Privacy is a fundamental and inalienable right under the Constitution of Pakistan. Pakistan is in the process to develop a specific law on personal data protection. A draft bill (Personal Data Protection Act, 2023/”the draft Bill”) has been developed by the Ministry of Information Technology and Telecommunication. The draft Bill has been approved by the Federal Cabinet and will now be presented before the legislature (National Assembly and Senate of Pakistan) and thereafter will be promulgated as a law. The draft Bill is not sector-specific but is applicable on processing of personal data by any sector. The draft Bill is applicable when either of data controller, data processer or data subject is present in Pakistan. The draft Bill would also be applicable to those data controllers and data processers who are not incorporated in Pakistan but are digitally or non-digitally operational in Pakistan and are involved in commercial or non-commercial activity in Pakistan.

The draft bill would also be applicable to any data controller or processor who collect the personal data of any data subject present within territory of Pakistan which also includes any foreigner who will be physically present in Pakistan.  The draft Bill would also be applicable on processing of personal data by data controllers and data processers who are not established in Pakistan but are in a place where Pakistan law is applicable due to private or public international law.

On promulgation of the draft Bill as a law, a National Commission for Personal Data Protection of Pakistan (the Commission) is to be established by the Federal Government of Pakistan. The Commission will be a regulator and will enforce and implement the draft Bill.

Apart from above, sectoral regulatory framework concerning data protection may be seen for banking and telecom sectors. State Bank of Pakistan (the SBP) and Pakistan Telecommunication Authority (the PTA) respectively are the regulators for banking and telecom sectors in Pakistan. The SBP and the PTA have developed certain regulations concerning the protection of their respective consumers including regulations for protection of personal data of the banking and telecom consumers.

It is expected that draft Bill will be presented before the parliament to be promulgated as a law. E-safety Bill 2023 has also been approved by the cabinet in August 2023, which is to be presented before the legislature for approval and promulgation. The E-safety Bill aims to prevent crimes such as Cyber bullying, online harassment and blackmailing.

The draft Bill does not place any specific requirement for registration or licensing of data controllers or data processers. The draft Bill, however, while describing the functions of the Commission provides that the Commission is to formulate a registration framework for data controllers and data processers. It follows that the Commission after its establishment may formulate registration regime for the data controllers and data processers. The law further provides exemptions for the data controllers and/or data processors who are already registered with any public body, shall only be required to intimate to the established Commission.

“personal data” means any information that relates directly or indirectly to a data subject, who is identified or identifiable from that information or from that and other information in the possession of a data controller and/or data processor, including any sensitive or critical personal data. Provided that anonymized, or pseudonymized data which is incapable of identifying an individual is not personal data.

“sensitive personal data” means and includes data relating to access control (username and/or password), financial information such as bank account, credit card, debit card, or other payment instruments, computerized national identity card, passports, biometric data, and physical, behavioral, psychological, and mental health conditions, medical records, and any detail pertaining to an individual’s ethnicity, religious beliefs, political affiliation, physical identifiable location, travelling details, pictorial or graphical still and motion forms, IP address and online identifier.

“critical personal data” means such personal data retained by the public service provider- excluding data open to the public-as well as data identified by sector regulators and classified by the Commission as critical or any data related to international obligations.

“data subject” means a natural person who is the subject of the personal data.

“data controller” means a natural or legal person or the government, who either alone or jointly has the authority to make a decision on the collection, obtaining, usage or disclosure of personal data.

“data processor” means a natural or legal person or the government who alone or in conjunction with other(s) processes data on behalf of the data controller.

“foreign data subject” means a data subject who is not Pakistani national.

“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the collecting, obtaining and processing of personal data relating to him or her.

“personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

The draft Bill provides following general principles for processing of personal data:

• Personal data be collected for specified, explicit and legitimate purpose
• Personal data is not to be processed in a manner incompatible with the purposes for which it was collected
• Personal data is to be adequate, relevant and limited to what is necessary in relation to the purpose for which it was collected
• Personal data is to be processed for a lawful purpose directly related to an activity of the data controller
• Processing of personal data is necessary or is directly related to that lawful purpose
• Personal data is adequate and not excessive in relation to that lawful purpose
• The data controllers and processors need to be registered with the Commission as specified.
• Those data controllers and processors who will fall within the category of the “Significant” shall have to appoint a data protection officer.

