Pakistan

The Prevention of Electronic Crimes Act 2016, section 1(3), applies to every citizen of Pakistan wherever they are and to every other person for the time being in Pakistan. Section 1(4) extends it to any act committed outside Pakistan that constitutes an offence under the Act and affects a person, property, information system or data located in Pakistan. Section 37 gives the Pakistan Telecommunication Authority power to remove or block online content on broad public-order and national-security grounds. The 2025 amendment created a Social Media Protection and Regulatory Authority which 'may require any social media platform to enlist with it' — a registration power that exists on paper but which we found no evidence has been switched on. The 2023 draft privacy bill would go much further, reaching controllers and processors with no physical presence in Pakistan, but it is a draft and binds nobody.

Sector by sector, checked 18 August 2026. TELECOM — closed by default. The Critical Telecom Data and Infrastructure Security Regulations 2020 say plainly that no data shall be stored beyond the country's geographical boundaries without the approval of the Pakistan Telecommunication Authority. This binds every PTA licensee, which includes mobile operators, fixed-line operators, internet service providers and long-distance operators. A 2025 replacement version of these regulations is published on the regulator's site but is a scanned image with no readable text, so we cannot confirm whether the wording changed. BANKING — closed for cloud, permission-based for everything else. The State Bank of Pakistan's Enterprise Technology Governance and Risk Management Framework requires that cloud service providers be located in Pakistan and that all physical servers and data centres reside and operate from Pakistan. Separately, core banking systems that process or store customer data may not be put on a cloud at all. The outsourcing framework requires prior State Bank approval for any outsourcing arrangement outside Pakistan, bans offshore providers that are not themselves regulated, bans subcontracting of offshore work, and requires both customer consent and prior written State Bank approval before confidential customer information goes to an offshore provider. PAYMENTS AND E-MONEY — permission-based. Electronic money institutions may not outsource any function outside Pakistan without prior written approval from the State Bank. GOVERNMENT — closed. The Cloud First Policy 2022 confines government cloud deployments to Pakistani locations and requires private cloud infrastructure to be located in Pakistan. Restricted, confidential and secret classes of government data may only sit on government or private cloud inside the country. INSURANCE AND SECURITIES — no localisation rule found on the regulator's own site as at 18 August 2026. The Securities and Exchange Commission of Pakistan has issued a cyber security advisory circular but we found no cloud or data residency instrument. HEALTH, EDUCATION, GAMBLING — no rule found, checked 18 August 2026. Gambling is a criminal offence in Pakistan, so there is no licensed gambling sector to regulate. MAPPING AND GEOSPATIAL — restrictions almost certainly exist. The Survey of Pakistan publishes Surveying and Mapping Rules 2015 and 1981 rules on the publication, classification, issue and custody of maps, but both files are scanned images we could not read, so we do not assert their content.

The national picture is unrestricted, not blocklist or allowlist: there is no instrument that names permitted or forbidden destinations. In telecoms, transfer abroad is a discretionary approval from the Pakistan Telecommunication Authority under the critical telecom data regulations. In banking, it is prior approval from the State Bank, and for confidential customer information it is prior written State Bank approval plus the customer's own consent, with subcontracting by the offshore provider prohibited outright. Banks must also ensure that all information relating to outsourcing outside Pakistan remains available domestically and open to State Bank inspection at any time — a mirror requirement in practice. For electronic money institutions it is prior written State Bank approval for any offshore function. In the public sector, the Cloud Office inside the Ministry of Information Technology and Telecommunication signs off deviations. The 2023 draft privacy bill would introduce an adequacy test plus binding contracts and consent, and would forbid critical personal data leaving at all, but it is a draft.

There is no data protection authority in Pakistan, constituted or otherwise. The May 2023 draft bill would have created a National Commission for Personal Data Protection within six months of commencement; the bill was never enacted, so the Commission does not exist. The Pakistan Digital Authority, created by the Digital Nation Pakistan Act 2025, is genuinely operational: it has a chairman, it ran the consultation on the National Data Governance Policy 2026 and closed it on 5 August 2026, it runs the national data exchange layer, and it publishes a standards register. But its own Acts and Regulations page carries only the founding Act and the line that rules and regulations will be posted as they become available. It has issued no binding data rules. The 2025 amendment to the cybercrime law created two more bodies. The National Cyber Crime Investigation Agency took over cybercrime investigation from the Federal Investigation Agency. The Social Media Protection and Regulatory Authority was created on paper; we could not find any official website or published decision for it, so we do not treat it as operational. The national computer emergency response team is operational and issues security advisories dated 2026. Overall rating: dormant for data protection. That is a statement about privacy enforcement, not about banking or telecoms supervision, which are active and licence-backed.

