Pakistan can no longer wait for personal data protection law

According to an opinion piece in The Express Tribune, Pakistan's digital economy is growing faster than its data protection rules. The writer cites a government inquiry which reportedly found that NADRA data on 2.7 million people was compromised between 2019 and 2023. He also refers to arrests announced by the National Cyber Crime Investigation Agency over alleged trade in call records and SIM information.

The writer argues that a dedicated law would be preventive, requiring organisations to gather only necessary data and keep it no longer than needed. Criminal statutes, by contrast, typically act once harm has already occurred. On the commercial side, IT and IT-enabled services exports are reported at about $4.5 billion, against a national goal of $25 billion within five years.

The piece notes that a revised draft Personal Data Protection Bill was published in 2023 after stakeholder consultations, so the groundwork is largely done. What remains, according to the writer, is political will to enact the law and build an implementation framework. Without it, Pakistani software houses, BPO providers and fintech firms could face contractual hurdles on foreign data projects.