As a general rule no personal data is to be processed without consent of the data subject. A separate consent is required form data subject for each purpose. The draft Bill provides following exceptions when personal data may be processed without consent of the data subject:

• When processing is necessary for the performance of a contract to which the data subject is a party
• When the processing is necessary to take steps at the request of the data subject to enter into a contract.
• When processing is necessary for compliance with any legal obligation to which the data controller is the subject, other than an obligation imposed by a contract
• When the processing is necessary for the treatment, public health, medical or research purposes or to respond to any medical emergency involving a threat to the life or health of a data subject or any other individual.
• When processing is necessary to protect the vital interests of the data subject
• When processing is necessary for the administration of justice pursuant to an order of the court of competent jurisdiction
• When processing is necessary for legitimate interests pursued by the data controller
• When processing is necessary for the exercise of any functions conferred on any person by or under any law

The draft Bill does not speak about the form, content and administration of the consent. The definition of “consent” as provided for in the draft Bill depicts the underlying concept based upon the principles of freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the collecting, obtaining and processing of personal data relating to him or her. So the form may not be as important but the substance should be met.

Under the draft Bill, sensitive personal data may only be processed in following situations:

• with the explicit consent of the data subject (when that consent is not restricted by any other applicable law)
• for the purposes of exercising or performing any right or obligation imposed by law on the data controller in connection with employment
• to protect the vital interests of the data subject
• for medical purposes
• in connection with any legal proceedings
• for obtaining legal advice (while ensuring its integrity and secrecy)
• for the purposes of establishing, exercising or defending legal rights
• processing is necessary for the administration of justice pursuant to orders of a court of competent jurisdiction
• for the exercise of any functions conferred on any person by or under any law
• where the information contained in the personal data is made public advertently by the data subject.

There are no categories of personal data which are prohibited from collection under the draft Bill.

Health data is covered with in the definition of sensitive personal data, therefore the requirements as discussed at Question 8 are applicable.

The draft Bill is not applicable on an individual processing personal data only for the purposes of his personal, family, household and recreational purposes.

The Bill has protected the interests of the children during the processing of the personal data, the law has defined the child as “ a person who has not attained the age of eighteen years.”

The Bill makes it obligatory for the data controllers and processors that they must protect the rights and interests of the children while processing his/her personal data.

The data controller or a data processor shall verify the age of the child, that whether it fall within the definition of a child and if the data subject fits the definition of the child the data controller/processor shall seek consent of the child’s parent or relevant person or any authorized person having parental responsibility over the child to decide on his behalf.

The law also emphasizes on the matter that  no personal data of a child must be processed by a controller or processor that is likely to cause him harm.

Please see the answer of question No.2

Pakistan Telecommunication Authority (PTA) regulates the online content. The PTA has issued parental guidelines for the protection of children’s rights from cyber bullying. The consumer can file a complaint with the PTA against any cyber bullying and for removal of the inappropriate content. The complaint can be made either via online or through a helpline number.

For legal and criminal proceedings the compliant is to be logged with the Cyber Crime wing of the Federal Investigation Agency (FIA).

Please see the answer of question No.2.

The draft Bill does not contain the concepts of “privacy by design” or “privacy by default”. The Commission, based upon national interest, is to prescribe best international standards to protect personal data from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction. The data controller and data processer are to follow the standards so prescribed by the Commission. The standards to be prescribed by the Commission may account for the concept of “privacy by design” or “privacy by default”.

The data controllers are to intimate the Commission on a regular basis the type of data they are collecting and processing. Procedural aspects for this reporting requirements are to be devised by the Commission.

In addition, the data controller is to keep and maintain record of each application, notice, request or any other information relating to personal data that has been or is being processed by the data controller. The Commission is to determine the manner and form in which such record is to be maintained. As the law, on the subject, has not been promulgated yet therefore practically such requirements are not being met.

The draft Bill provides that personal data processed shall not be kept longer than is necessary for the fulfillment of the purpose or as required under the law. The draft Bill further mandates the data controller to take all reasonable steps to ensure that all personal data is destroyed or permanently deleted if it is no longer required for the purpose for which it was to be processed.

The draft Bill does not place any mandatory requirement on the data controllers or the data subjects to consult with the Commission. However, one of the functions of the Commission under the draft Bill is to engage, support, guide, facilitate, train and persuade data controllers and data processers to ensure personal data protection. It follows that the Commission may contact data controllers/data processors in furtherance of the objects of the draft Bill.

The draft Bill does not require or recommend conducting risk assessment regarding personal data processing activities. However, the draft Bill empowers the Commission to formulate a compliance framework with regard to data protection impact assessment. It follows, that on promulgation of law and after establishment of the Commission, the Commission will frame rules with respect to data protection impact assessment.

The data controllers and processors identified as significant by the commission shall be required to appoint a data protection officer. The draft Bill empowers the Commission to formulate a compliance framework with regard to responsibilities of data protection officer. It follows, that on promulgation of law and after establishment of the Commission, the Commission will frame rules with respect to appointment of data protection officer.

The draft law does not require or recommend employee training.

