On the surface, Bangladesh's interim government has delivered on a long-standing demand from journalists, technologists, and the country's vibrant civil society. The Cyber Protection Ordinance 2025, promulgated this month by the administration of Nobel laureate Muhammad Yunus, repeals the Cyber Security Act (CSA) 2023, which itself was a hastily renamed successor to the notorious Digital Security Act (DSA) 2018. For a country whose previous government weaponised cyber law against critics with grim regularity, the symbolism is significant.
But symbolism is not the same as reform. Within hours of the ordinance's release, digital rights organisations including Article 19 and Dhaka's Centre for Governance Studies warned that several of the most speech-restrictive provisions of the old laws have been carried over largely unchanged. For online platforms — domestic startups and global services alike — and for the roughly 75 million Bangladeshis active on social media, the legal exposure that defined the DSA era has not been dismantled. It has been re-papered.
A familiar text under a new name
To understand why this matters, it helps to remember what the DSA 2018 did. Under Section 25, publishing information deemed "aggressive or frightening" was criminalised. Section 28 punished content that hurt "religious values or sentiment." Section 29 imported colonial-era defamation into the digital realm with the threat of prison. By 2023, the United Nations Human Rights Office and outlets including Reuters had documented thousands of cases filed under the DSA, many against journalists, students, and ordinary users sharing Facebook posts. Writer Mushtaq Ahmed died in pretrial detention in 2021 after being charged under the law — a case that became a rallying cry for repeal.
The CSA 2023, passed in the final year of the Awami League government, was marketed as a fix. Defamation became bailable; some penalties were reduced. But the substantive offences and the broad investigative powers survived. Rights groups, including Article 19, called it the DSA "in a new bottle."
The 2025 ordinance was meant to break that pattern. According to reporting by The Daily Star and Prothom Alo, the draft was developed with civil society consultation — a sharp departure from the closed-door drafting of its predecessors. Several provisions have been removed, including some criminal defamation language, and procedural safeguards around arrest have been tightened. These are real, welcome improvements.
The problem is what remains. Provisions criminalising content that allegedly threatens "communal harmony," "the spirit of the liberation war," or undefined "state security" persist in the new text, according to early analyses by Article 19 and the Centre for Governance Studies. Intermediary obligations — including takedown demands and data-sharing requirements directed at platforms — also continue, with limited judicial oversight.
Why platforms should be paying attention
For global services such as Meta, Google, TikTok, and X — and for Bangladesh's growing roster of homegrown platforms like Pathao, bKash, and Daraz — the ordinance's intermediary clauses are the section to read carefully. Bangladesh is one of South Asia's largest internet markets, with the Bangladesh Telecommunication Regulatory Commission reporting more than 130 million active internet subscriptions. Facebook alone is used by an estimated 60% of online Bangladeshis.
When intermediary liability is loosely defined, platforms face an unenviable choice. Over-comply, and lawful political speech, religious commentary, and journalism get scrubbed from public view. Under-comply, and local executives risk criminal exposure. The Indian experience under the 2021 IT Rules, the Vietnamese Cybersecurity Law, and Pakistan's PECA amendments all show how vaguely worded "harmful content" categories convert private companies into proxy censors. The Cyber Protection Ordinance, in its current form, risks reproducing that dynamic.
A proportionate path forward
None of this means Bangladesh should not have a cyber law. Fraud, child sexual abuse material, non-consensual imagery, hacking, and serious online harassment are genuine problems that require credible enforcement. A modern cyber statute is in the public interest — including the interest of the country's tech sector, which depends on user trust and predictable legal rules.
The question is whether the offences are drawn narrowly enough to survive scrutiny under Article 39 of Bangladesh's Constitution, which guarantees freedom of expression subject only to "reasonable restrictions." International standards — including the Johannesburg Principles and the UN Human Rights Committee's General Comment 34 on Article 19 of the ICCPR, which Bangladesh has ratified — require that speech-restrictive laws be precise, necessary, and proportionate.
There is a workable agenda for the Yunus government and the parliament that will eventually replace the ordinance with primary legislation:
- Strip the residual catch-all offences. "Communal disharmony" and "liberation war sentiment" clauses invite political abuse; they should be replaced with conduct-based offences targeting incitement to imminent violence, consistent with the Rabat Plan of Action.
- Build in judicial review for intermediary orders. Takedown and data-access demands should require a court order, with notice to the affected user where feasible.
- Codify a meaningful safe harbour. Platforms should not face criminal exposure for third-party content where they act on lawful, specific notices.
- Sunset and review. Given the ordinance route, parliament should commit to a sunset clause and an independent impact review before it is converted into law.
Bangladesh's tech ecosystem — from Dhaka's fintech corridor to Chittagong's freelancing economy — has been built in spite of, not because of, the country's cyber law. The Cyber Protection Ordinance is a genuine improvement in tone and process. Now it needs an improvement in substance. Otherwise, Bangladesh risks repeating the mistake of 2023: changing the name on the cover and leaving the chilling effect inside.