Data Protection Monitor
Global Privacy & Data Protection Intelligence

Pakistan Data Protection & Privacy Regulation

PK schema gdpri-v2 trajectory: not yet assessed unregulated gap overlaps: Sentinel (AML/CFT), World Payments, artificial-intelligence

Last updated · 10 categories · 35 claims · 29 sources in the cumulative register

Pakistan's Ministry of Information Technology and Telecommunications, together with the Pakistan Digital Authority, held a high-level meeting to finalise the draft National Data Governance Policy 2026 ahead of cabinet approval and gazette notification, following the close of consultation on 10 July 2026.

Data collected Data published

AI-assembled from cited sources

Not covered: AdTech & Commercial Privacy. Not fully checked this cycle: Regulator & Framework, Controller/Processor Duties (3 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureUnregulated gap9 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityMinistry of Information Technology and Telecommunication (MoITT)Primary statutory & supervisory perimeter
Next milestone (> 2026-10-26)None scheduledNo dated future statutory milestone on record
Module coverage & confidence9 / 10 modules assessed0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed

Jurisdiction brief

Latest update · 25 October 2026

Lead Signal

Pakistan has no enacted general data-protection statute, and that standing gap continues to shape the jurisdiction's data-protection profile more than any single development this period. The two live signals sit at the margins of the gap rather than inside it: civil-society reporting has raised transparency concerns around a Google-Pakistan government agreement, and adjacent cybercrime enforcement activity under the amended Prevention of Electronic Crimes Act continued with a reported remand extension in a journalist's case. Neither development touches a dedicated data-protection authority or statute, because none exists.

Key regulatory facts for Pakistan
Regulatory DimensionPakistan Standing Position
JurisdictionPakistan (PK)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 35 sourced findings)
Regulator & FrameworkNo enacted comprehensive data-protection statute and no independent supervisory authority exist; only unenacted drafts and a sectoral cybercrime law are in play.
Lawful Processing & Special DataAll lawful-basis and special-category provisions exist only in unenacted draft form; no in-force consent or sensitive-data regime.
Data Subject RightsAll data subject rights provisions are proposal-stage only; none in force.
Controller/Processor DutiesCore accountability infrastructure (DPIA, DPO, ROPA, breach notification, retention) exists only in unenacted draft form.
Primary Instruments CitedGovernment of Pakistan, MoITT, MoITT, MoITT, Recording Law
Last Confirmed / Updated2026-10-25 (29 sources in cumulative register)

#

No enacted comprehensive data-protection statute and no independent supervisory authority exist; only unenacted drafts and a sectoral cybercrime law are in play.

Supervisory authorityMinistry of Information Technology and Telecommunication (MoITT)
Traffic-light rationale — RedNo enacted comprehensive data-protection statute and no independent supervisory authority exist; only unenacted drafts and a sectoral cybercrime law are in play.

Sub-modules (5)

Regulator And AuthorityRed

No independent DPA exists; MoITT is the de facto adjacent competent body pending enactment of a data-protection commission/authority proposed in successive drafts.

Claims (4):

  • Pakistan has no independent dedicated data protection authority; the Ministry of Information Technology and Telecommunication (MoITT) holds adjacent competence pending enactment of a comprehensive data-protection law.
  • National Commission for Personal Data Protection (proposed) — envisaged, no statutory basis
  • Ministry of Information Technology and Telecommunication (MoITT) — No independent data-protection authority exists in Pakistan; the proposed National Commission for Personal Data Protection would be established only once the Personal Data Protection Bill is enacted
  • Ministry of Information Technology and Telecommunication (MoITT) — Pakistan has no independent, operational data-protection supervisory authority; the proposed National Commission for Personal Data Protection is not yet established.

Act And InstrumentsRed

Multiple unenacted PDPB drafts (2018/2020/2021/2023) exist alongside the in-force PECA 2016, which is sectoral cybercrime legislation, not a data-protection instrument.

Claims (4):

  • MoITT has circulated multiple drafts of a Personal Data Protection Bill (2018, 2020, 2021, and a Final Draft dated May 2023) without enactment into law as of the current verified status.
  • The Prevention of Electronic Crimes Act, 2016 (PECA) is an in-force statute addressing unauthorized access to data and cybercrime, but it does not constitute a comprehensive data-protection regime.
  • Personal Data Protection Bill — Has not passed both houses of Parliament as of September 2026; PECA 2016 as amended January 2025 remains the operative criminal-law instrument addressing data misuse
  • Personal Data Protection Bill — The Bill has completed consultation and received an earlier Federal Cabinet approval but, as of October 2026, has not passed both houses of Parliament.

