--- title: "Pakistan Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/pakistan/ source_html: /jurisdictions/pakistan/index.html description: "Pakistan data protection and privacy regulation: 10 categories, 35 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border…" generated_at: 2026-11-07T14:58:19Z content_sha256: 1a7fe212d385751ece901426ff94d27d5bc36904afa7189310c2ce200b390e5f generator: "fe-fleet/md-twin@1.0" --- # Pakistan Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/pakistan/), [World Payments](https://payments.gi/jurisdictions/pakistan/), artificial-intelligence Last updated 2026-10-25 · 10 categories · 35 claims · 29 sources in the cumulative register Download report (PDF) Expand all Pakistan's Ministry of Information Technology and Telecommunications, together with the Pakistan Digital Authority, held a high-level meeting to finalise the draft National Data Governance Policy 2026 ahead of cabinet approval and gazette notification, following the close of consultation on 10 July 2026. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: AdTech & Commercial Privacy. Not fully checked this cycle: Regulator & Framework, Controller/Processor Duties (3 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=PAKISTAN)[Build Report](/reports/?j=PAKISTAN)[Compare](/compare/?j=PAKISTAN) Framework posture Unregulated gap 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Ministry of Information Technology and Telecommunication (MoITT) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed 10 Categories 8 Red categories 57 Sub-modules 35 Claims 7 Tier-1 sources Traffic-light mix 8 red 1 amber 1 n/a (sums to 10 rendered categories; click to filter) 8 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 780 Full executive summary 129 ###### Latest update · 25 October 2026 #### Lead Signal Pakistan has no enacted general data-protection statute, and that standing gap continues to shape the jurisdiction's data-protection profile more than any single development this period. The two live signals sit at the margins of the gap rather than inside it: civil-society reporting has raised transparency concerns around a Google-Pakistan government agreement, and adjacent cybercrime enforcement activity under the amended Prevention of Electronic Crimes Act continued with a reported remand extension in a journalist's case. Neither development touches a dedicated data-protection authority or statute, because none exists. #### Other Developments Civil-society scrutiny of a government-platform data arrangement. Freedom Network's September 2026 digital-rights monitor reported calls for transparency around an agreement between Google and the Pakistani government, with concerns raised about surveillance and the potential for unrestricted access to citizens' personal information. This is reported through a single civil-society source and has not been independently corroborated by an official government statement, so it is presented here as reported concern rather than a confirmed arrangement or its confirmed terms. Continued NCCIA enforcement activity under amended PECA. The same monitor reported that an Islamabad court extended the physical remand of journalist Bilal Ghauri by two days in a case registered by the National Cyber Crime Investigation Agency under the Prevention of Electronic Crimes Act. This is adjacent cybercrime enforcement activity, not data-protection-specific enforcement, since Pakistan has no data-protection authority empowered to bring such an action; it is noted here because it illustrates the kind of enforcement apparatus now operating in the space a dedicated data-protection regulator would otherwise occupy. #### Cross-Monitor Connections The enforcement activity under the amended Prevention of Electronic Crimes Act and the National Cyber Crime Investigation Agency's role in it connects to the financial-integrity monitor's tracking of a separate Federal Investigation Agency action against an alleged unlicensed online betting network, insofar as both actions proceed under general cyber and financial-crime statutes in the absence of dedicated sectoral regimes. The crypto monitor separately tracks the Pakistan Virtual Assets Regulatory Authority's newly operative licensing regime, which carries its own AML/CFT/CPF conduct standards; none of that regime addresses personal-data handling obligations, which remain entirely outside statutory coverage in Pakistan regardless of sector. #### Outlook The status of the draft Personal Data Protection Bill, 2023 beyond Senate Standing Committee discussion has not been confirmed since 21 August 2026, and no dated legislative timeline for its enactment exists in the record. Until a general data-protection statute is enacted, the pattern