§ 1Short title, application and introduction
Sections85
LanguageEnglish
The Information and Communication Technology Act, 2006 is a comprehensive legislation governing digital transactions, electronic records, cybercrimes, and information technology in Bangladesh. It applies to all electronic records and digital signatures used for legal purposes within Bangladesh and to offences committed using digital technology that affect Bangladesh or its citizens. The Act provides legal recognition for electronic records and digital signatures (Sections 3-8), establishes the Controller of Certifying Authorities to regulate digital signature certification (Sections 18-25), and creates a framework for electronic governance including electronic filing, online service delivery, and digital payments. Key mechanisms include the penalisation of cybercrimes including unauthorised access to computer systems, data theft, hacking, identity theft, cyber terrorism, publishing obscene material online, and phishing (Sections 54-66). Penalties include imprisonment up to 10 years and significant fines. Notable provisions include the establishment of a Cyber Appellate Tribunal to hear appeals against orders of the Controller (Section 67), the power of law enforcement to intercept electronic communications with court authorisation, provisions for the admissibility of electronic evidence (Section 69), and the requirement for intermediaries to maintain records and assist law enforcement. The Act has been amended several times, including the controversial Section 57 which originally criminalised defamation online, and Section 8 of the Digital Security Act, 2018 which later occupied much of the same space. The Act remains in force alongside the Digital Security Act, 2018 and provides the foundational legal framework for Bangladesh's digital economy.
Full text · showing key sections
§ 2Definition
Unless there is anything contrary to the subject matter or context, in this Act-
(1)"Electronic Signature" means any electronic sound, symbol or process attached to or logically associated with a data message and executed or adopted by a person with the intent to sign, and includes a digital signature;
(2)"Electronic Record" means data, record or data generated, image or sound stored, received or sent in an electronic form and microfilm or microfiche or any other form in which information is stored by non-electronic means;
(3)"Appellate Tribunal" means the Appellate Tribunal constituted under the Information and Communication Technology Act, 2006 (Act No. 26 of 2006);
(4)"Commission" means the National Cyber Security Commission;
(5)"Chairperson" means the Chairperson of the Commission;
(6)"Director" means a Director of the Commission;
(7)"National Cyber Security Agency" means the National Cyber Security Agency constituted under the National Cyber Security Agency Act, 2018 (Act No. 46 of 2018);
(8)"Digital Security Agency" means the Digital Security Agency constituted under the Digital Security Act, 2018 (Act No. 46 of 2018);
(9)"Guidelines" means guidelines issued by the Commission;
(10)"Offense" means an offense under this Act;
(11)"Regulations" means regulations made under this Act;
(12)"Rules" means rules made under this Act;
(13)"Security Agreement" means the Security Agreement made under the Information and Communication Technology Act, 2006 (Act No. 26 of 2006);
(14)"Service Provider" means any person providing any service;
(15)"Subscriber" means any person who is a party to a contract with a service provider for the provision of services;
(16)"Telecommunication" means any transmission, emission or reception of any writings, signs, signals, data, sounds or intelligence of any nature by wire, radio, optical or other electromagnetic systems;
(17)"Website" means any interconnected system of web pages or files accessed through the Internet;
(18)"Sign" means any mark, character, symbol or any combination thereof executed or adopted by a person with the intention to authenticate a data message;
(19)"Data Message" means any information generated, sent, received or stored by electronic means which can be reviewed or accessed;
(20)"Critical Information Infrastructure" means any computer system, network or information infrastructure declared as such by the Government;
(21)"Cyber Security" means the measures necessary to protect computer systems, networks, data and information infrastructure from unauthorized access, damage or misuse;
(22)"Cyber Attack" means any action or attempt to gain unauthorized access to a computer system, network or information infrastructure with the intent to cause damage or disruption;
(23)"Cyber Terrorism" means any act of terrorism committed by means of a computer system, network or information infrastructure;
(24)"Cyber Espionage" means any act of obtaining, attempting to obtain or procuring information by deception or other unlawful means for the benefit of any foreign government, military organization, state-sponsored organization or their agents;
(25)"Cyber Fraud" means any deception or fraudulent act committed by means of a computer system, network or information infrastructure;
(26)"Cyber Stalking" means any act of repeatedly following or contacting a person using a computer system, network or information infrastructure in a manner that causes fear or distress;
(27)"Cyber Bullying" means any act of intimidating, threatening, humiliating or causing emotional distress to a person by means of a computer system, network or information infrastructure;
(28)"Cyber Harassment" means any act of causing annoyance, insult, mental agony or emotional distress to any person by means of a computer system, network or information infrastructure;
(29)"Digital Signature" means a cryptographic transformation of data using a pair of asymmetric keys, one private and one public, whereby the sender signs the data using the private key and the recipient verifies the signature using the sender's public key;
(30)"Electronic Commerce" means the sale or purchase of goods or services over an electronic network;
(31)"Electronic Governance" means the application of information and communication technology for delivery of government services;
(32)"Information Infrastructure" means any computer system, network, data or information system, including the Internet;
(33)"International Cooperation" means any cooperation between the Commission and any foreign government, international organization or any other entity for the purpose of cyber security;
(34)"Malware" means any software or code designed to disrupt, damage or gain unauthorized access to a computer system, network or information infrastructure;
(35)"Personal Data" means any data relating to a natural person who is identified or identifiable;
(36)"Privacy" means the right of a person to keep his or her personal data and information confidential and secure;
(37)"Sensitive Data" means any data which, if disclosed, could cause harm to the person to whom the data relates;
(38)"Social Engineering" means the psychological manipulation of people into performing actions or divulging confidential information;
(39)"Spam" means any unsolicited electronic communication;
(40)"Vulnerability" means any weakness in a computer system, network or information infrastructure that could be exploited by an attacker.
