Support Centre

Pakistan

Summary

Law: There is no general personal data protection law.

Regulator: There is no general data protection authority.

Summary: There is no general personal data protection law. The Prevention of Electronic Crimes Act, 2016 ('PECA') is currently the primary legislation that provides a legal framework in relation to various kinds of electronic crimes and also extends to the unauthorised access to personal data. The Ministry of Information Technology and Telecommunication ('MITT') has published several consultation drafts for a data protection bill. The most recent draft, the Personal Data Protection Bill, 2023 ('the Bill'), was released in May 2023. Notably, the MITT published its Pakistan Cloud First Policy on 18 February 2022, outlining guidelines and solutions for cloud services

Insights

Countries across the APAC region have been introducing comprehensive data protection laws and/or updating existing legislation to ensure personal data is protected in the digital era. OneTrust DataGuidance provides an overview of the status of current privacy/data protection bills in Australia, Brunei Darussalam, India, Malaysia, Mongolia, Myanmar, Pakistan, Sri Lanka, Thailand, and Vietnam.

The Ministry of Information Technology and Telecommunications ('MOITT') introduced, on 18 February 2022, the Pakistan Cloud First Policy ('the Cloud Policy'). The Cloud Policy aims to foster the adoption of cloud solutions and guide the regulation of cloud policy in Pakistan. OneTrust DataGuidance breaks down the key provisions of the Cloud Policy.

The Federal Cabinet of Pakistan has approved the draft of the Personal Data Protection Bill 2021 ('the Draft Bill') developed by the Ministry of Information Technology and Telecommunication. The next step is the Draft Bill being placed before the National Assembly and Senate of Pakistan for debate, consideration, and adoption. Thereafter, the same will be promulgated as a law. Saifullah Khan and Saeed Hasan Khan, Partners from S.U.Khan Associates Corporate & Legal Consultants, discuss the practical steps that the National Commission for Personal Data Protection ('the Commission'), as well as data controllers and processors, must take in order to implement and comply with the Draft Bill.

The Ministry of Information Technology and Telecommunications ('MOITT') is entrusted with the development of a law on personal data protection. In April 2020, the MOITT issued a consultation draft of the Personal Data Protection Bill 2020 ('the 2020 Draft') and, based upon this consultation, a revised draft was issued in August 2021 ('the 2021 Draft'). Saeed Hasan Khan and Saifullah Khan, from S.U.Khan Associates Corporate & Legal Consultants, survey the significant changes brought in by the 2021 Draft, as compared to the 2020 Draft.

Feedback