Pakistan still has no single, comprehensive data protection law in force. A Personal Data Protection Bill has been drafted and redrafted for years, but as of October 2026 it has not been enacted. That does not mean Pakistani businesses can handle personal data however they like. A mix of constitutional rights, cybercrime law, sector rules, a new national information security framework and foreign laws such as the GDPR already shapes what you must do. This guide sets out where the law stands, what applies today, what the draft bill is likely to require, and a practical plan to get ready.
Is there a data protection law in Pakistan?
Not a comprehensive one. Practice guides updated in 2026 report that the Personal Data Protection Bill has completed consultation but has not passed both houses of Parliament and is not enforceable (Chambers, Data Protection & Privacy 2026). Until it is passed and notified, there is no general data protection regulator and no general duty to report personal data breaches to one.
What already protects personal data in Pakistan
| Source | What it covers | Who it affects most |
|---|---|---|
| Constitution, Article 14 | Dignity of the person and privacy of the home, which courts have relied on in privacy cases | Everyone, mainly through litigation |
| Prevention of Electronic Crimes Act (PECA) 2016, amended 2025 | Offences such as unauthorised access to information systems and data, unauthorised copying or transmission of data, and unauthorised use of identity information | Any business holding data, and staff or vendors who misuse it |
| Banking Companies Ordinance 1962 | Banks’ duty to keep customer information confidential | Banks and their service providers |
| Payment Systems and Electronic Fund Transfers Act 2007 and SBP frameworks | Security and confidentiality of payment and banking data, cloud and cybersecurity rules | Banks, fintechs, payment providers, their vendors |
| Credit Bureaus Act 2015 | How credit information is collected, used and disclosed | Lenders and credit bureaus |
| PTA spam and telecom rules | Unsolicited calls and messages, Do Not Call register, telemarketer registration | Telemarketing and SMS marketing |
Contracts matter too. Most foreign clients now attach data processing terms to service agreements, and breaching them is a commercial liability even where no Pakistani statute applies.
The Pakistan Information Security Framework 2026
In August 2026 the federal cabinet approved the Pakistan Information Security Framework (PISF) 2026, developed by the national CERT under the CERT Rules 2023. It sets baseline controls for governance, risk management, supply chain security and secure software development. Reported requirements include formal incident response, reporting verified incidents affecting critical information infrastructure within 72 hours and other verified incidents within 120 hours, and moving government websites and apps hosted abroad to data centres in Pakistan. The framework is aimed first at government bodies and critical infrastructure, but the IT ministry has proposed it as a national baseline for public and private entities, and government buyers are expected to push its requirements down to their software, hosting and cloud suppliers.
Foreign laws that may already apply to you
If you offer goods or services to people in the EU, or monitor their behaviour, the EU General Data Protection Regulation can apply to your Pakistani business directly. Software houses, call centres and BPO firms that process data for UK, EU or Gulf clients are usually bound by data processing agreements that copy GDPR-style duties into the contract. For many exporters these obligations are stricter than anything currently required at home.
What the draft Personal Data Protection Bill is expected to require
Drafts have changed between versions, so treat these as likely directions rather than final law. Successive drafts have followed a GDPR-like model, including:
- A legal basis, usually consent, for processing personal data, with stricter rules for sensitive data.
- Rights for individuals to access, correct and, in some cases, erase their data and withdraw consent.
- Security duties for controllers and processors.
- Notification of personal data breaches to a new regulator and affected individuals, within 72 hours where feasible.
- Restrictions on transferring certain categories of data outside Pakistan, with critical personal data to be kept in the country.
- A National Commission for Personal Data Protection with powers to investigate and fine.
A practical readiness plan for Pakistani businesses
- Map your data. List what personal data you collect (customers, employees, CNIC copies, payment details, CVs), where it is stored, who can access it and who you share it with.
- Collect less and keep it for less time. Stop collecting data you do not need, and set retention periods for CNIC copies, CVs and old customer records.
- Publish an honest privacy notice on your website and forms explaining what you collect and why.
- Secure the data. MFA, access control, encryption on laptops, backups and logging are the controls regulators and clients will ask about first. Our cybersecurity checklist for small businesses covers the basics.
- Fix vendor contracts. Add confidentiality, security and data processing clauses with developers, hosting providers, payroll and CRM vendors.
- Prepare a breach response plan with clear roles, so you can investigate, contain and notify quickly when the law requires it.
- Name an owner. Give one senior person responsibility for privacy and security, even before the law requires a data protection officer.
- Consider a recognised standard. An ISMS based on ISO 27001 covers most of the security duties that data protection laws impose, and clients already recognise it.
Data protection also overlaps with ownership of your digital assets. Our intellectual property audit guide covers who owns your website code, databases and brand, and our regulatory briefing for 2023 to 2026 tracks other recent changes.
Frequently asked questions
Does Pakistan have a data protection law in 2026?
Not a comprehensive one. The Personal Data Protection Bill has been drafted but, as of October 2026, has not been passed by Parliament. Personal data is protected through the Constitution, PECA 2016, sector laws and contracts.
Does PECA 2016 protect personal data?
PECA makes it an offence to access information systems or data without authorisation, copy or transmit data without authorisation, or misuse identity information. It punishes misuse but does not set general rules on how businesses must handle personal data.
What is PISF 2026?
The Pakistan Information Security Framework 2026 is a national information security baseline approved by the federal cabinet in August 2026. It covers governance, risk, supply chain security, incident response and reporting, and applies first to government bodies and critical infrastructure.
Does GDPR apply to Pakistani companies?
It can. GDPR applies to businesses outside the EU that offer goods or services to people in the EU or monitor their behaviour, and many EU clients impose GDPR-style terms on their Pakistani suppliers by contract.
What should businesses do before the PDP Bill passes?
Map the personal data you hold, minimise and secure it, publish a privacy notice, update vendor contracts, prepare a breach response plan and assign an owner for privacy and security.
How CEC can help
Connect Engineers & Consultants helps businesses build practical privacy and security programmes: data mapping, policies and privacy notices, vendor clauses, ISO 27001 certification, and secure websites and software. Foreign companies entering Pakistan can also read our guide to setting up in Pakistan.
Need a data protection readiness review? Contact our team.
This article is general information as of October 2026, not legal advice. Data protection law in Pakistan is changing, so check the current status of the Personal Data Protection Bill and PISF 2026 and take legal advice for your situation.