§ 3Rule of law
3 Notwithstanding anything contained in any other law for the time being in force, the provisions of this Act shall have effect
§ 4Transnational application of law
4 (1) If any person commits an offense under this Act outside Bangladesh which if committed in Bangladesh would be punishable under this Act, this Act shall apply as if the offense had been committed by him in Bangladesh.
(2)If any person commits an offense under this Act within Bangladesh with the help of a computer, computer system or computer network located in Bangladesh from outside Bangladesh, the provisions of this Act shall apply against such person as if the entire process of said offense had been committed in Bangladesh.
(3)If any person commits any offense under this Act from within Bangladesh outside Bangladesh, the provisions of this Act shall apply against such person as if the entire process of said offense had been committed in Bangladesh.
§ 5Authentication of electronic records by electronic signature
5 (1) Subject to the provisions of sub-section (2), a subscriber may authenticate any electronic record by attaching his electronic signature.
(2)Authentication of electronic records shall be effected through application of technology neutral methods or recognized signature generating devices or techniques.
§ 6Legal recognition of electronic records
6 For the time being, if any other law in force requires any information or any other matter to be recorded in handwritten, stamped or otherwise written or printed form, the said information or matter shall be recorded in electronic format notwithstanding the similar provision in the said law:
Provided, however, that the said information or matter shall be accessible, so that it may be used later as a reference.
§ 7Legal recognition of electronic signatures
7 If any other law for the time being in force contains any provision or condition to the effect that,-
(a) any information or any other matter shall be authenticated by affixing the signature; or
(b) any document shall be signed and attested by any person;
If so, the said information or matter or, as the case may be, the said document shall be authenticated by affixing an electronic signature in the prescribed manner, notwithstanding the provisions to the contrary in the said Act.
§ 8Use of electronic records and electronic signatures in government offices, etc
8 (1) If any other law for the time being in force contains any provision or condition to the effect that,-
(a) any form, application or other document to be filed in any particular manner with any Government office, statutory body, or any authority or body owned or controlled by the Government;
(b) any licence, permit, approval, approval or order, by whatever name called, to be issued or granted in any particular manner;
(c) the money transaction shall be carried out in a particular manner;
Provided that, notwithstanding any provision to the contrary in the said Act, such document, issue, grant or, as the case may be, transaction of money shall be effected in the prescribed electronic manner.
(2)For the purposes of this section, the mode and manner of filing, preparing or issuing electronic records, including the manner and manner of payment of fees or charges for filing, preparing or issuing the same shall be prescribed by rules.
§ 9Electronic record keeping
9 (1) For the time being, if there is any provision or condition for the preservation of any document, record or information for a certain period in any other law in force, the said document, record or information, subject to the fulfillment of the following conditions, shall also be stored electronically, namely:-
(a) access to such stored information as necessary so that it can be used later as a reference;
(b) preserve the electronic record in the manner and manner in which it was first created, transmitted or received or in a manner and manner which accurately reflects the manner in which the information was created, transmitted or received;
(c) the date and time of transmission or receipt, if any, of information identifying the source and destination of electronic records;
Provided thatnothing in this sub-section shall apply to any information generated automatically for the sole purpose of transmitting or receiving electronic records.
(2)Subject to compliance with the conditions mentioned in sub-section (1), any person may take the help of any other person to carry out the work under the said sub-section.
(3)If any other law for the time being in force expressly provides for the preservation of any document, record or information in the prescribed manner, nothing in this section shall apply to the said provision.
