Pakistan can no longer wait for personal data protection law

Pakistan’s digital economy is growing rapidly, but its legal safeguards for personal information have not kept pace. Recent data breaches and cybercrime cases highlight the increasing risks to citizens, businesses and government institutions.

A government inquiry reportedly found that personal information of around 2.7 million citizens stored by NADRA was compromised between 2019 and 2023. In May 2025, the National Cyber Emergency Response Team warned that credentials belonging to more than 180 million internet users had appeared in an unsecured database.

The National Cyber Crime Investigation Agency has also reported arrests involving the alleged illegal sale of call records, SIM information, family registration details and location data.

These incidents underline the urgent need for a comprehensive Personal Data Protection Law (PDPL). Such legislation would protect citizens’ privacy, consistent with Article 14 of the Constitution, while establishing clear rules for collecting, processing, storing and sharing personal information.

It would also require organisations to maintain security measures, report breaches and provide individuals with meaningful rights and remedies.

Existing cybercrime laws are important but largely address wrongdoing after it occurs. A data protection framework would be preventive, requiring organisations to minimise data collection, use information for legitimate purposes and retain it only when necessary.

A strong PDPL would also benefit Pakistan economically. IT exports have reportedly reached around $4.5 billion, with ambitions of reaching $25 billion.

International clients increasingly demand strong privacy safeguards before transferring personal data across borders. Without such protections, Pakistani IT firms, fintech companies, BPOs and technology businesses may face additional contractual requirements or lose international opportunities.

Countries including the EU member states, UK, Singapore, Brazil, Saudi Arabia, UAE, China and India have already introduced comprehensive privacy laws. Pakistan also has a foundation in the 2023 draft Personal Data Protection Bill, which incorporates internationally recognised principles.

The priority now is political commitment, effective implementation and independent oversight. A modern PDPL would protect citizens, strengthen digital trust and support Pakistan’s ambitions in the global digital economy.