The draft Bill provides that a data controller is to give a written notice to the data subject. The said notice is to inform the data subject following:

• That personal data of the data subject is being collected and a description of the personal data
• The legal basis for processing of personal data
• The time duration for which personal data is likely to be processed and retained
• The purpose for which personal data is being collected and further processed
• The information as to source of the personal data
• Information with respect to any cross-border transfer of personal data.
• The data subject’s right to request access the data and to request correction and how to contact the data controller for any inquiries or complaints
• The class of third parties to whom data is disclosed or to be disclosed
• The choices and means data controller offer for restricting processing of personal data
• Whether it is obligatory or voluntary for the data subject to provide personal data and where it is obligatory the consequences for failure to provide personal data

The said notice is to be given as soon as reasonably possible when:

• The data subject is first asked by the data controller to provide personal data
• The data controller first collects the personal data
• Before the data controller uses personal data for a purpose other than the purpose for which personal data was collected
• Before the data controller discloses the personal data to a third party

The said notice is to be given in Urdu and English languages with clear and readily accessible means to exercise choice by the data subject.  It can also be served digitally.

The draft Bill distinguishes between the data controller and data processer (as defined at question 3). The data controller is to ensure that data processer undertakes to adopt applicable technical and organizational security standards to protect the personal data. The draft Bill further requires that the data processer is independently liable to take steps to ensure compliance with the prescribed security standards.

The draft Bill has conferred certain obligations upon data controllers it has also required some steps to be followed by the data processors.

A data processor while collecting the personal data of the subjects must take practical measures to protect the personal data processed, such practical measures are to be taken while considering the natural of the personal data and harm it may experience. The data processor shall be independently liable for adaptation of such steps that will ensure its compliance with the prescribed security standards. Moreover, a data processor is under obligation to notify the data controller and commission about any personal data breach it became aware of. The law has also placed certain obligations upon data processor with respect to the processing of the personal data of the children.

The draft Bill does not provide any guidance on contractual arrangements between the data controllers and the data processers.

The draft Bill does not provide any guidance specifically with respect to the appointment of processors.

The draft Bill provides a right to the data subjects to not to be subjected to a decision solely based on automated processing including profiling. These terms have not been defined in the draft Bill. No further details/restrictions are mentioned in the draft Bill.

The draft Bill does not discuss about cross-contextual behavioral advertising, except the right to the data subjects against the automated decision making and profiling, and right to object against direct marketing.

The sale of personal information is not currently addressed in any law.

The Pakistan Telecommunication Authority (the PTA) has issued “Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communication Regulations, 2009” (the Regulations). The Regulations apply to all telecom operators licensed by the PTA to ensure and protect the interests of telecom consumers by preventing them from spam, fraudulent, unsolicited and obnoxious communication. A few important terms are defined by the Regulations as follows:

“Do Not Call Register (DNCR)” means a database, maintained by the operators, containing the particulars of subscriber(s) who make a request for not receiving the unsolicited calls.

“Fraudulent Communication” means the transmission of message/statement which is false and misleading.

“Obnoxious Communication” means the transmission of message/statement with the intent to cause harassment or disturbance.

“Spamming” means the transmission of harmful, fraudulent, misleading, illegal or unsolicited messages in bulk to any person without the express permission of the recipient, or causing any electronic system to show any such message or is being involved in falsified online user account registration or falsified domain name registration for commercial purpose.

“Telemarketer” means a person who initiates a call for the purpose of marketing of services, investment and goods to public at large through telecommunications services.

“Unsolicited calls” means calls made to those numbers recorded in the Do not call register.

The Regulations require all operators to establish standard operating procedures to control spamming, fraudulent communication, unsolicited calls and obnoxious calls. The operators are also required to establish a “Do Not Call Register” in connection with controlling unsolicited calls. The Operators are also required to ensure registration of telemarketers.

Biometric is included within the definition of “sensitive personal data” and rules as explained at question 7 are applicable in relation thereto.

Ministry of Information Technology and Telecommunication has prepared a draft of Pakistan National Artificial Intelligence Policy, 2023. The policy framework is envisaged to provide a complete AI-enabling ecosystem in Pakistan, covering all aspects of awareness, skill development, standardization, and ethical use.

The draft Bill provides that personal data may be transferred outside Pakistan in following situations:

• Equivalent protection
• Consent of the data subject
• Under a framework to be devised by the Commission

Critical personal data is not allowed to be transferred outside Pakistan. Critical personal data shall only be processed in a server(s) or digital infrastructure located within the territory of Pakistan. The Commission is to devise a mechanism for keeping some components of sensitive personal data within Pakistan (data localization of some of the sensitive personal data).

The Commission may allow for the transfer of personal data outside Pakistan in the following cases:

• In presence of Binding contract/agreement.
• Where the data exporter has obtained the explicit consent of the data subject that does not conflict with the public interest or national security of Pakistan;
• Where International cooperation is required under relevant international obligations;
• Cross border data transfer shall be allowed with respect to any further conditions specified by the Commission.