§ 10Electronic Gazette
10 If any other law for the time being in force contains any provision or condition to the effect that any rule, regulation, order, by-law, notification or any other matter made under any law or any other legal document shall be published in the official gazette, then the said law, rule, regulation, order, by-law, notification or any other matter shall be published in the official gazette and optionally in the electronic gazette as well. will go:
Provided, however, that if any law, rule, regulation, order, bye-law, notification or any other matter is published in the official gazette or electronic gazette, in whatever form it is published, the date of its first publication shall be deemed to be the date of publication of the said gazette.
§ 11Absence of obligation to accept documents in electronic mode
11 Nothing in this Act shall compel any Ministry, Department of the Government or any statutory body or authority created under any law or any authority or body controlled or established by the Government to accept, issue, prepare, store or conduct any financial transaction in electronic form.
§ 12Formulation of rules regarding electronic signatures
12 For carrying out the purposes of this Act, the Government may, by notification in the Official Gazette and optionally in the Electronic Gazette, make rules on all or any of the following matters, namely-
(a) Type of electronic signature;
(b) manner and method of affixing electronic signatures;
(c) methods and procedures for identifying the person affixing the electronic signature;
(d) its control procedures and procedures for the purpose of ensuring adequate security and confidentiality of electronic record keeping and financial transactions;
(e) other matters necessary for the purpose of giving legal effect to the electronic signature
§ 13Acknowledgment
(1)If a sender himself transmits any electronic record, the said record shall be attributed to the sender.
(2)Where a sender transmits an electronic record to the recipient's information system and the electronic record is received by the recipient, the electronic record shall be deemed to have been received by the recipient.
(3)Where a recipient's information system receives an electronic record which is not addressed to the recipient or is addressed to someone other than the recipient, the electronic record shall be deemed to have been received by the recipient only when the recipient becomes aware of the electronic record.
(4)Where an electronic record is received by the recipient's information system, the recipient shall have an opportunity to access the electronic record.
(5)Where an electronic record is received by the recipient's information system, the recipient shall be deemed to have received the electronic record at the time when it enters the recipient's information system.
(6)Where an electronic record is transmitted to the recipient's information system by the sender and the electronic record is not received by the recipient, the electronic record shall be deemed to have been received by the recipient at the time when it enters the recipient's information system.
(7)Where an electronic record is transmitted to the recipient's information system by the sender and the electronic record is not received by the recipient, the electronic record shall be deemed to have been received by the recipient at the time when the recipient becomes aware of the electronic record.
(8)Where an electronic record is transmitted to the recipient's information system by the sender and the electronic record is not received by the recipient, the electronic record shall be deemed to have been received by the recipient at the time when the recipient has an opportunity to access the electronic record.
(9)Where an electronic record is transmitted to the recipient's information system by the sender and the electronic record is not received by the recipient, the electronic record shall be deemed to have been received by the recipient at the time when the recipient becomes aware that the electronic record has been stored in the recipient's information system.
(10)Where an electronic record is transmitted to the recipient's information system by the sender and the electronic record is not received by the recipient, the electronic record shall be deemed to have been received by the recipient at the time when the recipient has an opportunity to access the electronic record that has been stored in the recipient's information system.
§ 14Acknowledgment of receipt
14 (1) In cases where, at the time of transmission of any electronic record or before its transmission or through the said electronic record, the sender has notified the recipient of the request or a consensus has been established with the recipient that the recipient has to acknowledge the receipt of the electronic record, in that case the provisions of sub-sections (2), (3) and (4) shall apply.
(2)Unless the sender and receiver have previously agreed that receipt shall be acknowledged in a particular manner or method, receipt shall be acknowledged in the following manner-
(a) by automatic or otherwise communication by the recipient; or
(b) any action by the recipient that makes it appear to the sender that the electronic record has been received by the recipient.
(a) by automatic or otherwise communication by the recipient; or
(b) any action by the recipient that makes it appear to the sender that the electronic record has been received by the recipient.
(3)If a condition of acknowledgment of receipt by the sender is imposed on the receipt of an electronic record, the said electronic record shall not be deemed to have been sent by the sender until the recipient acknowledges receipt in accordance with the said condition.
(4)If no condition of acknowledgment of receipt is imposed by the sender on the receipt of any electronic record and if the sender does not receive the acknowledgment of receipt within the time specified or fixed by the sender, or if no similar time is specified or fixed, the sender within a reasonable time,-
(a) give notice to the recipient of non-acknowledgement of receipt, and such notice shall specify a reasonable time limit within which acknowledgment of receipt shall be made; And
(b) If receipt is not acknowledged within the period specified in clause (a), the sender may, subject to notice to the recipient, treat the electronic record as never having been sent.
(a) give notice to the recipient of non-acknowledgement of receipt, and such notice shall specify a reasonable time limit within which acknowledgment of receipt shall be made; And
(b) If receipt is not acknowledged within the period specified in clause (a), the sender may, subject to notice to the recipient, treat the electronic record as never having been sent.
(5)Where the sender receives an acknowledgment of receipt from the recipient, it shall be presumed that the electronic record concerned has been received by the recipient, but it shall not be presumed that the content of the electronic record is the same as the received record.
(6)Where an acknowledgment states that the electronic record concerned has met the technical requirements of the agreed or applicable standards, it shall be presumed that it was sent in compliance with the said requirements.
§ 15Time and place of transmission and receipt of electronic records
15 (1) Unless otherwise agreed by the sender and the receiver,—
(a) the time of transmission of any electronic record shall be counted as soon as it is accessed by any computer or electronic device or technique beyond the control of the sender;
(b) the time of receipt of any electronic record shall be determined as follows, namely-
(b) in the case of any electronic device or technique being prescribed by the recipient for the purpose of receiving the electronic record or opening the record,-
(1)the time at which the electronic record is entered into the prescribed electronic device or technique; or
(2)if the electronic record is transmitted by any unspecified device or technique or computer source other than the electronic device or technique designated by the recipient, at the time the record is opened by the recipient;
(a) If the recipient has not established an electronic technique, including a specific schedule, if any, when the electronic record is entered into the recipient's computer source.
(c) any electronic record sent by the sender shall be deemed to have been sent from his place of business and the record received by the recipient shall be deemed to have been received at his place of business.
(a) If the recipient has not established an electronic technique, including a specific schedule, if any, when the electronic record is entered into the recipient's computer source.
(c) any electronic record sent by the sender shall be deemed to have been sent from his place of business and the record received by the recipient shall be deemed to have been received at his place of business.
(2)The provisions of sub-section (1)(b) shall apply notwithstanding that the place of the electronic device or technique or computer source is different from the place where the electronic record is deemed to have been received under sub-section (1)(c).
(3)For the purposes of this section,—
(a) in case of more than one place of business of the consignor or consignee, their principal place of business shall be deemed to be the place of business;
(b) In case the consignor or consignee has no place of business, their place of ordinary residence shall be deemed to be their place of business.
(a) in case of more than one place of business of the consignor or consignee, their principal place of business shall be deemed to be the place of business;
(b) In case the consignor or consignee has no place of business, their place of ordinary residence shall be deemed to be their place of business.
ExplanationIn the case of a statutory body or body corporate, “principal place of business”, or “ordinary place of residence” shall mean its registered address.
§ 16Secure electronic records
16 If any security measures are adopted for any electronic record at any particular time, then the said record shall be deemed to be a secure electronic record from that time till the time of verification.
§ 17Secure electronic signature
17 (1) If it can be verified by applying any security measures with the consent of the parties concerned that, at the time of affixing the electronic signature—
(a) it was the sole property of the assignor;
(b) the linker was identifiable; And
(c) the linker had sole control over the method of manufacture or use thereof;
If so, subject to the provisions of sub-section (2), the said electronic signature shall be deemed to be a secure electronic signature.
(2)Notwithstanding the provisions of sub-section (1), the electronic signature shall be deemed to be invalid if any alteration is made to the electronic record relating to the electronic signature.
§ 18[Controller and other officers, etc.]
2
[(1) For the purposes of this Act, the Government shall, until rules are made, by notification in the Official Gazette and optionally in the Electronic Gazette, subject to such conditions as may be prescribed in the notification, appoint a Controller and such number of Deputy Controllers and Assistant Controllers as may be:
Provided thatthe period of such notification shall not exceed one year from the date of issue of the notification.]
(2)Subject to the general supervision and control of the Government, the Controller shall perform all functions devolved upon him under this Act.
(3)Subject to the direct supervision and control of the Controller, the Deputy Controllers and Assistant Controllers shall perform and perform the duties assigned to them by the Controller.
(4)The qualifications, experience and terms of service of the Controller, Deputy Controller and Assistant Controller shall be determined by the rules.
(5)The head office of the Controller shall be at Dhaka and the Government may, if necessary, establish branch offices in any part of the country for such period or permanently as may be prescribed by it.
(6)The office of the Comptroller shall have a common seal, which shall be used in such cases as may be approved and prescribed by the Government.
(7)There shall be a room in the office of the Controller for the purpose of preservation of all electronic records under this Act, which shall be called the "Electronic Record Preservation Room".
