Pakistan

Moderate

Personal Data Protection Bill 2023 + Prevention of Electronic Crimes Act 2016

Authority: National Commission for Personal Data Protection (proposed) | Enforcement: partial | Enacted: August 2016

Overview

Pakistan does not yet have a comprehensive enacted data protection law. The Personal Data Protection Bill was introduced in 2023. Current protections derive from the Prevention of Electronic Crimes Act 2016 and constitutional privacy rights.

14-Topic Coverage

Data Protection Authority

Pending Enforcement

National Commission for Personal Data Protection proposed in the Bill. FIA enforces cybercrime provisions.

Data Subject Rights

Partially Addressed

Constitutional privacy right. Limited statutory rights. Comprehensive rights in proposed Bill.

Cross-Border Transfer

Partially Addressed

No comprehensive framework. Proposed Bill addresses cross-border transfers.

Breach Notification

Partially Addressed

PECA has some notification provisions. Comprehensive notification in proposed Bill.

DPO Requirements

Not Addressed

No current requirement. Proposed Bill introduces DPO requirement.

Children's Data

Partially Addressed

PECA addresses some children's online safety. Proposed Bill has specific provisions.

Penalties & Enforcement

Partially Addressed

PECA penalties for cybercrimes. Proposed Bill introduces comprehensive penalties.

Sector-Specific Rules

Partially Addressed

SBP financial data circulars, PTA telecom regulations.

AI & Automated Decisions

Not Addressed

No specific provisions.

Data Localisation

Partially Addressed

SBP requires some financial data localisation. Proposed Bill has broader provisions.

Significant Data Fiduciary

Not Addressed

No equivalent concept.

Government Data

Partially Addressed

Various regulations protect government data. Access to information laws exist.