FLOOR. The cybercrime law requires a service provider to retain its specified traffic data for a minimum period of one year, or such other period as the Pakistan Telecommunication Authority may notify, and to hand it over on a court warrant. Failure can attract a fine up to ten million rupees, roughly thirty-six thousand United States dollars. Electronic money institutions must maintain all necessary records for at least ten years or as required by other laws. Computer emergency response teams must securely retain data they receive for at least three years unless a competent authority extends or erases it. The critical telecom data regulations tell licensees to observe their licensed retention periods and to ask the regulator when the period is unclear, which means the real answer for a telecoms licensee sits in its own licence, not in a public rule. CEILING. No general deletion duty is in force. The draft National Data Governance Policy 2026 would introduce one for government data, saying personal data shall not be retained beyond the defined period except where required by law or judicial process, but it is not yet approved. The 2023 draft privacy bill would introduce a general one. CONFLICT. Because there is no general ceiling, there is nothing for the floors to conflict with. If the draft policy or bill is adopted, the pattern in both texts is that a specific legal retention requirement wins over the deletion duty.

CLOCK ONE — one hour. The Computer Emergency Response Team Rules 2023 require covered entities to summarily report incidents to their sectoral and to the national response team within one hour of the incident being identified, using best estimates and updating later. The rules cover federal and provincial government bodies and critical sectors including defence, telecom, banking, finance, power and utilities. CLOCK TWO — forty-eight hours. Financial institutions must report to the State Bank's Banking Policy and Regulation Department within forty-eight hours all established information or cyber security breaches involving financial loss, theft of confidential data, or a major disruption leaving customers without banking services for more than two hours. CLOCK THREE — seventy-two hours. Telecoms licensees must inform the Pakistan Telecommunication Authority within seventy-two hours of discovering a data breach or damage to critical telecom infrastructure or critical data. A large bank running its own network can be inside all three at once. There is no duty in force to notify affected individuals; the 2023 draft bill would have added a seventy-two hour duty to notify both the regulator and the person, but it is a draft.

1. THE RULES LIVE IN LICENCES. Because there is no privacy statute, the binding obligations sit in regulator frameworks and licence conditions. A compliance review that searches for a data protection act finds nothing and concludes Pakistan is open. The telecoms and banking rules are enforced through supervision and licensing, where the sanction is suspension or loss of licence rather than a headline fine. 2. NO CLOUD FOR CORE BANKING, ANYWHERE. The State Bank rule is not only about location. Core banking applications, services and business processes used to process or store customer and borrower data may not be placed under cloud-based outsourcing at all. Cloud is confined to non-core support such as collaboration tools, human resources and procurement. A local cloud region does not fix this. 3. BANK CUSTOMER DATA ABROAD NEEDS TWO KEYS. Sharing confidential customer information with an offshore provider needs both the customer's consent and prior written State Bank approval, and it is needed regardless of what the contract says. The offshore provider must itself be a regulated entity, and it may not subcontract at all. 4. CRIMINAL, NOT ADMINISTRATIVE. The cybercrime law creates prison sentences, including up to three years for using another person's identity information without authorisation. Investigators can compel a person holding decryption information to hand over readable data. This is personal exposure for staff, not a corporate fine. 5. THE ONE-HOUR CLOCK. Most incident playbooks are written around seventy-two hours. In Pakistan a critical-sector entity has one hour to make a first report to its sector and national response teams. Missing it is the most common failure we would expect. 6. THE TELECOM RULES WERE REPLACED IN 2025 AND THE NEW TEXT IS UNREADABLE. The regulator publishes a 2025 version of the critical telecom data regulations as a scanned image with no machine-readable text. The 2020 wording is what we can verify; the current wording may differ.

COMING. The draft National Data Governance Policy 2026, published by the Ministry of Information Technology and Telecommunication on 26 June 2026, sets a three-tier residency model. Tier one, covering restricted, confidential and personal data, must be hosted, stored and processed within the territory of Pakistan. Tier two, internal data, may be processed offshore only with prior approval from the Pakistan Digital Authority plus contractual safeguards. Tier three, open data, may be hosted anywhere. The document itself records its status as proposed, effective on gazette notification. The Pakistan Digital Authority announced on 5 August 2026 that consultation had concluded and the policy had moved from draft to final stage. Read the scope carefully: the text is framed around government data and public bodies, and it is not yet clear how far it will bind private companies. STILL A DRAFT. The Personal Data Protection Bill has existed in drafts dated 2018, 2020 and 2023 and has not been passed. The 2023 draft would forbid critical personal data leaving Pakistan, require an adequacy-style test for other transfers, create a National Commission for Personal Data Protection within six months, impose a seventy-two hour breach notification duty, and set penalties up to two million United States dollars or one per cent of annual gross revenue, whichever is higher. None of this binds anyone today. DORMANT SWITCHES, which matter more. 1. The telecoms regulator can refuse or withdraw approval for storing data abroad at any time, under a regulation that is already in force. No consultation is needed. 2. The cybercrime law lets the telecoms regulator change the traffic data retention period by notification, from the current one year to any period it chooses. 3. The 2025 amendment lets the new social media authority require any social media platform to enlist with it, on terms to be prescribed. The power exists; the rules have not been made. 4. The telecoms regulator's content blocking power is broad and immediate, and the 2025 amendment adds a twenty-four hour removal deadline for content the authority treats as false information. 5. The Pakistan Digital Authority has statutory power to develop and enforce a national data strategy and a data governance framework across both public and private sectors, and has published no rules yet.