evident this period, civil-society concern operating alongside adjacent cybercrime enforcement rather than any dedicated data-protection mechanism, is likely to continue to define how data-handling concerns in Pakistan surface and are addressed. ###### Standing brief · as of 23 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Pakistan's Ministry of Information Technology and Telecommunications, together with the Pakistan Digital Authority, held a high-level meeting to finalise the draft National Data Governance Policy 2026 ahead of cabinet approval and gazette notification, following the close of consultation on 10 July 2026. This is a policy-track instrument distinct from the stalled Personal Data Protection Bill, and its advancement is the most recent development in Pakistan's data-protection enforcement and redress landscape. #### Other Developments The Prevention of Electronic Crimes Act remains the operative enforcement lever in the absence of a dedicated data-protection regulator. Section 16 of PECA bans obtaining or selling another person's identity information without consent, but provides few positive rights, and is enforced by the Federal Investigation Agency's cybercrime wing rather than by any dedicated data-protection authority. This general cybercrime enforcement channel remains the practical mechanism through which data-misuse conduct is addressed in Pakistan while the National Data Governance Policy and the Personal Data Protection Bill both remain outside statutory force. #### Cross-Monitor Connections The advancement of the National Data Governance Policy 2026 and the continued reliance on PECA's cybercrime provisions are domestic developments; this cycle's claim set does not evidence a nexus to financial-integrity, payments, gambling-regulatory, or crypto-monitor findings for Pakistan's enforcement and redress posture specifically, though readers tracking Pakistan's broader digital-regulation environment across monitors should note that the absence of a dedicated data-protection regulator is a structural feature relevant to any monitor assessing Pakistan's institutional capacity generally. #### Outlook The development to watch is whether the National Data Governance Policy 2026 proceeds to cabinet approval and gazette notification, and whether it is designed to substitute for, or to precede, statutory data-protection coverage that the stalled Personal Data Protection Bill has not delivered. Until either instrument is enacted, enforcement and redress for data-misuse conduct in Pakistan will continue to run through the Federal Investigation Agency's cybercrime wing under PECA rather than through any dedicated data-protection mechanism. Read full brief · 780 words Standing brief, as of 23 August 2026. #### Regulatory Status Pakistan has no comprehensive data-protection statute in force. Enforcement and redress for data-misuse conduct runs through Section 16 of the Prevention of Electronic Crimes Act, enforced by the Federal Investigation Agency's cybercrime wing, in the absence of a dedicated data-protection regulator. This cycle's material development is policy-track rather than statutory: the Ministry of Information Technology and Telecommunications and the Pakistan Digital Authority held a high-level meeting to finalise the draft National Data Governance Policy 2026 ahead of cabinet approval and gazette notification, following consultation close on 10 July 2026. #### Outlook Whether the National Data Governance Policy 2026 is gazetted, and whether it substitutes for or precedes statutory data-protection coverage, remains the central open question for Pakistan's enforcement and redress posture. Read full brief · 129 words Key regulatory facts for Pakistan Regulatory Dimension Pakistan Standing Position Jurisdiction Pakistan (PK) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 35 sourced findings) Regulator & Framework No enacted comprehensive data-protection statute and no independent supervisory authority exist; only unenacted drafts and a sectoral cybercrime law are in play. Lawful Processing & Special Data All lawful-basis and special-category provisions exist only in unenacted draft form; no in-force consent or sensitive-data regime. Data Subject Rights All data subject rights provisions are proposal-stage only; none in force. Controller/Processor Duties Core accountability infrastructure (DPIA, DPO, ROPA, breach notification, retention) exists only in unenacted draft form. Primary Instruments Cited Government of Pakistan, MoITT, MoITT, MoITT, Recording Law Last Confirmed / Updated 2026-10-25 (29 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Pakistan: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No enacted comprehensive data-protection