New Delhi, July 8 (IANS) Bangladesh’s newly enacted data protection law contains no mandatory breach notification requirement even after the Shwapno supermarket ransom case that compromised data of forty lakh registered customers, a new report has said.

The report from Bangladesh-based The Daily Star said that the final voter list for the country’s 13th parliamentary election being sold openly on Facebook highlighted gaps in the law’s enforcement architecture.

A Dismislab investigation found hundreds of Facebook posts and paid advertisements offering the voter register containing names, voter numbers, parents’ names, dates of birth, occupations and permanent addresses for between 30 taka and 250 taka.

“A 250 taka payment to a bKash number could get you access to a Google Drive folder organised by division, constituency, and area,” the report said, adding that none knew who was legally accountable for the breach.

Analysts said that Bangladesh’s data protection framework contains no mandatory breach‑notification requirement and assigns enforcement to a body that lacks the statutory independence and investigatory reach to hold powerful public or private actors to account.

“Bangladesh drafted an imperfect law for a shifting scenario. Then, it handed enforcement to a body that, by its own statute, cannot fully investigate the government that created it,” the report said.

The Election Commission, earlier in 2026, confirmed that five organisations with legitimate API access to the NID system, including the Directorate General of Health Services, a major bank, and the Chittagong Port Authority, had leaked data to third parties.

The report argued that the Shwapno supermarket data leak occurred because the company had accumulated years of detailed behavioural data on millions of customers and stored it without adequate protection. Even after receiving a ransom demand, it had no legal obligation to notify those affected, the media house said.

—IANS

aar/pk