Bangladesh law treats biometric data as sensitive personal data and requires lawful processing, security controls, limited retention and records 1. ICAO says API contains identity and travel document data, and PNR comes from the booking record 2. UN Security Council Resolution 2396 requires states to build API and PNR capacity with respect for human rights 3. No public government document checked on 19 October 2026 states where data for the reported new border proposal would be stored or who could access it.
Bangladesh law
Personal Data Protection Act 2026 1
Biometrics
Sensitive personal data 1
API source
Check-in and travel document data 2
PNR source
Airline booking data 2
International duty
API and PNR capacity under Resolution 2396 3
Proposal data location
Not published in an official document checked on 19 October 2026

What API and PNR mean

ICAO separates passenger information into two streams. Advance Passenger Information, or API, is generated at check-in and includes a traveller's name, date of birth, gender, citizenship and travel document data 2. Passenger Name Record, or PNR, is generated when a ticket is booked or bought. It can contain a name, itinerary and ticket information, and may contain sensitive personal data 2.

These records are not the same as a fingerprint or face image. A border system may link API and PNR to biometrics, watchlists or immigration records, but the published design must say what is linked and on what legal basis.

What Bangladesh law requires

The Personal Data Protection Act 2026 defines personal data to include identity, location, financial, biometric and other identifying data. It classifies biometric and genetic data as sensitive personal data 1.

Section 5 requires consent or another lawful basis for processing 1. Section 16 limits disclosure outside the purpose for which the data was collected, subject to the rest of the Act 1. Section 17 requires technical and organisational measures against loss, misuse, unauthorised access and disclosure 1. Sections 18 and 19 set retention and recordkeeping duties 1.

The Act has cross-border reach for violations involving Bangladesh from inside or outside the country 1. Its existence does not prove that a proposed system meets the law. Compliance depends on the final design, contract, access rules, retention schedule and operating practice.

Why countries collect passenger data

UN Security Council Resolution 2396, adopted on 21 December 2017, directs member states to establish API systems and develop the capacity to collect, process and analyse PNR 3. The resolution ties use of the data to domestic law, international obligations, human rights and fundamental freedoms 3.

ICAO's guidance says border checks increasingly use electronic data before arrival so agencies can perform targeted controls 2. ICAO standards cover transmission formats, legal authority and data handling 2,4. These international rules explain why Bangladesh needs passenger-data capability. They do not select a vendor or funding model.

Questions the public proposal must answer

No published official proposal or draft contract answering those questions was found on the Home Affairs, Cabinet Division, BPPA or laws portals by 19 October 2026. A claim that data will stay in Bangladesh, or that it will leave Bangladesh, is not established without that record.

  • Which Bangladesh authority is the data controller and which entities are processors 1
  • Which API, PNR, biometric and watchlist fields are collected 1,2
  • Where the live database, backups and recovery systems are located
  • Which government and contractor staff can view, change or export records
  • How long each data class is kept and how deletion is audited 1
  • Whether any data crosses Bangladesh's borders and under which legal power 1
  • How a traveller can use rights granted by the 2026 Act 1

Common questions

Does API include biometrics?

ICAO describes API as identity and travel document data from check-in 2. Biometrics are a separate data class under Bangladesh law 1.

Is biometric data protected in Bangladesh?

Yes. The 2026 Act classifies biometric data as sensitive personal data and sets processing and security duties 1.

Does the UN require Bangladesh to use one company?

No. Resolution 2396 requires API and PNR capability. It does not choose a supplier or payment model 3.

Will border data leave Bangladesh?

Not confirmed. No official public proposal checked on 19 October 2026 gave the storage location or transfer terms.

Does a privacy law settle the sovereignty question?

No. The law sets duties 1. The final technical design, contract and operating controls determine how those duties are applied.

Rules and fees change. Check the official site linked on this page before you apply or pay. Spotted an error? Email [email protected] with the official link.

Sources

  1. Laws of Bangladesh: Personal Data Protection Act 2026, Act 63 of 2026 (10 April 2026)
  2. International Civil Aviation Organization: API Guidelines and PNR Reporting Standards (viewed 19 October 2026)
  3. United Nations Security Council: Resolution 2396 (21 December 2017)
  4. International Civil Aviation Organization: Interactive API Best Practice, Annex 9 standards (2024)

Related guides