statute and no independent supervisory authority exist; only unenacted drafts and a sectoral cybercrime law are in play. Supervisory authority [Ministry of Information Technology and Telecommunication (MoITT)](https://moitt.gov.pk/) Traffic-light rationale — Red No enacted comprehensive data-protection statute and no independent supervisory authority exist; only unenacted drafts and a sectoral cybercrime law are in play. #### Sub-modules (5) #### Regulator And AuthorityRed No independent DPA exists; MoITT is the de facto adjacent competent body pending enactment of a data-protection commission/authority proposed in successive drafts. Claims (4): - Pakistan has no independent dedicated data protection authority; the Ministry of Information Technology and Telecommunication (MoITT) holds adjacent competence pending enactment of a comprehensive data-protection law. - National Commission for Personal Data Protection (proposed) — envisaged, no statutory basis - Ministry of Information Technology and Telecommunication (MoITT) — No independent data-protection authority exists in Pakistan; the proposed National Commission for Personal Data Protection would be established only once the Personal Data Protection Bill is enacted - Ministry of Information Technology and Telecommunication (MoITT) — Pakistan has no independent, operational data-protection supervisory authority; the proposed National Commission for Personal Data Protection is not yet established. #### Act And InstrumentsRed Multiple unenacted PDPB drafts (2018/2020/2021/2023) exist alongside the in-force PECA 2016, which is sectoral cybercrime legislation, not a data-protection instrument. Claims (4): - MoITT has circulated multiple drafts of a Personal Data Protection Bill (2018, 2020, 2021, and a Final Draft dated May 2023) without enactment into law as of the current verified status. - The Prevention of Electronic Crimes Act, 2016 (PECA) is an in-force statute addressing unauthorized access to data and cybercrime, but it does not constitute a comprehensive data-protection regime. - Personal Data Protection Bill — Has not passed both houses of Parliament as of September 2026; PECA 2016 as amended January 2025 remains the operative criminal-law instrument addressing data misuse - Personal Data Protection Bill — The Bill has completed consultation and received an earlier Federal Cabinet approval but, as of October 2026, has not passed both houses of Parliament. #### Material ScopeRed Proposed material scope under the 2021 draft extends to processing of personal data throughout Pakistan; not currently operative. Claims (1): - The 2021 consultation draft of the Personal Data Protection Bill proposes that the Act extend to the whole of Pakistan, covering processing of personal data by controllers and processors. #### Territorial ScopeRed The May 2023 draft proposes extraterritorial application concepts (e.g., 'significant' controller/processor designation, application of Pakistani law under international law principles), but this remains proposal-stage only. Claims (1): - The May 2023 draft bill proposes extraterritorial-style application concepts, including designation of 'significant' data controllers/processors and application of Pakistani law under public or private international law principles, but this remains unenacted proposal text. #### Regulator Registration And FilingRed Draft bills propose establishment of a statutory Commission/Authority with registration-fee provisions; no registration/filing regime is currently operative. Claims (1): - Successive drafts (2020 update) propose establishment of a statutory Personal Data Protection Authority/Commission with registration-fee collection powers, but no such body or filing regime is currently operative. Pakistan has no independent dedicated data protection authority. The Ministry of Information Technology and Telecommunication (MoITT) holds adjacent competence and has circulated multiple drafts of a Personal Data Protection Bill (2018, 2020, 2021, and a Final Draft dated May 2023) without any version being enacted into law as of the current verified status (2026-08-07). The Prevention of Electronic Crimes Act, 2016 (PECA) is the only in-force statute touching personal data, but it addresses cybercrime/unauthorized access rather than comprehensive data protection. Sources and claims (11) - [Government of Pakistan](https://moitt.gov.pk/) — Pakistan has no independent dedicated data protection authority; the Ministry of Information Technology and Telecommunication (MoITT) holds adjacent competence pending enactment of a comprehensive data-protection law. - [MoITT](https://moitt.gov.pk/SiteImage/Misc/files/Final%20Draft%20Personal%20Data%20Protection%20Bill%20May%202023.pdf) — MoITT