Law: There is no general personal data protection law.

Regulator: There is no general data protection authority.

Summary: There is no general personal data protection law in Pakistan, however, the Ministry of Information Technology and Telecommunication (MITT) has released the Personal Data Protection Bill 2023 (the Bill). The Bill received the approval of the Federal Cabinet of Pakistan but is yet to be promulgated into law. If enacted, the Bill will be the main law for regulating personal data protection in Pakistan. The Bill would apply to any person who processes, has control over, or authorizes the processing of personal data, provided that the data subject, data controller, or data processor (either local or foreign) is located in Pakistan.

Presently, the Constitution of the Islamic Republic of Pakistan (the Constitution) provides for the fundamental right to privacy. Additionally, the Prevention of Electronic Crimes Act, 2016 (PECA) is the primary legislation that provides a legal framework in relation to various kinds of electronic crimes and also extends to unauthorized access to personal data.