Material ScopeRed

Proposed material scope under the 2021 draft extends to processing of personal data throughout Pakistan; not currently operative.

Claims (1):

  • The 2021 consultation draft of the Personal Data Protection Bill proposes that the Act extend to the whole of Pakistan, covering processing of personal data by controllers and processors.

Territorial ScopeRed

The May 2023 draft proposes extraterritorial application concepts (e.g., 'significant' controller/processor designation, application of Pakistani law under international law principles), but this remains proposal-stage only.

Claims (1):

  • The May 2023 draft bill proposes extraterritorial-style application concepts, including designation of 'significant' data controllers/processors and application of Pakistani law under public or private international law principles, but this remains unenacted proposal text.

Regulator Registration And FilingRed

Draft bills propose establishment of a statutory Commission/Authority with registration-fee provisions; no registration/filing regime is currently operative.

Claims (1):

  • Successive drafts (2020 update) propose establishment of a statutory Personal Data Protection Authority/Commission with registration-fee collection powers, but no such body or filing regime is currently operative.
Category narrative 80 words

Pakistan has no independent dedicated data protection authority. The Ministry of Information Technology and Telecommunication (MoITT) holds adjacent competence and has circulated multiple drafts of a Personal Data Protection Bill (2018, 2020, 2021, and a Final Draft dated May 2023) without any version being enacted into law as of the current verified status (2026-08-07). The Prevention of Electronic Crimes Act, 2016 (PECA) is the only in-force statute touching personal data, but it addresses cybercrime/unauthorized access rather than comprehensive data protection.

Sources and claims (11)
  1. Confirmed Government of Pakistan — Pakistan has no independent dedicated data protection authority; the Ministry of Information Technology and Telecommunication (MoITT) holds adjacent competence pending enactment of a comprehensive data-protection law. observed
  2. Confirmed MoITT — MoITT has circulated multiple drafts of a Personal Data Protection Bill (2018, 2020, 2021, and a Final Draft dated May 2023) without enactment into law as of the current verified status. observed
  3. Confirmed MoITT — The Prevention of Electronic Crimes Act, 2016 (PECA) is an in-force statute addressing unauthorized access to data and cybercrime, but it does not constitute a comprehensive data-protection regime. observed
  4. Probable MoITT — The 2021 consultation draft of the Personal Data Protection Bill proposes that the Act extend to the whole of Pakistan, covering processing of personal data by controllers and processors. observed
  5. Uncertain MoITT — The May 2023 draft bill proposes extraterritorial-style application concepts, including designation of 'significant' data controllers/processors and application of Pakistani law under public or private international law principles, but this remains unenacted proposal text. observed
  6. Probable MoITT — Successive drafts (2020 update) propose establishment of a statutory Personal Data Protection Authority/Commission with registration-fee collection powers, but no such body or filing regime is currently operative. observed
  7. High Recording Law — National Commission for Personal Data Protection (proposed) — envisaged, no statutory basis observed
  8. Probable Cybersilo — Ministry of Information Technology and Telecommunication (MoITT) — No independent data-protection authority exists in Pakistan; the proposed National Commission for Personal Data Protection would be established only once the Personal Data Protection Bill is enacted observed
  9. Probable Chambers and Partners — Personal Data Protection Bill — Has not passed both houses of Parliament as of September 2026; PECA 2016 as amended January 2025 remains the operative criminal-law instrument addressing data misuse observed
  10. Probable Recording Law — Ministry of Information Technology and Telecommunication (MoITT) — Pakistan has no independent, operational data-protection supervisory authority; the proposed National Commission for Personal Data Protection is not yet established. observed
  11. Probable DLA Piper — Personal Data Protection Bill — The Bill has completed consultation and received an earlier Federal Cabinet approval but, as of October 2026, has not passed both houses of Parliament. observed

#

All lawful-basis and special-category provisions exist only in unenacted draft form; no in-force consent or sensitive-data regime.

Supervisory authorityMinistry of Information Technology and Telecommunication (MoITT)
Traffic-light rationale — RedAll lawful-basis and special-category provisions exist only in unenacted draft form; no in-force consent or sensitive-data regime.
D2 · Lawful Processing — Full Module Record4 sub-modules · 63 words · 3 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

All data subject rights provisions are proposal-stage only; none in force.

Supervisory authorityMinistry of Information Technology and Telecommunication (MoITT)
Traffic-light rationale — RedAll data subject rights provisions are proposal-stage only; none in force.

Sub-modules (5)

Access RightRed

May 2023 draft includes 'Right to access' and 'Compliance with the data access request' provisions, unenacted.

Claims (1):

  • The May 2023 draft bill includes proposed 'Right to access' and 'Compliance with the data access request' provisions, not yet enacted.

Rectification And ErasureRed

2020 and 2021 drafts propose erasure rights, including a 14-day erasure window and an undue-delay erasure standard; unenacted.

Claims (2):

  • The 2020 updated draft proposes that data controllers erase personal data within a period of 14 days where specified conditions are met.
  • Draft bill text provides that a data subject shall have the right to obtain from the data controller the erasure of personal data concerning him without undue delay.

Restriction And ObjectionRed

Draft text proposes a 'right to prevent processing likely to cause damage or distress,' an objection-style right; unenacted.

Claims (1):

  • Draft bill text includes a proposed 'right to prevent processing likely to cause damage or distress,' functioning as an objection-style right.

Data PortabilityRed

No explicit data-portability right was identified in any reviewed draft bill text (2018/2020/2021/2023). Absent-field provenance: reviewed all four MoITT draft PDFs' indexed section titles with no portability provision located.

Deadlines And Response WindowsRed

The 2021 draft proposes a 30-day response window for data-correction requests; unenacted.

Claims (1):

  • The 2021 draft proposes that a data controller satisfied that a data correction request is warranted must act not later than thirty days from the date of receipt of the request.
Category narrative 52 words

No enacted subject-access, correction, erasure, objection, or portability regime exists. Draft bills propose access, correction (30-day response window per the 2021 draft), erasure (14-day window per the 2020 draft), and an objection-style 'right to prevent processing likely to cause damage or distress.' No explicit data-portability right was located in any reviewed draft.

Sources and claims (5)
  1. Probable MoITT — The May 2023 draft bill includes proposed 'Right to access' and 'Compliance with the data access request' provisions, not yet enacted. observed
  2. Probable MoITT — The 2020 updated draft proposes that data controllers erase personal data within a period of 14 days where specified conditions are met. observed
  3. Probable MoITT — Draft bill text provides that a data subject shall have the right to obtain from the data controller the erasure of personal data concerning him without undue delay. observed
  4. Probable MoITT — The 2021 draft proposes that a data controller satisfied that a data correction request is warranted must act not later than thirty days from the date of receipt of the request. observed
  5. Probable MoITT — Draft bill text includes a proposed 'right to prevent processing likely to cause damage or distress,' functioning as an objection-style right. observed

#

Core accountability infrastructure (DPIA, DPO, ROPA, breach notification, retention) exists only in unenacted draft form.

Supervisory authorityMinistry of Information Technology and Telecommunication (MoITT)
Traffic-light rationale — RedCore accountability infrastructure (DPIA, DPO, ROPA, breach notification, retention) exists only in unenacted draft form.
D4 · Controller & Processor — Full Module Record7 sub-modules · 59 words · 5 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

All transfer-mechanism and localisation provisions are unenacted proposals; no adequacy relationships exist.

Supervisory authorityMinistry of Information Technology and Telecommunication (MoITT)
Traffic-light rationale — RedAll transfer-mechanism and localisation provisions are unenacted proposals; no adequacy relationships exist.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 59 words · 3 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Some in-force sectoral cyber-security/content-moderation obligations exist even though no general data-protection law exists; financial-sector overlay is the most developed segment.

Supervisory authorityState Bank of Pakistan (SBP)
Traffic-light rationale — AmberSome in-force sectoral cyber-security/content-moderation obligations exist even though no general data-protection law exists; financial-sector overlay is the most developed segment.
D6 · Sectoral Watch — Full Module Record7 sub-modules · 97 words · 3 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

No adtech/commercial-privacy-specific rules identified in any tier of sourcing.

Traffic-light rationale — Not assessedNo adtech/commercial-privacy-specific rules identified in any tier of sourcing.

Sub-modules (6)

Cookies And TrackersRed

No cookie/tracker consent regime identified. Absent-field provenance as noted at module level.

Dark PatternsRed

No dark-pattern prohibition identified. Absent-field provenance as noted at module level.

Opt Out SignalsRed

No recognised opt-out signal (e.g., GPC/DAA) mechanism identified. Absent-field provenance as noted at module level.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room rules identified. Absent-field provenance as noted at module level.

Cross Context AdvertisingRed

No cross-context-advertising/'sale'-or-'share' restriction identified. Absent-field provenance as noted at module level.

Direct MarketingRed

No direct-marketing consent/suppression regime identified. Absent-field provenance as noted at module level.

Category narrative 69 words

No cookie/tracker consent law, dark-pattern prohibition, opt-out-signal recognition (e.g., GPC), clean-room/data-collaboration rule, cross-context-advertising restriction, or direct-marketing consent/suppression regime was identified for Pakistan. Absent-field provenance: searched 'Pakistan cookie consent law,' 'Pakistan dark patterns regulation,' 'Pakistan direct marketing consent law,' and reviewed MoITT/DataGuidance Pakistan materials; no responsive adtech-specific privacy rules located. This module reflects the broader absence of an enacted general data-protection statute from which such commercial-privacy rules would typically derive.

No periodic updates recorded in this cycle

#

Only a broad security-based content-removal power is confirmed in force; no ADM/biometric/genetic-data-specific regime exists.

Supervisory authorityPakistan Telecommunication Authority (PTA), under MoITT policy oversight
Traffic-light rationale — RedOnly a broad security-based content-removal power is confirmed in force; no ADM/biometric/genetic-data-specific regime exists.
D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 73 words · 1 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Only a proposed, unenacted children's-data chapter exists; no operative minors' protections.

Supervisory authorityMinistry of Information Technology and Telecommunication (MoITT)
Traffic-light rationale — RedOnly a proposed, unenacted children's-data chapter exists; no operative minors' protections.
D9 · Children's Privacy — Full Module Record5 sub-modules · 58 words · 1 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

No operative DPA-style enforcement, penalty, or redress mechanism exists; only proposed provisions in unenacted drafts.

Traffic-light rationale — RedNo operative DPA-style enforcement, penalty, or redress mechanism exists; only proposed provisions in unenacted drafts.
Periodic update · new data 2026-10-25

Enforcement & Redress

Pakistan has no data-protection-specific enforcement regime and no dedicated authority empowered to investigate or sanction data-handling conduct. What exists instead, and what continued to operate this period, is enforcement under the amended Prevention of Electronic Crimes Act carried out by the National Cyber Crime Investigation Agency. Freedom Network's September 2026 digital-rights monitor reported that an Islamabad court extended the physical remand of journalist Bilal Ghauri by two days in a case the NCCIA had registered under PECA. This is adjacent cybercrime enforcement activity rather than data-protection enforcement in any technical sense, since the matter proceeds under cybercrime provisions rather than any data-handling or privacy-specific statute, and Pakistan has no data-protection authority capable of bringing a parallel data-protection action in any event.

The report rests on a single civil-society source and has not been independently corroborated against a court record or an official NCCIA statement describing the charges in detail, so the specific legal basis for the remand beyond its PECA registration is not established in the record available this period. What is established is that the enforcement infrastructure created by the amended PECA, principally the NCCIA, continues to be actively used, and that its activity is the closest functional analogue currently available in Pakistan to the enforcement and redress mechanism a dedicated data-protection authority would otherwise provide.

Outlook

Whether SMPRA, also created under the amended PECA, has issued any data-handling rules relevant to controller or processor duties has not been confirmed, and this remains an open gap for the enforcement-and-redress picture generally. Absent a dedicated data-protection statute, PECA-based cybercrime enforcement by the NCCIA is likely to remain the primary enforcement signal visible in this space for the foreseeable period.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 100 words · 3 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 35 claim(s) (35 category placement(s)), 29 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 25 Oct 2026: not settled (1 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsdeadlines and response windows
Art. 14Data Subject Rightsdeadlines and response windows
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrestriction and objection
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacytransfer mechanisms
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 81Enforcement & Redressregulator powers and penalties
Art. 82Enforcement & Redressregulator powers and penalties
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties