Data Privacy Debate
Data Privacy Debate: Pakistan still lacks a complete data privacy law. The Personal Data Protection Bill has remained in draft form since 2018. The government has delayed the bill for years. This has created the impression that Pakistan has stopped working on data protection. Recent developments challenge this view.
Policy Finalization Process
In June, the Ministry of Information Technology and Telecommunication released the draft National Data Governance Policy 2026. It invited public feedback. The consultation ended on July 10. This week, the ministry and the Pakistan Digital Authority held a high-level meeting. They discussed the final policy. The government plans to seek cabinet approval. It will then issue the policy officially.
Focus on Government Data
The policy is not a privacy law. It does not mainly control private companies. It focuses on government data. This matters because private companies often handle government information. They run call centers. manage cloud systems. They also process citizens’ data for government departments.
Wider Compliance Requirements
The policy covers many organisations. These include contractors and service providers. It also covers companies that process government data. Many technology companies may therefore face new requirements. Government contracts may introduce these requirements. Procurement rules may also include them.
Stronger Data Controls
The policy classifies government data by sensitivity. It also controls where companies can store and process certain data. It places stronger controls on sensitive data transfers. Companies must report certain security incidents to the Pakistan Digital Authority. Citizens will also gain more information. They can know who accessed their data and why.
Decentralised Data Sharing
The policy does not create one central government database. Each government department will keep ownership of its data. The WASL framework will support secure data sharing. It will follow security standards and data classifications. This creates a more decentralised system.
Data as National Asset
The policy also changes the government’s view of data. It treats government data as a national asset. The state holds this data for the people. Organisations that handle this data will have more responsibilities. They must protect it throughout its life cycle.
Phased Policy Implementation
The policy will start in phases after cabinet approval. The government will then issue an official notification. The Pakistan Digital Authority will help organisations prepare. The National Data Strategy will provide more details. Companies should prepare for new requirements. These may cover data storage, security, reporting and access.
Data Management Challenges
Many companies face a basic challenge. They may also lack clear records of data movement. They may not know who can access the data. Companies must improve their systems and documentation.
Compliance Creates Opportunities
These rules can also create opportunities. Pakistan’s IT and IT-enabled services exports crossed $4.6 billion in the latest fiscal year. Many Pakistani technology companies already follow global standards. European clients often require GDPR compliance. US clients also demand strong security systems. Companies can use these existing systems to meet local requirements.
Evolving Data Regulation
This development shows a new approach to regulation. Governments no longer rely only on laws. They also use contracts and procurement rules. They use infrastructure requirements and technical standards too. Companies must therefore watch these requirements closely.
Pakistan still needs a complete data protection law. The Personal Data Protection Bill remains important. The country needs a law that protects personal data in both sectors. However, companies should not wait for that law. They should improve their data practices now.
Changing Privacy Landscape
The National Data Governance Policy does not solve every privacy problem. It was never designed to do so. However, it shows a clear change. Data governance is already moving forward. Technology companies will face new responsibilities. These responsibilities will come through contracts and government projects. Pakistan’s privacy debate is changing before parliament passes a complete privacy law.
Published in Dawn, 6th August 2026