§ 19Functions of Controller
19 The Controller shall perform all or any of the following functions, namely:-
(a) supervision of the functions of the certifying authority;
(b) prescribing the standards to be followed by the certifying authority;
(c) determining the qualifications and experience of the employees of the certifying authority;
(d) prescribing the conditions of operation of the certifying authority;
(e) prescribing the contents of any written, printed or visible content or advertisement that may be used in connection with electronic signature certification;
(f) prescribing electronic signature certificate forms and matters to be included therein;
(g) prescribing the schedule and method of keeping accounts of the certificate-issuing authority;
(h) prescribing the terms and conditions of appointment of auditors for the purpose of auditing the accounts of the certifying authority and their remuneration;
(j) Facilitating the establishment of electronic systems by any Certificate Issuing Authority alone or jointly with any other Certificate Issuing Authority and prescribing policies for the operation of such system;
(j) prescribing rules of conduct for customers and certifying authorities regarding the conduct of business;
(k) Resolving conflicts of interest between the Certificate Issuing Authority and the Customer;
(l) prescribing the duties and responsibilities of the certifying authority;
(d) maintenance of computerized databases, whereby—
(b) the records of every certificate issuing authority shall include such information as may be prescribed by regulation; And
(a) public access shall be guaranteed;
(d) performing any other function under this Act or rules made thereunder.
§ 20Acknowledgment of Foreign Certificate Issuing Authorities
20 (1) Subject to such conditions as may be prescribed by regulation, with the prior approval of the Government and by notification published in the Official Gazette and optionally in the Electronic Gazette, the Controller may recognize any foreign Certificate Authority as a Certificate Authority under this Act.
(2)If any foreign authority is recognized as a certifying authority under sub-section (1), the electronic signature certificate issued by that authority shall be valid for the purposes of this Act.
(3)If the Controller is satisfied that any certifying authority has contravened any of the conditions under which it has been accredited under sub-section (1), he may, by notice in the Official Gazette and optionally in the electronic gazette, by notice in writing, cancel the accreditation granted to that authority.
§ 21Acting as the controller's repository
21 (1) The Controller shall be the custodian of all electronic signature certificates issued under this Act.
(2)The Controller shall ensure the confidentiality and security of all electronic signatures, and for this purpose he shall use hardware, software and any other secure means to prevent misuse and unauthorized access to electronic signatures and shall follow a prescribed standard.
§ 22License for issuance of electronic signature certificates
22 (1) Subject to the provisions of sub-section (2), any person may apply to the Controller for a license to issue electronic signature certificates.
(2)No license shall be issued under sub-section (1) unless the applicant has the prescribed qualifications, skills, manpower, financial standing and other necessary infrastructural facilities for the issuance of electronic signature certificates.
(3)A license issued under sub-section (1)—
(a) remain valid for the prescribed period;
(b) shall be paid subject to compliance with prescribed conditions; And
(c) shall not be acquired by inheritance or otherwise transferable
(a) remain valid for the prescribed period;
(b) shall be paid subject to compliance with prescribed conditions; And
(c) shall not be acquired by inheritance or otherwise transferable
§ 23Application for license
23 (1) Application for obtaining a license shall be submitted in the prescribed form
(2)Every application under sub-section (1) shall be accompanied by the following documents and papers-
(a) Certification practice statement;
(b) necessary documents relating to the identification of the applicant;
(c) proof of deposit of prescribed fee;
(d) such other information, documents and papers as may be prescribed
(a) Certification practice statement;
(b) necessary documents relating to the identification of the applicant;
(c) proof of deposit of prescribed fee;
(d) such other information, documents and papers as may be prescribed
§ 24License renewal
24 Licenses issued under this Act shall be automatically renewable for the prescribed period, subject to payment of fees in the prescribed manner.
§ 25Procedure for Grant or Rejection of License
25 On receipt of an application under section 22(1), the Controller may grant a license or cancel or reject any application having regard to the information, documents and papers attached with the said application and any other matter deemed appropriate by the said application:
Provided thatno application shall be dismissed or rejected without giving the applicant a reasonable opportunity of being heard.
§ 26Cancellation or suspension of license
26 (1) Subject to other provisions of this Act, the Controller may suspend or cancel any licence, if he is satisfied that the certifying authority—
(a) furnishes false or untrue information in connection with the issue or renewal of a licence;
(b) fails to comply with the terms of the licence;
(c) fails to maintain the criteria prescribed under section 21 (2);
(d) contravenes any provision of this Act or any rule, regulation or order made thereunder.
(2)No license shall be canceled under this section without giving the certifying authority a reasonable opportunity to show cause for cancellation of any license under sub-section (1).
(3)If the Controller has reasonable grounds to believe that a cause for revocation of a license under sub-section (1) has arisen, he may, by order, suspend the said license pending the completion of the inquiry so directed.
(4)No license shall be suspended for a period exceeding fourteen (fourteen) days by giving reasonable opportunity to the certifying authority to show cause in respect of an order suspending any license under sub-section (3).