has circulated multiple drafts of a Personal Data Protection Bill (2018, 2020, 2021, and a Final Draft dated May 2023) without enactment into law as of the current verified status. - [MoITT](https://moitt.gov.pk/SiteImage/Misc/files/25821%20DPA%20Bill%20Consultation%20Draft(1).pdf) — The Prevention of Electronic Crimes Act, 2016 (PECA) is an in-force statute addressing unauthorized access to data and cybercrime, but it does not constitute a comprehensive data-protection regime. - [MoITT](https://moitt.gov.pk/SiteImage/Misc/files/25821%20DPA%20Bill%20Consultation%20Draft(1).pdf) — The 2021 consultation draft of the Personal Data Protection Bill proposes that the Act extend to the whole of Pakistan, covering processing of personal data by controllers and processors. - [MoITT](https://moitt.gov.pk/SiteImage/Misc/files/Final%20Draft%20Personal%20Data%20Protection%20Bill%20May%202023.pdf) — The May 2023 draft bill proposes extraterritorial-style application concepts, including designation of 'significant' data controllers/processors and application of Pakistani law under public or private international law principles, but this remains unenacted proposal text. - [MoITT](https://moitt.gov.pk/SiteImage/Downloads/Personal%20Data%20Protection%20Bill%202020%20Updated.pdf) — Successive drafts (2020 update) propose establishment of a statutory Personal Data Protection Authority/Commission with registration-fee collection powers, but no such body or filing regime is currently operative. - [Recording Law](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/pakistan-data-privacy-laws/) — National Commission for Personal Data Protection (proposed) — envisaged, no statutory basis - [Cybersilo](https://cybersilo.tech/pakistan-personal-data-protection-act) — Ministry of Information Technology and Telecommunication (MoITT) — No independent data-protection authority exists in Pakistan; the proposed National Commission for Personal Data Protection would be established only once the Personal Data Protection Bill is enacted - [Chambers and Partners](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/pakistan) — Personal Data Protection Bill — Has not passed both houses of Parliament as of September 2026; PECA 2016 as amended January 2025 remains the operative criminal-law instrument addressing data misuse - [Recording Law](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/pakistan-data-privacy-laws/) — Ministry of Information Technology and Telecommunication (MoITT) — Pakistan has no independent, operational data-protection supervisory authority; the proposed National Commission for Personal Data Protection is not yet established. - [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=law&c=PK) — Personal Data Protection Bill — The Bill has completed consultation and received an earlier Federal Cabinet approval but, as of October 2026, has not passed both houses of Parliament. ### Pakistan: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ All lawful-basis and special-category provisions exist only in unenacted draft form; no in-force consent or sensitive-data regime. Supervisory authority [Ministry of Information Technology and Telecommunication (MoITT)](https://moitt.gov.pk/) Traffic-light rationale — Red All lawful-basis and special-category provisions exist only in unenacted draft form; no in-force consent or sensitive-data regime. D2 · Lawful Processing — Full Module Record 4 sub-modules · 63 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Pakistan: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Probable▾ All data subject rights provisions are proposal-stage only; none in force. Supervisory authority [Ministry of Information Technology and Telecommunication (MoITT)](https://moitt.gov.pk/) Traffic-light rationale — Red All data subject rights provisions are proposal-stage only; none in force. #### Sub-modules (5) #### Access RightRed May 2023 draft includes 'Right to access' and 'Compliance with the data access request' provisions, unenacted. Claims (1): - The May 2023 draft bill includes proposed 'Right to access' and 'Compliance with the data access request' provisions, not yet enacted. #### Rectification And ErasureRed 2020 and 2021 drafts propose erasure rights, including a 14-day erasure window and an undue-delay erasure standard; unenacted. Claims (2): - The 2020 updated draft proposes that data controllers erase personal data within a period of 14 days where specified conditions are met. - Draft bill text provides that a data subject shall have the right to obtain from the data controller the erasure of personal data concerning him without undue delay. #### Restriction And ObjectionRed Draft text proposes a 'right to prevent processing likely to cause damage or distress,' an