Pakistan

The Prevention of Electronic Crimes Act 2016, section 1(3), applies to every citizen of Pakistan wherever they are, and to every other person who is in Pakistan at the time. Section 1(4) extends it to any act committed outside Pakistan that is an offence under the Act and affects a person, property, information system or data located in Pakistan. Section 37 gives the Pakistan Telecommunication Authority power to remove or block online content, on broad public-order and national-security grounds. The 2025 amendment created a Social Media Protection and Regulatory Authority. That body 'may require any social media platform to enlist with it'. The registration power exists on paper. We found no evidence it has been switched on. The 2023 draft privacy bill would go much further. It would reach companies with no physical presence in Pakistan, whether they decide how data is used or only handle it for someone else. But it is a draft and binds nobody.

Here is what we found industry by industry, checked 18 August 2026. TELECOM. Closed by default. The Critical Telecom Data and Infrastructure Security Regulations 2020 say plainly that no data shall be stored beyond the country's geographical boundaries without the approval of the Pakistan Telecommunication Authority. That binds every licensee of the Authority. It covers mobile operators, fixed-line operators, internet service providers and long-distance operators. A 2025 replacement version is published on the regulator's site. It is a scanned image with no readable text, so we cannot confirm whether the wording changed. BANKING. Closed for cloud, permission-based for everything else. The State Bank of Pakistan's Enterprise Technology Governance and Risk Management Framework requires cloud service providers to be located in Pakistan. All physical servers and data centres must sit and operate in Pakistan. Separately, core banking systems that handle or store customer data may not be put on a cloud at all. The outsourcing rules require prior State Bank approval for any outsourcing outside Pakistan. They ban providers abroad that are not themselves regulated. They ban sub-contracting of work done abroad. And they require both customer consent and prior written State Bank approval before confidential customer information goes to a provider abroad. PAYMENTS AND E-MONEY. Permission-based. Electronic money institutions may not outsource any function outside Pakistan without prior written approval from the State Bank. GOVERNMENT. Closed. The Cloud First Policy 2022 limits government cloud to Pakistani locations. Private cloud infrastructure must be located in Pakistan. Restricted, confidential and secret classes of government data may only sit on a government or private cloud inside the country. INSURANCE AND SECURITIES. We found no rule about keeping data in the country on the regulator's own site as at 18 August 2026. The Securities and Exchange Commission of Pakistan has issued a cyber security advisory circular. We found no rule from it on cloud or on where data must sit. HEALTH, EDUCATION, GAMBLING. We found no rule, checked 18 August 2026. Gambling is a criminal offence in Pakistan, so there is no licensed gambling industry to regulate. MAPPING AND GEOSPATIAL. Restrictions almost certainly exist. The Survey of Pakistan publishes Surveying and Mapping Rules 2015, and 1981 rules on the publication, classification, issue and custody of maps. Both files are scanned images we could not read, so we do not state their content.

At national level there is no restriction. No law names permitted or forbidden destinations. In telecoms, sending data abroad needs approval from the Pakistan Telecommunication Authority, which it can grant or refuse. That comes from the critical telecom data regulations. In banking, you need prior approval from the State Bank. For confidential customer information you need prior written State Bank approval plus the customer's own consent. The provider abroad may not sub-contract at all. Banks must also make sure all information about outsourcing outside Pakistan stays available inside Pakistan, and open to State Bank inspection at any time. That works like a keep-a-copy-here rule. For electronic money institutions, any function abroad needs prior written State Bank approval. In the public sector, the Cloud Office inside the Ministry of Information Technology and Telecommunication signs off exceptions. The 2023 draft privacy bill would add a test of whether the destination country is safe enough, plus binding contracts and consent. It would forbid critical personal data leaving at all. But it is a draft.

There is no data protection authority in Pakistan at all. The May 2023 draft bill would have created a National Commission for Personal Data Protection within six months of the law starting. The bill was never enacted, so the Commission does not exist. The Pakistan Digital Authority, created by the Digital Nation Pakistan Act 2025, really is operational. It has a chairman. It ran the consultation on the National Data Governance Policy 2026 and closed it on 5 August 2026. It runs the national data exchange layer. It publishes a standards register. But its own Acts and Regulations page carries only the founding Act, plus a line saying rules and regulations will be posted as they become available. It has issued no binding data rules. The 2025 amendment to the cybercrime law created two more bodies. The National Cyber Crime Investigation Agency took over cybercrime investigation from the Federal Investigation Agency. The Social Media Protection and Regulatory Authority was created on paper. We could not find any official website or published decision for it, so we do not treat it as operational. The national computer emergency response team is operational and issues security advisories dated 2026. Overall: nothing is happening on data protection. That is about privacy enforcement only. Banking and telecoms supervision are active and backed by licences.

