Pakistan's Personal Data Protection Bill: Two Decades of Delay and What Businesses Should Do Now

Pakistan's digital economy has expanded at a pace few could have anticipated a decade ago. E-commerce platforms process millions of transactions daily. Fintech startups handle customer financial data at scale. Telecommunications operators manage subscriber information across hundreds of millions of connections. Healthcare providers, retailers, and financial institutions across the country routinely collect, process, and store vast troves of personal data. Yet for all this explosive digital growth, Pakistan remains one of the very few countries in Asia without a comprehensive, enacted data protection statute. This gap is not accidental—it reflects two decades of legislative stalling, institutional conflict, and fundamentally conflicting views about surveillance, privacy, and state authority.

The Digital Economy Without Legal Safeguards

Pakistan's digital landscape has transformed entirely. The number of internet users exceeded 200 million by 2024. Mobile banking penetration reaches consumers in rural areas where branch banking never did. E-commerce giants operate warehouses nationwide. Yet this infrastructure rests on an astonishing foundation: personal data collected and processed without dedicated legal protection. A Pakistani citizen buying goods online, opening a digital wallet, or requesting a loan through a fintech platform has no statutory right to know what data is collected, how it is used, or where it is stored. No law requires explicit consent before data processing. No authority exists to whom they can appeal for a breach. No data controller faces a statutory duty to notify affected individuals if their data is compromised.

This regulatory vacuum creates two parallel problems. First, multinational companies operating in Pakistan—payment processors, cloud providers, consultants—must comply with GDPR, the California Consumer Privacy Act, or other jurisdictions' laws when handling Pakistani personal data. These external obligations frequently exceed what Pakistani law requires domestically, creating a bizarrely inverted situation where international customers enjoy stronger protections than local ones. Second, domestic Pakistani businesses operate without clear rules. Some adopt rigorous international standards voluntarily; others treat personal data with negligence or indifference. The market cannot effectively distinguish between responsible and careless data handlers because no legal baseline exists to enforce compliance.

Twenty Years of Legislative Failure

The absence of data protection law is not due to oversight. Pakistani lawmakers have attempted to fill this gap repeatedly since the mid-2000s.

The first serious attempt came in 2005, when discussions began on an Electronic Data Protection Act modelled loosely on international precedent. These conversations stretched across several years without yielding a bill. In 2018, work resumed when a draft Personal Data Protection Bill was circulated by the Ministry of Information Technology and Telecommunications (MOITT). The 2018 draft proposed a framework along European lines: a data protection authority, controller obligations, rights of data subjects including access and rectification, and restrictions on cross-border transfers. It died without legislative action.

By 2020, another draft emerged. This version incorporated feedback from the 2018 iteration and refined definitions and enforcement mechanisms. Again, the bill stalled in committee. The pattern repeated in May 2023 when MOITT released a final draft Personal Data Protection Bill after consultations with industry, civil society, and international advisors. The 2023 draft was comprehensive: approximately 100 articles covering data controller licensing, consent mechanisms, data protection impact assessments, and penalties for non-compliance. It went nowhere legislatively.

Most recently, in 2025, a Personal Data Protection Act draft circulated in parliament, carrying elements from all previous attempts. As of early 2026, this bill remains pending. No data protection law has been enacted.

Current Draft Provisions: What the Bill Would Actually Require

The most recent draft (2025) provides a useful baseline for understanding what Pakistan's data protection framework would require once enacted. It defines a data controller as any entity determining purposes and means of data processing, and a data processor as an entity processing data on behalf of a controller. This distinction mirrors the GDPR approach.

The draft imposes core obligations on data controllers. They must obtain prior written consent from data subjects before collecting or processing personal data, except where processing is necessary for legal compliance, protection of life or safety, or performance of a contractual obligation. Controllers must implement security safeguards proportionate to the sensitivity of data handled. They must register with a proposed Data Protection Authority (DPA) and conduct privacy impact assessments for high-risk processing activities.

Data subjects would gain statutory rights. These include the right of access to personal data held by controllers; the right to rectification of inaccurate or incomplete data; the right to erasure ("right to be forgotten") in certain circumstances; the right to object to processing for direct marketing; and the right to lodge complaints with the DPA. The draft creates a duty to notify data subjects of breaches causing high risk of harm without undue delay.

Cross-border transfers of personal data would require explicit legal basis. The draft restricts transfers to countries that offer adequate protection—a principle borrowed directly from GDPR—or permits transfers only where contractual clauses impose equivalent safeguards. A data controller wishing to outsource processing to a cloud provider in Singapore or the United States would need contractual assurances and likely DPA approval.