objection-style right; unenacted. Claims (1): - Draft bill text includes a proposed 'right to prevent processing likely to cause damage or distress,' functioning as an objection-style right. #### Data PortabilityRed No explicit data-portability right was identified in any reviewed draft bill text (2018/2020/2021/2023). Absent-field provenance: reviewed all four MoITT draft PDFs' indexed section titles with no portability provision located. #### Deadlines And Response WindowsRed The 2021 draft proposes a 30-day response window for data-correction requests; unenacted. Claims (1): - The 2021 draft proposes that a data controller satisfied that a data correction request is warranted must act not later than thirty days from the date of receipt of the request. No enacted subject-access, correction, erasure, objection, or portability regime exists. Draft bills propose access, correction (30-day response window per the 2021 draft), erasure (14-day window per the 2020 draft), and an objection-style 'right to prevent processing likely to cause damage or distress.' No explicit data-portability right was located in any reviewed draft. Sources and claims (5) - [MoITT](https://moitt.gov.pk/SiteImage/Misc/files/Final%20Draft%20Personal%20Data%20Protection%20Bill%20May%202023.pdf) — The May 2023 draft bill includes proposed 'Right to access' and 'Compliance with the data access request' provisions, not yet enacted. - [MoITT](https://moitt.gov.pk/SiteImage/Downloads/Personal%20Data%20Protection%20Bill%202020%20Updated.pdf) — The 2020 updated draft proposes that data controllers erase personal data within a period of 14 days where specified conditions are met. - [MoITT](https://moitt.gov.pk/SiteImage/Misc/files/25821%20DPA%20Bill%20Consultation%20Draft(1).pdf) — Draft bill text provides that a data subject shall have the right to obtain from the data controller the erasure of personal data concerning him without undue delay. - [MoITT](https://moitt.gov.pk/SiteImage/Misc/files/25821%20DPA%20Bill%20Consultation%20Draft(1).pdf) — The 2021 draft proposes that a data controller satisfied that a data correction request is warranted must act not later than thirty days from the date of receipt of the request. - [MoITT](https://moitt.gov.pk/SiteImage/Misc/files/25821%20DPA%20Bill%20Consultation%20Draft(1).pdf) — Draft bill text includes a proposed 'right to prevent processing likely to cause damage or distress,' functioning as an objection-style right. ### Pakistan: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Core accountability infrastructure (DPIA, DPO, ROPA, breach notification, retention) exists only in unenacted draft form. Supervisory authority [Ministry of Information Technology and Telecommunication (MoITT)](https://moitt.gov.pk/) Traffic-light rationale — Red Core accountability infrastructure (DPIA, DPO, ROPA, breach notification, retention) exists only in unenacted draft form. D4 · Controller & Processor — Full Module Record 7 sub-modules · 59 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Pakistan: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ All transfer-mechanism and localisation provisions are unenacted proposals; no adequacy relationships exist. Supervisory authority [Ministry of Information Technology and Telecommunication (MoITT)](https://moitt.gov.pk/) Traffic-light rationale — Red All transfer-mechanism and localisation provisions are unenacted proposals; no adequacy relationships exist. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 59 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Pakistan: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Some in-force sectoral cyber-security/content-moderation obligations exist even though no general data-protection law exists; financial-sector overlay is the most developed segment. Supervisory authority [State Bank of Pakistan (SBP)](https://moitt.gov.pk/) Traffic-light rationale — Amber Some in-force sectoral cyber-security/content-moderation obligations exist even though no general data-protection law exists; financial-sector overlay is the most developed segment. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 97 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Pakistan: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ No adtech/commercial-privacy-specific rules identified in any tier of sourcing. Traffic-light rationale — Not assessed No adtech/commercial-privacy-specific rules identified in any tier of sourcing. #### Sub-modules (6) #### Cookies And TrackersRed No cookie/tracker consent regime identified. Absent-field provenance as noted at module level. #### Dark PatternsRed No dark-pattern prohibition identified. Absent-field provenance as noted at module level. #### Opt Out SignalsRed No recognised opt-out signal (e.g., GPC/DAA) mechanism identified. Absent-field provenance as noted at module level. #### Clean Rooms And DcrRed No clean-room/data-collaboration-room rules identified. Absent-field provenance as noted at module level. #### Cross Context AdvertisingRed No cross-context-advertising/'sale'-or-'share' restriction identified. Absent-field provenance as noted at module level. #### Direct MarketingRed No direct-marketing consent/suppression regime identified. Absent-field provenance as noted at module level. No cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition (e.g., GPC), clean-room/data-collaboration rule, cross-context-advertising restriction, or direct-marketing consent/suppression regime was identified for Pakistan. Absent-field provenance: searched 'Pakistan cookie consent law,' 'Pakistan dark patterns regulation,' 'Pakistan direct marketing consent law,' and reviewed MoITT/DataGuidance Pakistan materials; no responsive adtech-specific privacy rules located. This module reflects the broader absence of an enacted general data-protection statute from which such commercial-privacy rules would typically derive. No periodic updates recorded in this cycle ### Pakistan: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only a broad security-based content-removal power is confirmed in force; no ADM/biometric/genetic-data-specific regime exists. Supervisory authority [Pakistan Telecommunication Authority (PTA), under MoITT policy oversight](https://moitt.gov.pk/) Traffic-light rationale — Red Only a broad security-based content-removal power is confirmed in force; no ADM/biometric/genetic-data-specific regime exists. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 73 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Pakistan: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only a proposed, unenacted children's-data chapter exists; no operative minors' protections. Supervisory authority [Ministry of Information Technology and Telecommunication (MoITT)](https://moitt.gov.pk/) Traffic-light rationale — Red Only a proposed, unenacted children's-data chapter exists; no operative minors' protections. D9 · Children's Privacy — Full Module Record 5 sub-modules · 58 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Pakistan: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No operative DPA-style enforcement, penalty, or redress mechanism exists; only proposed provisions in unenacted drafts. Traffic-light rationale — Red No operative DPA-style enforcement, penalty, or redress mechanism exists; only proposed provisions in unenacted drafts. Periodic update · new data 2026-10-25 #### Enforcement & Redress Pakistan has no data-protection-specific enforcement regime and no dedicated authority empowered to investigate or sanction data-handling conduct. What exists instead, and what continued to operate this period, is enforcement under the amended Prevention of Electronic Crimes Act carried out by the National Cyber Crime Investigation Agency. Freedom Network's September 2026 digital-rights monitor reported that an Islamabad court extended the physical remand of journalist Bilal Ghauri by two days in a case the NCCIA had registered under PECA. This is adjacent cybercrime enforcement activity rather than data-protection enforcement in any technical sense, since the matter proceeds under cybercrime provisions rather than any data-handling or privacy-specific statute, and Pakistan has no data-protection authority capable of bringing a parallel data-protection action in any event. The report rests on a single civil-society source and has not been independently corroborated against a court record or an official NCCIA statement describing the charges in detail, so the specific legal basis for the remand beyond its PECA registration is not established in the record available this period. What is established is that the enforcement infrastructure created by the amended PECA, principally the NCCIA, continues to be actively used, and that its activity is the closest functional analogue currently available in Pakistan to the enforcement and redress mechanism a dedicated data-protection authority would otherwise provide. #### Outlook Whether SMPRA, also created under the amended PECA, has issued any data-handling rules relevant to controller or processor duties has not been confirmed, and this remains an open gap for the enforcement-and-redress picture generally. Absent a dedicated data-protection statute, PECA-based cybercrime enforcement by the NCCIA is likely to remain the primary enforcement signal visible in this space for the foreseeable period. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 100 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties