Corporate & Commercial

Data Protection for Businesses in Pakistan in 2026: PECA, Sector Rules and the Unfinished Personal Data Protection Bill

A company in Karachi that holds customer records, employee files or payment data has no single data protection regulator to register with, no statutory privacy notice to publish and, outside regulated sectors, no general legal duty to report a breach. That does not mean it carries no risk. Unauthorised access, copying and misuse of data are crimes under PECA, banks and payment firms face detailed State Bank rules, and foreign partners increasingly write European-style obligations into their contracts.

Anyone looking for the best data protection lawyer in Pakistan should begin from that gap: because no single statute sets the standard, compliance means assembling obligations from criminal law, sector regulation and contract, and the advice is only as good as that map. This guide is written for businesses. If you are an individual facing online harassment or blackmail, our guide to cyber harassment complaints under PECA covers the victim's route.

Is there a data protection law in Pakistan in 2026?

Not yet. The Ministry of Information Technology and Telecommunication has worked on personal data legislation since 2018. The federal cabinet approved a Personal Data Protection Bill in February 2022, a further draft followed in 2023, and as of August 2026 the bill was still reported to be in draft form. It has not been passed by Parliament, so none of its provisions bind anyone.

The drafts are still worth knowing because they show where the law is heading and because multinational counterparties already ask about them. The 2023 draft proposed:

• a National Commission for Personal Data Protection as regulator;
• notice to the Commission and affected individuals of a breach likely to put individuals' rights at risk, where feasible within 72 hours;
• cross-border transfers only to jurisdictions with equivalent protection or under approved safeguards; and
• a requirement that "critical personal data" be processed only on servers in Pakistan.

Treat these as proposals. A business that builds its programme around them is preparing sensibly; a business that tells customers it is "compliant with Pakistan's data protection law" is making a claim that has no legal referent. Separately, a draft National Data Governance Policy 2026, aimed mainly at data held by government, went through public consultation in mid-2026. Vendors to government should also note the Cloud First Policy of 2022, which classifies public-sector data into open, public, restricted, sensitive or confidential and secret tiers, with higher tiers restricted to the government cloud or private cloud.

PECA offences that matter to a business

PECA is a criminal statute, but several offences map directly onto everyday data risks. A business can be the victim (a departing employee copying the customer database) or the source of liability (staff misusing identity information they handle at work).

Section	Offence	Typical business scenario
3	Unauthorised access to an information system or data	An ex-employee logs in with credentials that were never revoked
4	Unauthorised copying or transmission of data	Client lists or price files emailed to a personal account before resignation
5	Interference with an information system or data	Deleting records, ransomware, sabotage of systems
6 to 8	The same conduct against critical infrastructure	Attacks on systems designated as critical infrastructure; higher punishments
13 and 14	Electronic forgery and electronic fraud	Spoofed invoices, altered payment instructions
16	Unauthorised use of identity information	Using a customer's CNIC data or credentials without authorisation
17	Unauthorised issuance of SIM cards	Retailers and franchisees issuing SIMs without proper verification

Punishments rise with seriousness: up to three months' imprisonment for basic unauthorised access under section 3, up to two years for interference under section 5 and up to three years for misuse of identity information under section 16, in each case with or without a fine. Section 2 defines "identity information" broadly as information that can authenticate or identify a person or an information system and enables access to data.

Under section 43, most PECA offences are non-cognizable, bailable and compoundable. In practice that means the process usually starts with a written complaint rather than an automatic criminal case, the accused will normally be entitled to bail, and a negotiated settlement with the accused is legally possible. Offences are tried by courts designated under section 44.

Duties on service providers: retention, confidentiality and limited liability

PECA's definition of "service provider" is wider than telecom companies. It extends to anyone who provides the ability to send, receive, store or process electronic communications, and to anyone who processes or stores data for such a service or its users. App operators, hosting firms and some platform businesses may fall within it.

• Section 32 requires service providers to retain specified traffic data for at least one year, or such period as the PTA may notify, and to produce it when a court warrant requires.
• Section 41 makes it an offence, punishable with up to three years' imprisonment, for a service provider or an authorised officer to disclose a person's personal information without consent or lawful authority, with intent to cause, or knowing it is likely to cause, harm, wrongful loss or wrongful gain. A defence of good faith must be proved by the accused.
• Section 38 limits service-provider liability: there is no general duty to monitor content, and liability for third-party content arises only with specific actual knowledge and deliberate intent to participate. Certain notices must be kept confidential for fourteen days unless the court extends that period.
• Section 35 lets an authorised investigating officer inspect systems, copy data and require technical assistance and decryption, but requires proportionality, protection of data integrity and a record of what was done. Seizing hardware is meant to be a last resort.

A business that receives a data request from investigators should therefore check the legal basis (warrant or statutory order), the scope and the officer's authority before handing anything over, and keep a log of what was produced.

The 2025 amendments: NCCIA and the social media regulator

The Prevention of Electronic Crimes (Amendment) Act, 2025 (Act II of 2025), passed in January 2025, made three changes that businesses should register.

• NCCIA: section 29 now establishes the National Cyber Crime Investigation Agency as the investigating body under PECA. The FIA's cybercrime wing ceased to exist and its matters passed to the NCCIA, so complaints about data theft or system intrusion now go there.
• False information offence: new section 26A punishes disseminating information a person knows or has reason to believe is false and likely to cause fear, panic or unrest, with up to three years' imprisonment, a fine or both. Brands running aggressive social media campaigns, and businesses responding publicly to a breach, should be careful with unverified statements.
• Social Media Protection and Regulatory Authority: sections 2A onwards create an authority with power to direct removal or blocking of unlawful or offensive online content and to act against non-compliant platforms, a Social Media Complaint Council and Social Media Protection Tribunals, with appeals to the Supreme Court within sixty days.

On the ground, implementation has lagged. The government constituted the Authority in March 2026, but a July 2026 report stated that it still had no budget, office or staff, its rules were not final and the tribunals had not been established. Until they are, content disputes continue to run largely through the PTA and the courts.

Sector rules: banks, payment firms, telecoms and insurers

Regulated sectors carry the most concrete data duties in Pakistan today.

• Banks and DFIs: section 33A of the Banking Companies Ordinance, 1962 forbids a bank from divulging information about its customers' affairs except where law, practice or usage requires. SBP's BPRD Circular No. 08 of 2018 requires need-to-know access to balances and customer data, prompt removal of access when staff change roles, regular review of access rights and logs of who viewed account information, and warns that breaches expose both the bank and responsible officials to penal action.
• Outsourcing: the SBP Framework for Risk Management in Outsourcing Arrangements, revised by BPRD Circular No. 06 of 2019, addresses the definition of personally identifiable information, disclosure of customer information, outsourcing outside Pakistan and group outsourcing.
• Cloud: BPRD Circular No. 01 of 2023 issued the Framework on Outsourcing to Cloud Service Providers for banks, microfinance banks, DFIs, electronic money institutions and payment system operators and providers. Offshore cloud hosting of material workloads requires prior SBP approval.
• Telecom and marketing: the PTA's Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communication Regulations, 2009 require spam controls and support a Do Not Call register, which affects SMS and call-centre marketing.
• Insurance: the SECP's 2020 cybersecurity guidelines for the insurance sector expect insurers to build a framework to detect, prevent and respond to cyber attacks, including measures such as appointing a chief information security officer.

Credit information is separately protected under the Credit Bureaus Act, 2015, and electronic fund transfers under the Payment Systems and Electronic Fund Transfers Act, 2007. A fintech or e-commerce business should map which of these frameworks reaches it before designing its data architecture.

Article 14 and privacy in the courts

Article 14(1) of the Constitution provides that "the dignity of man and, subject to law, the privacy of home, shall be inviolable." The Supreme Court has read privacy beyond the physical home. In Mohtarma Benazir Bhutto v. President of Pakistan, PLD 1998 SC 388, it treated phone tapping as unconstitutional in the absence of a lawful procedure, and privacy has been revisited in later decisions, including the Justice Qazi Faez Isa litigation reported as PLD 2021 SC 1.

Two cautions for businesses. First, fundamental rights are enforced primarily against the State; how far Article 14 creates direct claims against private companies is not settled in Pakistani law, so a customer's remedy against a business usually runs through contract, PECA, sector regulators or a civil suit for breach of confidence. Second, the constitutional standard still influences courts when they decide whether an employer's monitoring of staff or a company's disclosure of customer data was reasonable. Monitoring policies should therefore be written, proportionate and notified to employees in advance, and should sit alongside the confidentiality terms in employment contracts discussed in our guide to Sindh employment law.

Responding to a data breach in Pakistan

Without a general notification statute, the response is driven by sector rules, contracts and evidence. A workable sequence is:

1. Contain and preserve. Revoke credentials, isolate affected systems and take forensic images before anything is wiped. A later PECA prosecution or civil claim depends on logs and chain of custody.
2. Check regulatory duties. SBP-regulated entities must assess reporting obligations under their frameworks and circulars; other regulated businesses should check their licence conditions.
3. Check contracts. Supply, outsourcing and data processing agreements with foreign clients often require notice within a fixed number of hours. Missing that deadline can be a breach of contract even where Pakistani law imposes none.
4. Complain to the NCCIA where the breach involves an offence under sections 3 to 5, 13, 14 or 16, with a written chronology, the evidence preserved and the identity of any suspect.
5. Consider civil relief. Where a former employee or competitor holds copied data, an injunction restraining its use can be sought alongside the criminal complaint; see our guide to interim injunctions.
6. Communicate carefully. Tell affected customers what is known and what they should do, without speculation, and keep a record of every decision.

Cross-border transfers and a practical compliance programme

There is currently no general statutory restriction on sending personal data out of Pakistan. Restrictions come from sector rules (for example, SBP approval for offshore cloud hosting of material workloads), from government data policies for public-sector work, and from contracts. The draft bill's localisation rule for critical personal data would change this if enacted, so businesses investing in new infrastructure should keep the option of in-country hosting open.

For most businesses the sensible programme, pending legislation, is short:

• map what personal data you hold, where it is stored and who can reach it;
• apply need-to-know access and remove access the day a role changes;
• put confidentiality and data-return clauses in employment and vendor contracts;
• publish an accurate privacy notice that does not overstate legal compliance;
• keep a written incident response plan and test it; and
• for foreign-owned entities, align group data policies with Pakistani sector rules, a point we cover in our foreign-owned business roadmap.

Common questions

This article is general information about Pakistani law and procedure, not legal advice for any specific matter. If this touches on something you're currently facing, get in touch and we'll advise on your facts directly.