A Statute Without a Floor: Data Protection and the Case for Constitutional Privacy in Bangladesh

I. Introduction

Bangladesh has built a ceiling without a floor. The Personal Data Protection Act 2026 confers on individuals a modern suite of rights over their personal data and imposes binding duties on public and private entities.^[1]

The Constitution beneath that statute guarantees privacy only in the narrow, State-facing terms of Article 43: the secrecy of correspondence and the security of the home. The courts have not developed an autonomous privacy right recognised elsewhere in the region, most notably by the Indian Supreme Court in KS Puttaswamy v Union of India.^[2] The result is a curious inversion: a detailed statutory regime of data rights resting atop a constitution that barely speaks of privacy at all.

That inversion is dangerous. A right that exists only by statute can be qualified by statute. The Act’s open-ended exemptions let the State escape its own rules. This article argues that Bangladeshi courts should read Article 43 together with Article 32, as Bangladesh’s own courts have already read Article 32 expansively to recognise an autonomous, dignity-based right to life. Without that judicially supplied floor, the Act’s carefully drafted protections remain structurally fragile.

II. Article 43 as It Stands

Article 43 sits within Part III of the Constitution. It guarantees security against entry, search, and seizure, and the privacy of correspondence. Both guarantees are expressly subject to reasonable restrictions imposed by law.^[3]

Two features limit this provision. First, Article 43 is vertical. It restrains the State, not private parties. Second, its subject matter is narrow. The text speaks of physical intrusion into the home and the secrecy of communication. It does not reach informational self-determination. This is the individual’s interest in controlling how data about them is collected and used long after any single communication has ended.^[4]

Judicial interpretation has not filled the gap. At the constitutional level, privacy remains weakly entrenched and dependent almost entirely on legislation.^[5]

III. The 2026 Act and Its Constitutional Anchor

The 2026 Act marks a genuine advance. It confers on data subjects rights of access, correction, erasure, and portability. Crucially, these obligations apply horizontally, binding private actors as well as the State.^[6]

The difficulty is that the Act presents itself as an elaboration of the constitutional right to privacy. Yet, as Section II showed, that constitutional right is too narrow to carry the weight. The statute borrows constitutional legitimacy from a provision that cannot supply an autonomous right to informational privacy. The foundation is rhetorical rather than doctrinal.

IV. The Floor Problem

The core weakness lies in the Act’s exemption regime. Under section 24, the data subject’s consent is deemed waived wherever processing is “necessary” for national security, defence, public order, and an undefined “public interest.”^[7]

Internal checks exist but do not cure the deeper defect.^[8] First, the grounds are indeterminate. “Public order” and “public interest” are left undefined, allowing the invoking body to set its own limits. Second, supervision is administrative, not judicial. The supervisory Authority polices the exemption, but the same statute binds that Authority to comply with government directions on the exact same grounds on which the widest exemptions rest.^[9] Third, the regime is opaque. No general duty of transparency or notification attaches when the exemption is used. The State both writes the exemption and superintends it.

This is the floor problem. A right that exists only by statute is defeasible by statute. Where the Act exempts the executive on open-ended grounds, protection can be displaced without any amendment at all. A scheme in which the principal regulated party writes its own escape clause offends the elementary principle that no one should be judge in their own cause. A constitutional right fixes a floor beneath which ordinary legislation and executive practice may not descend. Bangladesh has built the ceiling but not the floor.

International human rights law requires that privacy interference satisfy legality, necessity, and proportionality.^[10] An exemption built around an undefined “public interest” strains each limb. It lacks foreseeability and necessity. Because Bangladesh recognises no autonomous constitutional right to informational privacy, these international standards lack a domestic anchor.^[11]

Statutory safeguards cannot substitute for constitutional limits. A safeguard written into the instrument it is meant to constrain is a self-referential promise. A floor must sit beneath the instrument and outside the reach of the actor it restrains. Only a constitutional right enforceable against the State by an independent judiciary performs that function.

V. A Right Already Within Reach

The route to a constitutional floor is interpretive. In Puttaswamy, the Indian Supreme Court held that privacy is an inseparable part of the right to life and personal liberty.^[12] India reached a full right of informational privacy by interpretation.

Bangladesh need not import that reasoning wholesale. Its own courts have long read the right to life in the same expansive spirit. In Dr Mohiuddin Farooque v Bangladesh, the Supreme Court held that the “life” protected by Article 32 is not bare survival but “a life worth living”. It read Articles 31 and 32 together to embrace health, a safe environment, and human dignity.^[13]

The move this article proposes relies on exactly that mechanism: read Article 32’s guarantee of life and personal liberty, together with Article 43 and the Constitution’s commitment to human dignity, as reaching a person’s control over information about themselves.^[14]

The proposal must clear a doctrinal hurdle. The dignity principle invoked here sits in Article 11, within the Fundamental Principles of State Policy in Part II of the Constitution, which Article 8 declares judicially unenforceable on their own. Mohiuddin Farooque provides the solution. The Court faced the same difficulty regarding a non-justiciable Part II environmental principle. The Court overcame it by reading that value into the Part III right to life. The dignity principle, channelled through Article 32 in the exact same manner, informs an enforceable right to informational privacy.

Recognition arms the courts with a standard for testing the statutory exemptions. A structured proportionality enquiry compels each exemption to justify itself. A narrowly defined national-security exception might survive. The open-ended “public interest” ground would fail the necessity stage. The right thus disciplines, rather than abolishes, the exemptions.

VI. Conclusion

The 2026 Act establishes a modern, rights-based regime. However, a statute is only as secure as its foundation. Read alone, Article 43 leaves the Act’s protections resting on legislative goodwill. What Parliament grants, it may qualify. What the Act exempts, the executive may exploit.

Read together with Article 32 and the constitutional commitment to human dignity, the Constitution supplies the missing floor. It creates a limit no ordinary law and no exemption could cross, and against which the State’s own carve-outs must justify themselves. Until that floor is laid, the citizen’s data rights remain rights named on paper, and unenforceable where they matter most.

⚡ 2nd Cohort: Registration Live

2026 Legal Research Professional Certificate

Lifetime Membership Verified Certification Legal Research Training Publication Opportunities Official References for Jobs

Secure Your Place Today →