push toward "interoperability and centralised database integration frameworks," they say could enable state agencies to collect, aggregate, and retain personal data across government systems with little external check.
A Monitoring Centre Without a Statute
The sharpest example is institutional rather than textual. The National Telecommunication Monitoring Centre (NTMC), Bangladesh's telecommunications-intelligence body under the Ministry of Home Affairs since 2013, has — according to the joint statement — no "clear public-facing statutory mandate," no independent oversight mechanism, and no transparency framework governing what it does. In May 2026, the government approved roughly BDT 94.95 crore (about $8 million) for the NTMC to expand its monitoring and content-filtering capacity. The rights groups place that single procurement alongside broader reporting that put cumulative Bangladeshi surveillance spending at roughly $190 million between 2015 and 2025 — spending on an agency whose founding document the public still cannot point to.
The Case the Government Would Make
Bangladesh's position is not unreasonable on its face. Every state retains some interception and data-sharing capacity for counterterrorism, organized crime, and cybercrime enforcement — the EU's own GDPR carries a national-security carve-out, and India's 2023 data law includes broad government exemptions too. A country managing a fragile post-uprising transition, with active extremist and cross-border security concerns, has a genuine argument for keeping lawful-intercept capability funded and functional rather than dismantling it overnight.
Why the Gap Still Matters
But a national-security exemption that is undefined, unaudited, and unreviewable by a court is a different thing from a bounded one — and that difference is exactly what the interim government's 2025 reforms were built to fix. Rolling them back while keeping the underlying intercept power does not make Bangladesh safer; it just makes the exercise of that power less predictable, which is its own cost. Foreign cloud, OTT, and platform operators — the sector the BTRC's own late-2025 jurisdiction expansion was aimed at courting — price legal uncertainty into every market-entry decision. A regime where surveillance procurement (like the NTMC's Tk 95-crore expansion) proceeds without a public mandate or judicial sign-off is a harder jurisdiction to operate in, not a more secure one.
The rights groups' six recommendations — an independent legislative commission to review all surveillance law, a dedicated surveillance statute grounded in legality, necessity, and proportionality, civilian-authority review of surveillance-technology procurement, judicial pre-authorization outside narrow emergencies, an empowered parliamentary oversight committee, and narrower, defined PDPA exemptions — are not radical asks. They mirror safeguards most liberal democracies already operate under. Rahman's government inherited a rare, internationally credible reform on this exact issue; letting it lapse quietly, rather than replacing it with something equally bounded, is the choice that will actually cost Bangladesh reputational and investment capital over time.