Bangladesh's digital future is at a critical juncture as its draft Data Protection Act includes requirements to compel firms to store data locally – a concept known as data localisation. Localisation would create a lose-lose situation for Bangladesh. It undermines Bangladesh's ability to get the most out of the data and digital tools that drive digital development. New econometric analysis shows that its trade and economy will suffer severely. Localisation also doesn't do the things its supporters say it does in terms of privacy and cybersecurity.

While there is still a long way to go, Bangladesh has made remarkable progress in helping more people and businesses get online and benefit from data, digital technologies, and global connectivity. Since the 2008 launch of the government's "Digital Bangladesh" vision, internet subscribers have surged to nearly 124 million, as of December 2021. Bangladeshi content creators and entrepreneurs are showing what's possible via cooking channels on YouTube and education tech. A 2019 UN study estimated that Bangladesh's IT sector had increased an astonishing 40 percent a year since 2010.

Read more

Is the Data Protection Act an extension of DSA?

Bangladesh has also taken advantage of the digitalisation of trade, which allows services work to be broken apart and done remotely. Bangladesh is home to the second largest group of global gig workers (15 percent) involved in creative and multimedia work who earn, according to Bangladesh's ICT ministry, an estimated USD 500 million annually.

Because of this, Bangladeshi policymakers have a lot at stake in enacting data policies. They face one central question: do they follow a smart data governance strategy (that holds firms accountable for following local laws when they move data abroad, a principle most countries embrace) or do they pursue data localisation in a misguided pursuit of digital control and protectionism? Both paths allow for data privacy, cybersecurity, law enforcement, and national security policies, but the latter will be much more costly to the digital economy.

Unfortunately, Bangladesh has started down the latter path in enacting or considering multiple localisation policies. The main one is in its draft Data Protection Act (Sections 44 and 45). Together, these localisation policies will be costly to Bangladesh's economy. A new report by the US-based public policy think tank Information Technology and Innovation Foundation (ITIF) shows that after five years, Bangladesh's trade volumes and imports will decrease by an estimated 6 and 7.7 percent, respectively. Localisation also increases import prices by two percent. Bangladesh's overall trade volumes decreasing in line with imports suggests that exports are also affected by such policies. Our findings are consistent with other recent econometric research, including a study specifically on Bangladesh.

Bangladeshi officials have fallen for the false promise of "data nationalism." Data localisation mandates do not increase commercial privacy or data security. In the case of surveillance, localisation makes it easier to undermine privacy and other human rights. Data localisation also doesn't improve cybersecurity as the confidentiality of data does not generally depend on which country the information is stored in – only on the measures used to store it securely. In protecting government data, governments can require that IT service providers use international cybersecurity best practices and technical measures in procurement contracts. If the concern is access to data for law enforcement, there are better tools. Localisation is no silver bullet – the globalisation and digitisation of crime means there will more than likely be data in other jurisdictions. Bangladesh should pursue new legal agreements to help local law enforcement request and receive data from other jurisdictions.

Bangladeshi policymakers that choose data localisation policies are setting their digital economy up for failure. It's a fact that international trade involving consumers cannot occur without collecting and sending personal data across borders – such as names, addresses, billing information, etc. The few jobs and investments in local data centres are far outweighed by the larger economic costs of more expensive and fewer digital services. This ripples through the whole economy as firms in every sector are increasingly getting dependent on digital goods and services.

Read more

With a new data protection act on the cards, time for a reality check

Localisation also puts Bangladesh's growing digital exports at risk as there is global competition between countries to capture a growing share of this work. There's enormous room to grow: Bangladesh's services export-GDP ratio is just 1.5 percent, compared to around 40 percent in India, the Philippines, and Sri Lanka. Never mind the trade impact if other countries retaliate against Bangladesh for enacting localisation, which the US has done against India and Indonesia in the past.

With misguided localisation policies, Bangladesh's early progress and future promise are at risk. What path will Bangladesh's policymakers take as they conduct a final review of the country's Data Protection Act? The path to a false and costly promise of digital protectionism and control? Or will they choose one that's based on targeted and balanced laws that reflect global data-policy norms that keep Bangladesh integrated with the global digital economy? Hopefully, it's the latter.

Nigel Cory is associate director at the US-based Information Technology and Innovation Foundation (ITIF).