(5)If the license of any certificate issuing authority is temporarily suspended under this section, the said authority shall not issue any electronic signature certificate during the period of suspension of the licence.
§ 27Notice of license cancellation or suspension
27 (1) Where the license of any certificate issuing authority is revoked or suspended, the Controller shall publish a notice of such revocation or, as the case may be, order of suspension in the database maintained by it.
(2)In case there is more than one repository, the notice of the cancellation or, as the case may be, of the order temporarily suspended shall be published in all such repositories:
Provided thatthe database containing the notice of such cancellation or, as the case may be, temporarily suspended order shall be made available to the public at all times by electronic or any other means including the website.
§ 28delegation of power
28 The Controller may delegate any of his powers under this Act in writing to the Deputy Controller, Assistant Controller or any other officer under his control.
§ 29power of investigation
29 (1) The Controller or any officer empowered for this purpose or under his control may investigate any contravention of this Act or the rules or regulations made thereunder.
(2)For the purposes of sub-section (1), the Controller or such officer may exercise the powers of a civil court under the Code of Civil Procedure in respect of the following matters, namely:
(a) discovery and inspection;
(b) to secure the attendance of any person and to examine him on oath;
(c) compel the production of any document; And
(d) examining or examining any witness before the Commission
(a) discovery and inspection;
(b) to secure the attendance of any person and to examine him on oath;
(c) compel the production of any document; And
(d) examining or examining any witness before the Commission
§ 30Access to computers and data contained therein
30 (1) Without prejudice to the provisions of section 45, if the controller or any person authorized by him reasonably suspects that any provision of this Act or the rules or regulations made thereunder has been violated, then for the purpose of investigation, he shall enter the said computer system or any equipment or data or any other content related to the said system for the purpose of collecting any information or data stored or available in any computer system.
(2)For the purposes of sub-section (1), the Controller or any person empowered to do so may, by order, direct any person managing or supervising any computer system, equipment, data or content to provide any technical and other assistance necessary.
(3)If any direction is given under sub-section (1), the person directed shall be obliged to cooperate in accordance with the said direction.
§ 31Provisions to be followed by the Certifying Authority in respect of certain matters
31 Every Certificate Issuing Authority-
(a) use secure hardware, software and appropriate procedures to prevent unauthorized access and misuse;
(b) provide reliable services of a quality reasonably necessary for the purpose of carrying out the functions under this Act;
(c) follow appropriate security procedures to ensure the confidentiality and privacy of electronic signatures; And
(d) follow such other criteria as may be prescribed by regulations
§ 32Ensuring compliance of laws, etc., by the certifying authority
32 Every person appointed or otherwise engaged by every certifying authority shall ensure compliance with the provisions of this Act or the rules or regulations made thereunder in the performance of his duties and responsibilities under this Act.
§ 33License display
33 Every Certifying Authority shall display its license in a public place at its place of business for the inspection of all concerned.
§ 34Surrender of license
34 If any license is canceled or, as the case may be, suspended under this Act, the relevant certifying authority shall forthwith surrender the license to the Controller after such cancellation or, as the case may be, suspension.
§ 35To reveal some things
35 (1) The certifying authority shall, in the manner prescribed by regulations, disclose the following matters, namely—
(a) an electronic signature certificate used by a certificate issuing authority to validate another electronic signature certificate;
(b) particulars of the manner and procedure to be followed in connection with the issue of the certificate;
(c) notice of cancellation or suspension of certificate by the issuing authority, if any; And
(d) any other information that may adversely affect the credibility of the electronic signature certificate issued by the certificate issuing authority or its ability to provide services.
(2)If any event occurs or any situation arises in which it appears to the certifying authority that the credibility of the computer system of the said authority has been adversely affected or the conditions of the electronic signature certificate issued to the said authority have been violated, the said authority shall take necessary measures to notify all persons who may be affected by the said event or to deal with the situation and procedures followed for issuing certificates. Necessary measures will be taken in light
§ 36Issuance of certificates
36 The Certifying Authority may issue a certificate to a prospective customer if the following are satisfied, namely:-
(a) whether the application in the prescribed form has been submitted by the applicant for the issue of the certificate;
(b) whether the following customs and procedures have been followed in the matter, including ascertaining the identity of the applicant customer;
(c) whether the applicant customer is a registered person for the certificate at issue;
(d) whether all the information provided by the customer applying for the certificate of issue is correct or not; And
(e) whether the prescribed fee for issue of certificate has been paid by the said customer or not.
§ 37Assurance of Certificate Issuing Authority
37 (1) Any person reasonably confident of the electronic signature or certificate appearing in the certificate shall, at the time of issuing the certificate, be assured by the certifying authority that the said authority has issued the certificate in compliance with the rules and procedures for issuing the certificate, or that the confident person is aware of the same.