The Commission, considering the national interest, is to prescribe best international standards to protect personal data from any loss, misuse, modification, unauthorized or accidental access, disclosure, alteration or destruction. Data controllers and data processers are to take practical measures, while processing personal data, as prescribe by the Commission to protect the personal data.

The term “personal data breach” is defined in the draft Bill as mentioned at question 4.

The draft Bill does not provide any sector specific security requirements.

The draft Bill requires the data controller to report a data breach to the Commission and to the data subject within 72 hours.  The exception is where the personal data breach is unlikely to result in a risk to the rights and freedoms of the data subject. In case the notification is made beyond 72 hours, the notification is to state reasons for the delay.

The notification must contain the following information:

• Description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned.
• Name and contact details of the Data Protection Officer or other contact point where more information can be obtained.
• Likely consequences of the personal data breach.
• Measures adopted or proposed to be adopted by the data controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

The Prevention of Electronic Crimes Act, 2016 (the PECA) was promulgated to prevent unauthorized acts with respect to information systems and to provide for related offences and mechanism for their investigation, prosecution and trial. The PECA is a criminal law and recognizes various acts as being an offence like:

• Unauthorized access to information system or data
• Unauthorized copying or transmission of data
• Interference with information system or data
• Electronic forgery
• Electronic fraud
• Unauthorized use of identity information

Pakistan has no separate cybersecurity regulator. The Federal Investigations Authority is responsible to implement and enforce the PECA with reference to cyber-crimes.

The draft Bill confers following rights to the data subjects, exercisable through submission of a request to data controller:

• Right of access to personal data
• Right to correct personal data
• Right to withdrawal of consent
• Right to prevent processing likely to cause damage or distress
• Right to erasure
• Right to nominate
• Right to redressal of grievance
• Right to data portability and automated processing
• Right not to be subjected to a decision solely based on automated processing including profiling

The draft Bill provides the instances where a data controller may refuse to comply with a request by data subject to have these rights, as follows:

Right of Access to Personal Data

• The data controller is not supplied with such information as the data controller may reasonably require.
• The data controller cannot comply with the data access request without disclosing personal data relating to another individual who can be identified from that information.
• Providing access may constitute a violation of an order of a court.
• Providing access may disclose confidential information relating to business of the data controller.
• The requested access is regulated by another law.

Right to Correct Personal Data

• The data controller is not supplied with such information as the data controller may reasonably require.
• The data controller is not supplied with such information as it may reasonably require to ascertain in what way the personal data to which the data correction request relates is inaccurate, incomplete, misleading or not up-to-date.
• The data controller is not satisfied that the personal data to which the data correction request relates is inaccurate, incomplete, misleading or not up-to-date.
• The data controller is not satisfied that the correction which is the subject of the data correction request is accurate, complete, not misleading or up-to-date.
• Where any other data controller controls the processing of the personal data to which the data correction request relates in such a way as to prohibit the first-mentioned data controller from complying, whether in whole or in part, with the data correction request.

Right to Prevent Processing Likely to Cause Damage or Distress

• Where the data subject has given his consent.
• Where the processing of personal data is necessary:
  1. for the performance of a contract to which the data subject is a party.
  2. for the taking of steps at the request of the data subject with a view to entering a contract.
  3. for compliance with any legal obligation to which the data controller is the subject, other than an obligation imposed by contract.
  4. in order to protect the vital interests of the data subject.

Right to Erasure

When processing is necessary for:

• Exercising the right of freedom of expression and information.
• Compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• Reasons of public interest in the area of public health.
• Archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
• The establishment, exercise or defence of legal claims.

To enforce the individual data privacy rights a data subject is to present a complaint before the Commission. In case the data subject is not satisfied with the decision in complaint (of the Commission), the data subject has the right to present an appeal before the High Court or to the Tribunal established by the Federal Government for the purpose in the manner prescribed by the High Court.

An individual or relevant person, under the draft Bill, may file a complaint on its own before the Commission against any violation of personal data protection rights conferred under the draft Bill, conduct of any data controller, data processer or their processes.

The draft Bill does not provide for entitlement for any monetary damages or compensation to the affected data subjects.

The Commission would act as a regulator and enforcer of the subject matter. The data subjects may file a complaint to the Commission for enforcement of their rights, as explained at question 40.

The draft Bill does not provide any guidelines or rules regarding the calculation of fines or thresholds for imposition of sanctions.

Orders of the Commission are appealable to the High Court (or to a Tribunal established by the Federal Government for the purpose in the manner prescribed by the High Court). Any person aggrieved by the order of the Commission may prefer such an appeal.

As the law (the draft Bill) has yet been promulgated, therefore there are no enforcement activity.

No information is available regarding any proposal to reform data protection or cybersecurity laws.