Govt Rejects Single Centralized Platform, Adopts Federated Architecture For Data Privacy: ICT Secretary

Rejecting the model of a single centralized data warehouse to prevent systemic vulnerabilities, the Government of Bangladesh has confirmed that it is operationalizing a "federated data architecture" linked via an integrated interoperability framework to safeguard citizens' sensitive records. Concurrently, statutory mandates are being finalized to end excessive enterprise data collection, backed by institutionalized Standard Operating Procedures (SOPs) for rapid cyber breach management.

The strategic policy direction was outlined on Thursday, 5 November 2026, at the corporate headquarters of Robi Axiata PLC in Agargaon, Dhaka, during the award ceremony and high-level policy dialogue of ‘Privacy Avengers 2026’—a nationwide initiative honoring the top 10 youth innovator teams. The panel deliberated under the theme ‘Navigating AI, Privacy, and Trust in the DVP Era’.

The policy summit featured Secretary of the Information and Communication Technology (ICT) Division Md. Mamunur Rashid Bhuiyan as Chief Guest. Director General (Systems and Services) and Commissioner of the Bangladesh Telecommunication Regulatory Commission (BTRC) Brigadier General Shahzad Pervez Mohiuddin, alongside Axiata Group’s Group Chief Risk and Compliance Officer Abid Abdul Adam, participated as Special Guests. Robi Axiata PLC Managing Director and Chief Executive Officer Ziad Shatara presided over the convention.

Federated Interoperability Replaces Single-Point Failure: ICT Secretary

 Delivering the keynote ministerial address, ICT Secretary Md. Mamunur Rashid Bhuiyan stated: "Across public and private sectors, digital platforms continuously ingest citizen data. The fundamental test lies in our institutional ability to protect this information and preserve public trust. Beyond legislative blueprints like the European GDPR, Bangladesh must cultivate an organic, nationwide data protection culture."

The Secretary confirmed that three major regulatory pillars were enacted in early 2026: the Personal Data Protection Act, the Cyber Security Amendment Act, and the National Data Governance Act. Structurally, these statutes mandate the creation of an independent ‘National Data Protection Authority’ operating under the Prime Minister's Office, complemented by an apex ‘Data Governance Board’ chaired directly by the Prime Minister. During the transition phase, the ICT Division has been entrusted with formulating the foundational rules, enforcement mechanisms, and administrative instruments.

Addressing enterprise integration architectures, the Secretary clarified: "Stakeholders frequently query whether national data will be concentrated into a single monolithic database. That will not occur. We are deploying a federated framework. Consolidating all citizen registries into a single system introduces an untenable Single Point of Failure (SPOF). Instead, sovereign and private data siloes will remain distributed, securely cross-referenced via an interoperability protocol strictly on an authorized, need-to-know basis."

He issued a stern advisory against enterprise over-collection: "Entities often harvest ten operational fields when their core service requires merely two. This practice must cease immediately. Data defense cannot rely solely on statutes; organizations must formulate precise, actionable SOPs to execute containment before a breach occurs." He pledged direct seed funding and venture grants from the ICT Division to incubate scalable privacy solutions engineered by the competition's university cohorts.

Enforcing Strict Lineage Audits and National AI Data Centers: BTRC

 Commissioner Reinforcing the multi-tier governance model, BTRC Commissioner Brigadier General Shahzad Pervez Mohiuddin affirmed that sectoral regulators must issue complementary operational guidelines within the broader parameters set by national authorities.

"Telecommunications constitutes critical national infrastructure. Telco operators handle vastly more than simple routing—they process SIM identities, real-time location telemetry, billing footprints, metadata, and biometrics. With deep AI deployment across churn prediction, e-KYC, and automated marketing, systemic risks surrounding algorithmic bias, unauthorized extraction, and third-party vendor leaks multiply," the Commissioner observed.

He outlined an eight-point operational compliance directive for telcos, ordering the deployment of comprehensive Data Lineage Frameworks, mandatory Algorithmic Risk Assessments, Zero-Trust access topologies, and localized tokenization. Importantly, he noted that as millions of citizens navigate telecom services without smartphones, privacy interfaces cannot remain exclusive to smartphone applications; operators must engineer transparent privacy controls utilizing Bangla voice prompts and USSD access tiers. He further advocated the expedited construction of sovereign National AI Data Centers to guarantee national data sovereignty.

Breaches Are Not Hypothetical, But Inevitable: Axiata Group CRCO

Providing a multinational security perspective, Axiata Group Chief Risk and Compliance Officer Abid Abdul Adam emphasized that data breaches represent an inevitable operational certainty rather than a speculative contingency. "The first few hours of a cyber incident are marked by systemic operational panic. Shutting down compromised nodes triggers severe Quality of Service (QoS) degradation, while capitulating to ransomware extortions introduces compounding regulatory and existential liabilities," he observed.

Adam highlighted that Axiata Group instituted mandatory Minimum Baseline Security Standards (NBSS) across all regional operating companies as early as 2017. He urged corporate boards to execute periodic, unannounced incident response simulations to develop operational "muscle memory." He also cautioned regulators against engineering hyper-complex, multi-page consent gateways that alienate regular mobile subscribers, advocating instead for simplified, transparent consent architectures.

Robi Deploys Granular Consent Portals & Role-Based Access: CEO Ziad Shatara

Concluding the deliberations, Robi Axiata PLC Managing Director and CEO Ziad Shatara maintained that data governance forms the foundational currency of sustainable digital enterprise. "Robi is actively deploying a next-generation Consent Management System, enabling mobile subscribers to independently audit, grant, or revoke permissions concerning their personal data storage and behavioral processing," Shatara announced.

Addressing internal governance, the Robi CEO explained: "We enforce strict Role-Based Access Control (RBAC). Customer data is classified into rigorous hierarchies; if an employee or automated pipeline does not strictly require a data attribute to deliver an outcome, access is algorithmically denied. Furthermore, every internal query creates an immutable audit trail. Crucially, third-party cloud vendors and support contractors are held to identical, legally binding data-protection covenants before interfacing with our ecosystem."

The event culminated with the presentation of awards to the top 10 university teams of 'Privacy Avengers 2026', alongside week-long internal sensitization drives executed across Robi's distributor networks, corporate call centers, and supply chain partners, official sources confirmed.

//DBTech/IH/SMP/MVNO//