(2)In the absence of the rules and procedures mentioned in sub-section (1), the certifying authority shall give an assurance that,-
(a) in issuing the certificate the certifying authority has complied with all requirements under this Act and the rules and regulations made thereunder, and if the certifying authority has published the certificate or otherwise made it available to a similar trusted person, the subscriber listed on the certificate has accepted it;
(b) all the information stated in the certificate is correct unless there is any guarantee as to the accuracy or correctness of the information contained in the certificate or by reference to the certificate by the authority issuing the certificate;
(c) the certifying authority has no knowledge of any information included in the certificate which would undermine the credibility of the assurances given in clauses (a) and (b).
(a) in issuing the certificate the certifying authority has complied with all requirements under this Act and the rules and regulations made thereunder, and if the certifying authority has published the certificate or otherwise made it available to a similar trusted person, the subscriber listed on the certificate has accepted it;
(b) all the information stated in the certificate is correct unless there is any guarantee as to the accuracy or correctness of the information contained in the certificate or by reference to the certificate by the authority issuing the certificate;
(c) the certifying authority has no knowledge of any information included in the certificate which would undermine the credibility of the assurances given in clauses (a) and (b).
(3)If the particulars of the manner and procedure of issuing the applicable certificate are included in any certificate as a reference or if the person who believes in the matter has the knowledge of the same, then the provisions of sub-section (2) shall apply to the extent that it is consistent with the particulars of the manner and procedure of issuing the certificate so given.
§ 38Electronic signature certificate cancellation
38 (1) The Certificate Issuing Authority may cancel the Electronic Signature Certificate issued by it for the following reasons, namely-
(a) if any customer or any person authorized by him applies for cancellation;
(b) on the death of any subscriber; or
(c) in the case of the Customer being a company, on its winding up or otherwise winding up.
(2)Subject to the provisions of sub-section (3) and without prejudice to the generality of the provisions of sub-section (1), a certificate issuing authority may cancel any electronic signature certificate issued by it, if that authority is satisfied that—
(a) the information presented in any electronic signature certificate is falsified or concealed;
(b) all requirements for issuance of electronic signature certificate are not fulfilled;
(c) the authentication method of the certifying authority has been altered in such a way as to materially and substantially impair the reliability of the electronic signature certificate; or
(d) the customer has been declared insolvent by a competent court
(a) the information presented in any electronic signature certificate is falsified or concealed;
(b) all requirements for issuance of electronic signature certificate are not fulfilled;
(c) the authentication method of the certifying authority has been altered in such a way as to materially and substantially impair the reliability of the electronic signature certificate; or
(d) the customer has been declared insolvent by a competent court
(3)No electronic signature certificate shall be canceled under this section without giving the customer a reasonable opportunity of being heard.
(4)Upon cancellation of any electronic signature certificate under this section, the issuing authority shall immediately notify the subscriber concerned.
§ 39Suspension of Electronic Signature Certificate
39 (1) Subject to the provisions of sub-section (2), any Certifying Authority may suspend an electronic self-certificate so issued for any of the following reasons, namely-
(a) if the customer listed in the relevant electronic certificate or any person authorized by the said customer notifies the request for suspension;
(b) If the Certifying Authority deems it expedient to suspend the Electronic Signature Certificate in the public interest.
(2)No electronic signature certificate shall be suspended under sub-section (1) (b) without giving 30 (thirty) days notice to the subscriber concerned.
(3)If, in view of the notice under sub-section (2), the explanation given by the customer is not acceptable, the certifying authority may suspend the certificate.
(4)Upon suspension of any electronic signature certificate, the certificate issuing authority shall immediately notify the concerned subscriber.
§ 40Notice of cancellation or suspension
40 (1) Where an electronic signature certificate is canceled under section 38 or suspended under section 39, the issuing authority shall thereafter publish a notice of such cancellation or, as the case may be, suspension, in the specified repository specified in the electronic signature certificate.
(2)In case there are more than one repositories, the certificate issuing authority shall publish the notice of cancellation or, as the case may be, suspension of the electronic signature certificate in all such repositories.
§ 41Implementation of security procedures
41 The Customer shall take appropriate security measures to ensure the validity of the Electronic Signature Certificate issued by the Certificate Authority.
§ 42Acceptance of Electronic Signature Certificate
42 (1) An electronic signature certificate shall be deemed to have been accepted by a customer if he himself or a person authorized by him for that purpose discloses the same to one or more persons or in any repository.
