The draft of the proposed Cyber Security (Amendment) Act, 2026 seeks to further increase the government’s influence over social media regulation. Alongside expanding the scope of punishment for spreading rumours and misinformation, defamation, bullying, and content created or edited using artificial intelligence, the draft proposes broader government powers to remove and block online content. Transparency International Bangladesh (TIB) has expressed deep concern, stating that some of the provisions in the draft pose serious risks to people’s fundamental human rights, freedom of speech, and freedom of expression.
A consultation meeting on the draft was held last Thursday at the conference room of the Ministry of Information and Broadcasting. The proposed amendments were discussed at the meeting. The draft proposes introducing a new Section 26(a), under which publishing or disseminating rumours and misinformation in cyberspace would be considered a criminal offence. The offence would be punishable by up to 10 years in prison, a fine of up to Tk 4 million, or both. Under the proposed definition, “rumour” refers to unsupported or unverified information, news, or claims that cause or are likely to cause confusion, panic, tension, or social instability among the public.
The proposed amendment also seeks to change the title of Section 25. Alongside sexual harassment, blackmailing, and obscene content, defamatory information would be brought under the provision. Under the existing law, the creation, collection, storage, transmission, publication, or dissemination of harmful or threatening information, videos, audio-visual material, still images, or graphics for the purpose of blackmailing, sexual harassment, revenge pornography, digital child sexual abuse material, or extortion involving sexual harassment is punishable by up to two years in prison, a fine of Tk 1 million, or both. The proposed amendment would increase the punishment to five years’ imprisonment or a fine of Tk 2 million. In cases involving women or children under 18, the maximum sentence would be increased from five to 10 years, while the maximum fine would rise from Tk 2 million to Tk 4 million.
A new definition of “bullying” has also been proposed. It would be considered bullying when an individual or group deliberately and repeatedly uses actual or perceived power, influence, or dominance against another individual or group through physical, verbal, social, digital, or other means in a manner that causes or is likely to cause physical or psychological harm, distress, fear, social exclusion, isolation, or loneliness. The use of artificial intelligence has also been explicitly incorporated into the language of the law. If any information or content is captured, edited, created, or altered using artificial intelligence, it could also fall within the scope of the relevant offence.
The existing framework for taking action against both the individuals concerned and the organisation when an offence is committed through a company or legal entity would remain in place. Under a new sub-section, Section 29(3), if a company is found guilty, a court could order the suspension, cancellation, or prohibition of the company’s registration, licence, or operations. The definition of “company” has also been broadened. In addition to entities registered under the Companies Act, 1994, the proposal would bring commercial establishments, partnerships, associations, organisations, trusts, statutory bodies, and other legal entities within its scope.
Major changes have also been proposed in the judicial system. Although the existing law provides for all offences under the Act to be tried by cyber tribunals, the amendment would reserve only specified serious offences for trial before cyber tribunals.
One of the most significant changes in the draft concerns Section 8(2). Under the existing law, law-enforcement agencies may, under certain circumstances, take steps to remove, block, or transfer digital or electronic information. The amendment proposes extending this authority beyond law-enforcement agencies to the Ministry of Information and Broadcasting and other agencies or forces authorised by the government. The provisions would cover content deemed a threat to sovereignty, security, defence, or public order; religious or communal hatred; content that could incite violence based on ethnic discrimination; instructions for committing crimes or creating disorder; misinformation or rumours; and defamatory information concerning any individual or organisation, as well as information deemed insulting to the state.
In addition to removing, blocking, or transferring such information, the authorities would also be able to request the Bangladesh Telecommunication Regulatory Commission to take necessary action. In other words, the proposed amendment does not merely introduce new offences; it would also expand the institutional scope of online content regulation.
In a statement sent to the media last Friday, TIB Executive Director Dr Iftekharuzzaman said that the draft Cyber Security Act 2026 brings three complex issues—cybercrime, cybersecurity, and people’s right to freedom of expression—under a single law, without giving adequate importance to any of them. Instead, he said, it creates scope for risky and deliberate misinterpretation and misuse in each area, raising concerns about human rights violations.
He further said that, in addition to conflating the specialised field of cybersecurity with cybercrime, the law incorporates provisions aimed at controlling people’s freedom of expression in cyberspace. Such matters, he argued, are fundamentally different, fall outside the proper scope of such legislation, and run counter to global best practices.