MINIMUM. The cybercrime law requires a service provider to keep its specified traffic data for at least one year, or any other period the Pakistan Telecommunication Authority notifies. It must hand the data over on a court warrant. Failure can attract a fine up to ten million rupees, roughly thirty-six thousand United States dollars. Electronic money institutions must keep all necessary records for at least ten years, or as required by other laws. Computer emergency response teams must securely keep data they receive for at least three years, unless a competent authority extends that or erases it. The critical telecom data regulations tell licensees to follow their licensed keeping periods, and to ask the regulator when a period is unclear. So the real answer for a telecoms licensee sits in its own licence, not in a public rule. MAXIMUM. No general deletion duty is in force. The draft National Data Governance Policy 2026 would introduce one for government data. It says personal data shall not be kept beyond the defined period, except where required by law or judicial process. It is not yet approved. The 2023 draft privacy bill would introduce a general one. CONFLICT. There is no general maximum, so there is nothing for the minimums to conflict with. If the draft policy or bill is adopted, both texts follow the same pattern. A specific legal keeping requirement wins over the deletion duty.

CLOCK ONE. One hour. The Computer Emergency Response Team Rules 2023 set this. You must make a short report of an incident within one hour of identifying it. It goes to your industry response team and to the national one. Use best estimates and update later. The rules cover federal and provincial government bodies and critical industries, including defence, telecom, banking, finance, power and utilities. CLOCK TWO. Forty-eight hours. Financial institutions must report to the State Bank's Banking Policy and Regulation Department within forty-eight hours. That covers all confirmed information or cyber security breaches involving financial loss, theft of confidential data, or a major disruption leaving customers without banking services for more than two hours. CLOCK THREE. Seventy-two hours. Telecoms licensees must inform the Pakistan Telecommunication Authority within seventy-two hours of discovering a data breach, or damage to critical telecom infrastructure or critical data. A large bank running its own network can be inside all three at once. There is no duty in force to notify the people affected. The 2023 draft bill would have added a seventy-two hour duty to notify both the regulator and the person. It is a draft.

1. THE RULES LIVE IN LICENCES. There is no privacy statute, so the binding duties sit in regulator rulebooks and licence conditions. A compliance review that searches for a data protection act finds nothing and concludes Pakistan is open. The telecoms and banking rules are enforced through supervision and licensing. The penalty is suspension or loss of licence, not a large public fine. 2. NO CLOUD FOR CORE BANKING, ANYWHERE. The State Bank rule is not only about location. Core banking applications, services and business processes used to handle or store customer and borrower data may not go on a cloud at all. Cloud is limited to non-core support, such as collaboration tools, human resources and procurement. A local cloud region does not fix this. 3. BANK CUSTOMER DATA ABROAD NEEDS TWO KEYS. Sharing confidential customer information with a provider abroad needs both the customer's consent and prior written State Bank approval. You need both, whatever the contract says. The provider abroad must itself be regulated, and it may not sub-contract at all. 4. CRIMINAL, NOT ADMINISTRATIVE. The cybercrime law creates prison sentences. Using another person's identity information without authorisation carries up to three years. Investigators can force a person holding decryption information to hand over readable data. That is personal exposure for staff, not a company fine. 5. THE ONE-HOUR CLOCK. Most incident plans are written around seventy-two hours. In Pakistan a critical-industry organisation has one hour to make a first report to its industry and national response teams. Missing it is the failure we would most expect. 6. THE TELECOM RULES WERE REPLACED IN 2025 AND THE NEW TEXT IS UNREADABLE. The regulator publishes a 2025 version of the critical telecom data regulations as a scanned image with no readable text. We can verify the 2020 wording. The current wording may differ.

COMING. The draft National Data Governance Policy 2026 was published by the Ministry of Information Technology and Telecommunication on 26 June 2026. It sets three tiers for where data may sit. Tier one covers restricted, confidential and personal data. It must be hosted, stored and handled within the territory of Pakistan. Tier two is internal data. It may be handled abroad only with prior approval from the Pakistan Digital Authority, plus safeguards in the contract. Tier three is open data. It may be hosted anywhere. The document records its own status as proposed, taking effect on gazette notification. The Pakistan Digital Authority announced on 5 August 2026 that consultation had ended and the policy had moved from draft to final stage. Read the scope carefully. The text is written around government data and public bodies. It is not yet clear how far it will bind private companies. STILL A DRAFT. The Personal Data Protection Bill has existed in drafts dated 2018, 2020 and 2023, and has not been passed. The 2023 draft would forbid critical personal data leaving Pakistan. It would require a test of whether the destination country is safe enough for other transfers. It would create a National Commission for Personal Data Protection within six months. It would impose a seventy-two hour breach notification duty. And it would set penalties up to two million United States dollars, or one per cent of annual gross revenue, whichever is higher. None of this binds anyone today. POWERS ALREADY IN PLACE, WHICH MATTER MORE. 1. The telecoms regulator can refuse or withdraw approval for storing data abroad at any time, under a regulation already in force. No consultation is needed. 2. The cybercrime law lets the telecoms regulator change the traffic data keeping period by notification, from the current one year to any period it chooses. 3. The 2025 amendment lets the new social media authority require any social media platform to enlist with it, on terms to be set. The power exists. The rules have not been made. 4. The telecoms regulator's content blocking power is broad and immediate. The 2025 amendment adds a twenty-four hour removal deadline for content the authority treats as false information. 5. The Pakistan Digital Authority has legal power to develop and enforce a national data strategy and national data governance rules, across both the public and private sectors. It has published no rules yet.