Data protection & privacy law in Pakistan (2026)
Data protection in Pakistan: proposed.
Pakistan currently lacks an enacted, comprehensive personal data protection statute. The Personal Data Protection Bill, originally drafted in 2023 and revised in 2025, received Federal Cabinet approval but has not been passed by Parliament, leaving personal data governed by a patchwork of sectoral rules under the SBP, PTA, and the Prevention of Electronic Crimes Act. A proposed National Commission for Personal Data Protection would serve as the dedicated supervisory authority only upon the Bill's enactment.
Legal framework
No comprehensive data protection law in force; Personal Data Protection Bill (2023 draft, revised 2025) pending parliamentary enactment; interim sectoral coverage via Prevention of Electronic Crimes Act 2016 (as amended 2025), State Bank of Pakistan (SBP) frameworks, and Pakistan Telecommunication Authority (PTA) regulations
Key points: data & privacy in Pakistan
Pending Comprehensive Bill
The Personal Data Protection Bill (PDPB 2023, revised as a 2025 draft) was approved by Pakistan's Federal Cabinet and introduced in Parliament, but has not received parliamentary or presidential assent. It was returned to the Ministry of IT and Telecommunication after procedural objections regarding how it was introduced, stalling enactment as of May 2026.
Proposed Supervisory Authority
The Bill proposes establishing a National Commission for Personal Data Protection of Pakistan as the dedicated national regulator. Until enactment, no single national supervisory authority exists; the SBP and PTA exercise sector-specific data oversight in finance and telecoms respectively.
Constitutional Privacy Basis
Article 14(1) of Pakistan's Constitution renders the dignity of man and privacy of home inviolable. Superior courts have extended this protection to communications and data, providing an implicit constitutional basis for privacy rights in the absence of a dedicated statute.
PECA as Primary Data/Cybercrime Law
The Prevention of Electronic Crimes Act 2016 (PECA), amended in 2025, currently serves as the principal legislation touching data protection, covering unauthorised access to personal data and confidentiality of information. The 2025 amendment expanded content regulation and government surveillance powers under Sections 31-32 but introduced no new data protection obligations.
Sectoral Regulators Fill the Gap
The State Bank of Pakistan issues data-handling and IT compliance frameworks for banks and financial institutions, while the PTA regulates telecom network data and interception. These sector-specific regimes currently constitute the operative data governance framework for their respective industries.
State Exemptions and Civil Society Concerns
The draft Bill contains broad carve-outs for 'national security,' 'public interest,' and 'legitimate interest,' and largely exempts state agencies from its obligations. Analysts at LUMS and Privacy International have flagged these provisions as enabling surveillance and undermining accountability, casting doubt on the Bill's adequacy even if enacted.
Sources
- moitt.gov.pk/SiteImage/Misc/files/Final%20Draft%20Personal%20Data%20Protection%20B
- iclg.com/practice-areas/data-protection-laws-and-regulations/pakistan
- dlapiperdataprotection.com/index.html?t=law&c=PK
- privacyinternational.org/state-privacy/1008/state-privacy-pakistan
- ibanet.org/data-privacy-and-protection-in-Pakistan
- thefridaytimes.com/17-Mar-2025/peca-2025-digital-governance-or-a-missed-opportunity-for-
- sahsol.lums.edu.pk/node/25604
- lexmundi.com/guides/data-privacy-guide/jurisdictions/asia-pacific/pakistan/
- thefridaytimes.com/11-Dec-2025/data-privacy-peril-pakistan-s-legal-vacuum-consequences
Next for Pakistan: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026