The proposed Data Protection Authority would be an independent statutory body empowered to investigate complaints, conduct audits, and impose penalties. Violations would attract fines up to 4% of annual revenue or a fixed amount (typically several million rupees), whichever is greater.

Why the Bill Has Stalled: Politics, Turf Wars, and Surveillance

Twenty years of legislative failure do not reflect lack of effort; they reflect genuine institutional resistance and competing policy priorities.

The first obstacle is jurisdictional conflict within government. MOITT has driven the legislative agenda, but other agencies—particularly the Federal Investigation Agency (FIA) and intelligence services—view comprehensive data protection rules as constraints on their investigative and surveillance capabilities. A statutory ban on processing personal data without consent, or restrictions on cross-border transfers, could impede counter-terrorism operations or financial crime investigations. Intelligence and law enforcement actors have historically resisted data protection laws that mandate warrants or judicial oversight for bulk data access. Pakistan's experience with this dynamic mirrors tensions globally, but the political weakness of privacy advocates in Pakistan gives security arguments decisive weight.

A second obstacle is opposition from private members who question whether a centralized Data Protection Authority represents sound governance. Some lawmakers have viewed MOITT's draft as expanding bureaucratic control and regulatory burden without clear public benefit. This opposition manifests as procedural delays: the bill is not controversial enough to trigger outright rejection, yet not politically urgent enough to bypass procedural steps. It sits in committee, awaiting prioritization.

Third, the technology sector itself is divided. Multinational corporations with headquarters in jurisdictions subject to GDPR or similar laws support Pakistan's adoption of data protection law—it harmonizes their global compliance obligations and levels the playing field with competitors who already comply with rigorous standards. Domestic Pakistani technology and fintech firms, however, have sometimes expressed concern about compliance costs, particularly smaller companies that lack dedicated data protection infrastructure. This internal division weakens the political case for swift legislative action.

Finally, data protection lacks the political salience of issues like taxation, infrastructure, or security. Pakistan's legislative agenda is crowded with urgent matters: energy crises, fiscal stabilization, terrorism prevention. Data protection is simultaneously complex and invisible to mass politics. Few citizens currently experience the harm of data misuse acutely enough to demand legislative action. By the time a major breach or abuse surfaces, political momentum has typically dissipated.

Existing Protections: Piecing Together a Fragmented Legal Framework

Until a dedicated data protection statute is enacted, businesses and individuals must navigate a fragmented patchwork of existing laws that provide partial—and inconsistent—protection.

The Prevention of Electronic Crimes Act (PECA), 2016 criminalizes unauthorized access to data and systems. Section 14 specifically penalizes breaching the privacy of data through unauthorized access, imposing imprisonment and fines. However, PECA applies only to criminal conduct; it does not create a civil remedy for individuals harmed by data misuse, nor does it impose affirmative data protection duties on legitimate businesses.

The Constitution of the Islamic Republic of Pakistan, Article 14, recognizes the inviolability of the dignity of man and privacy of the home. Pakistani courts have interpreted this as a fundamental right to privacy, though jurisprudence on data privacy specifically remains underdeveloped. A data breach affecting thousands of individuals has never been litigated to finality under Article 14; the precedent remains uncertain.

For telecommunications operators, the Pakistan Telecommunication Authority (PTA) licensing conditions incorporate data protection requirements. Operators must maintain customer confidentiality and implement security standards. However, these licensing conditions are negotiated case-by-case and vary in stringency. They are not statutory.

Financial institutions—banks, microfinance banks, payment service providers—fall under State Bank of Pakistan (SBP) regulations mandating security standards for consumer data and transaction records. The SBP's Prudential Regulations and Branchless Banking regulations impose obligations analogous to data protection laws, but their scope is limited to the financial sector. A healthcare provider, an e-commerce platform, or a SaaS company faces no comparable statutory requirements.

This fragmented framework creates legal uncertainty. A business in Pakistan cannot rely on a single comprehensive statute to understand its obligations. Instead, it must consult PECA (criminal), constitutional principles (civil), licensing conditions (regulatory), sector-specific regulations (SBP, PTA), and potentially international standards (if processing data of EU residents or US customers). Compliance becomes an interpretive exercise rather than a matter of following clear statutory rules.