(2)By accepting the Electronic Signature Certificate, the Customer may certify to all persons reasonably confident of the information contained therein that—
(a) all descriptions provided by the Customer to the Certificate Issuing Authority and all information and relevant matters contained in the Electronic Signature Certificate are correct; And
(b) All information in the Electronic Signature Certificate is true to the best of the Customer's knowledge
(a) all descriptions provided by the Customer to the Certificate Issuing Authority and all information and relevant matters contained in the Electronic Signature Certificate are correct; And
(b) All information in the Electronic Signature Certificate is true to the best of the Customer's knowledge
§ 43Presumptions about information presented in case of obtaining certificate
43 For the purpose of obtaining any Electronic Signature Certificate, all material information submitted by the Customer to the Certifying Authority and all information contained in the Electronic Signature Certificate to the Customer's knowledge, whether or not confirmed by said Authority, shall be deemed to be correct and complete to the best of the Customer's knowledge and belief.
§ 44Control of customer security systems
44 (1) Every customer shall take care to maintain the security of its electronic signature certificate issuance process, and shall take all steps not to disclose the customer's electronic signature to any person not authorized to attach it.
(2)If any security measures are breached in violation of the provisions of sub-section (1), the concerned customer shall immediately inform the electronic signature certificate issuing authority in the prescribed manner.
§ 45Power of Regulator to issue directions
45 In order to ensure compliance with any provision of this Act or the rules or regulations made thereunder, the Controller shall, by order, direct any certificate issuing authority or any of its employees to take any action or refrain from doing any work as mentioned in the order or to take any other action at the discretion of the Controller.
§ 46Power of the Controller to issue directives in emergency situations
46 (1) If the Controller is satisfied that it is expedient and necessary to issue an order in the interests of the sovereignty, integrity, security, friendly relations of Bangladesh with other foreign countries, public order and security, or to prevent incitement to the commission of any offense punishable under this Act, he may, for reasons in writing, by order, prevent any law enforcement agency of the Government from transmitting any information through any computer resource. Can you give instructions
(2)If any order is issued under sub-section (1), any customer or custodian of computer resource shall be obliged to provide all facilities and technical assistance to the said organization to decrypt any information as per the instructions mentioned in the said order.
§ 47Ability to declare reserved systems
47 (1) The Regulator may, by notification in the Government or other optional electronic gazette, declare any computer, computer system or computer network to be a protected system.
(2)The Controller may, by order in writing, grant access to any person for the purpose of controlling access to or providing security to a protected system declared under sub-section (1).
§ 48Remedies for failure to furnish documents, returns and reports
48 If any person fails to deliver the documents, returns and reports payable under this Act or the rules or regulations made thereunder to the controller or the certificate-issuing authority, the controller or the controller for this purpose or, in the field, any officer empowered by a general or special order from the government may, by administrative order, collect a fine not exceeding ten thousand taka from the said person, stating the reasons in writing.
§ 49Remedy for failure to submit information, books, etc
49 If any person fails to provide any information, book or any other document within the time limit set for this purpose under this Act or the rules or regulations made thereunder, the controller or the controller or, in the field, any officer empowered by a general or special order from the government may, by administrative order, levy a fine not exceeding ten thousand taka from the said person, stating the reasons in writing.
§ 50Remedy for failure to maintain books or records
50 If any person fails to maintain any accounts or records required under this Act or the rules or regulations made thereunder, the Controller or the Controller for this purpose or, as the case may be, any officer empowered by a general or special order from the Government, may, by administrative order, with reasons in writing, levy a fine of not more than two hundred thousand rupees on such person.
The Information and Communication Technology Act, 2006 is a comprehensive legislation governing digital transactions, electronic records, cybercrimes, and information technology in Bangladesh. It applies to all electronic records and digital signatures used for legal purposes within Bangladesh and to offences committed using digital technology that affect Bangladesh or its citizens. The Act provides legal recognition for electronic records and digital signatures (Sections 3-8), establishes the Controller of Certifying Authorities to regulate digital signature certification (Sections 18-25), and creates a framework for electronic governance including electronic filing, online service delivery, and digital payments. Key mechanisms include the penalisation of cybercrimes including unauthorised access to computer systems, data theft, hacking, identity theft, cyber terrorism, publishing obscene material online, and phishing (Sections 54-66). Penalties include imprisonment up to 10 years and significant fines. Notable provisions include the establishment of a Cyber Appellate Tribunal to hear appeals against orders of the Controller (Section 67), the power of law enforcement to intercept electronic communications with court authorisation, provisions for the admissibility of electronic evidence (Section 69), and the requirement for intermediaries to maintain records and assist law enforcement. The Act has been amended several times, including the controversial Section 57 which originally criminalised defamation online, and Section 8 of the Digital Security Act, 2018 which later occupied much of the same space. The Act remains in force alongside the Digital Security Act, 2018 and provides the foundational legal framework for Bangladesh's digital economy.