FATF Implications and International Pressure

Pakistan's weak data protection framework carries consequences beyond privacy. The Financial Action Task Force (FATF), which monitors global compliance with anti-money laundering and counter-terrorist financing standards, has flagged data governance as a material weakness. Pakistan's greylist status—as of early 2026—depends in part on demonstrating effective financial crime controls. Those controls require reliable data management: financial institutions must track beneficial ownership information, transaction patterns, and suspicious activity with accuracy and integrity. Inadequate data protection standards undermine these capabilities.

More broadly, international business partners—particularly in financial services, payment processing, and digital commerce—are increasingly reluctant to establish operations or move operations to jurisdictions with weak data protection. A bank in New York or London cannot delegate customer data processing to a Pakistani service provider without GDPR-compliant safeguards; if Pakistan lacks a domestic data protection framework, contractual protections become the sole recourse, and those protections are only as good as the ability to sue for breach in Pakistani courts (notoriously slow and uncertain). This regulatory gap makes Pakistan a less attractive hub for technology, fintech, and shared services operations than it might otherwise be. Jurisdictions like India and the Philippines have gained competitive advantage partly because they enacted data protection laws that international companies can rely on.

What Businesses Should Do Now: Voluntary Compliance and Risk Mitigation

The absence of enacted data protection law does not absolve businesses of responsibility. A prudent approach involves voluntary adoption of international standards, even where not legally mandated in Pakistan.

First, map your data. Conduct a comprehensive audit of what personal data your business collects, from whom, how it is processed, where it is stored, who has access, and whether it is transferred internationally. This exercise—a data inventory—is a foundational compliance practice and is explicitly required under GDPR, the proposed Pakistani bill, and most modern data protection regimes. Many Pakistani businesses have never done this audit and are unaware of how much personal data they hold or how it flows through their systems.

Second, develop and publish a privacy policy aligned with international standards, particularly GDPR. The policy should transparently disclose what data is collected, the legal basis for processing, how long it is retained, who it is shared with, and what rights individuals have. This policy should be publicly accessible and updated as practices change. GDPR provides an excellent template, and adapting GDPR language to a Pakistani context creates a policy defensible in Pakistani courts and intelligible to international partners.

Third, implement a breach notification procedure. Establish a process for identifying data breaches, documenting the scope and cause, notifying affected individuals without undue delay (48 hours is the GDPR standard; this is reasonable as best practice), and cooperating with relevant authorities. Many Pakistani businesses lack any formal breach response procedure; data breaches are discovered by accident, managed informally, and concealed from affected parties. Formalizing this process protects both individuals and your organization.

Fourth, conduct privacy impact assessments for high-risk processing. Where your business processes sensitive data (health information, financial details, identity numbers), or processes data about vulnerable populations (children, the elderly), or uses automated decision-making, engage with the risks explicitly. An assessment need not be lengthy; a structured document identifying risks, mitigation measures, and residual risks demonstrates professional risk management and is valuable if your practices are ever challenged.

Fifth, use contractual safeguards when outsourcing data processing. If you engage a third-party service provider (a cloud vendor, a payment processor, an HR platform) to handle personal data, the contract should explicitly govern how that vendor may use the data, what security measures they must implement, how they will assist you in responding to data subject requests, and whether they may sub-contract processing to others. These Data Processing Agreements (DPAs) are standard under GDPR and are increasingly expected by multinational businesses.

Sixth, implement appropriate technical and organizational security measures. These should be proportionate to the sensitivity of the data and the scale of processing. For a small business, this might mean encrypted databases, access controls, and staff training. For a larger organization handling highly sensitive data, it might require encryption in transit and at rest, multi-factor authentication, regular penetration testing, and a dedicated information security team. The Pakistani draft bill requires such measures; treating them as best practice now positions your business well for future compliance.

The Role of Legal Counsel: Preparing for the Inevitable

The data protection bill will eventually be enacted. Pakistani legislators have attempted this for two decades; the only uncertainty is timing, not inevitability. When the bill passes, businesses that have prepared voluntarily will face minimal disruption. Those that have ignored the issue will face rapid, costly adaptation.

Engaging legal counsel now—particularly counsel with experience in both Pakistani and international data protection law—serves multiple purposes. It clarifies your current data practices, identifies gaps and risks, positions your business as a responsible handler of personal data, and establishes a documented compliance foundation that demonstrates good faith to future regulators. If the Data Protection Authority is eventually established and begins enforcement actions, early voluntary compliance is a powerful mitigating factor.

Expertise

Insights & Tools