Technology, Data & AI

Not a comprehensive one in force as of mid-2026. The Personal Data Protection Bill has been through repeated drafts over several years without, to our knowledge, being enacted [LEGISLATIVE STATUS — TO BE VERIFIED BY REVIEWING LAWYER]. What exists instead is a patchwork: the offence provisions of the Prevention of Electronic Crimes Act 2016, constitutional privacy jurisprudence under Article 14, sectoral rules from regulators such as the State Bank and PTA, and contractual obligations businesses take on themselves. Companies handling personal data should build on that patchwork now rather than waiting for the statute.

The draft bill, in its successive versions, follows the international pattern: consent and lawful-basis requirements, data-subject rights, obligations on controllers and processors, restrictions on cross-border transfer of certain categories of data, a supervisory authority, and significant penalties. Preparing early is cheap because the direction of travel is clear even where details shift between drafts — data mapping, privacy notices, vendor contracts and security practices all carry over whatever final text emerges. Businesses serving foreign customers usually need most of this anyway to satisfy GDPR-driven contractual demands, as of mid-2026.

The Prevention of Electronic Crimes Act 2016 approaches data through criminal law rather than data-protection rights: it criminalises unauthorised access to information systems and data, unauthorised copying and transmission, interference with systems, and specific offences around identity information and dignity. That gives businesses a route against hackers, data thieves and rogue insiders, but it imposes nothing like a controller's duty of care toward the individuals whose data a business holds. It is a sword against intruders, not a framework for how you handle customer data.

It can. The GDPR reaches processing by companies outside the EU where they offer goods or services to people in the EU or monitor their behaviour — so a Pakistani SaaS or e-commerce business targeting European users can be within scope despite having no EU office. In practice the pressure usually arrives contractually first: EU and UK customers require data processing agreements and GDPR-grade commitments from Pakistani vendors as a condition of doing business. Ignoring it narrows your market well before any regulator notices you.

No statute in force as of mid-2026 imposes a general privacy-policy requirement on Pakistani businesses — but the practical mandates are real: app stores require one as a condition of listing, foreign customers and partners expect one, payment and advertising platforms demand one, and the draft data-protection regime assumes one. A privacy policy is also a contract-like public statement, so an inaccurate policy is worse than none: it converts sloppy data practice into misrepresentation. Publish one, and make it true.

What you collect, how you collect it, why, on what basis, how long you keep it, who you share it with — including analytics, advertising and cloud vendors — where it is stored, how users can reach you about their data, and how changes to the policy are notified. Write it to describe what the product actually does, verified against the engineering reality, not what a template imagines. If children can use the product or sensitive data is involved, say so specifically and handle it accordingly.

For most businesses, yes — as of mid-2026 there is no general statutory ban on transferring ordinary personal data out of Pakistan. The caveats are sectoral and contractual: regulated industries face localisation and approval requirements from their regulators, government-linked work often carries data-residency conditions, and the draft data-protection bill has proposed restrictions on cross-border transfer of certain data categories [CURRENT SECTORAL RULES AND BILL STATUS — TO BE VERIFIED BY REVIEWING LAWYER]. Contracts with your own customers may also promise data residency — check before you migrate.

Generally yes for ordinary commercial data, and most Pakistani startups do exactly that, since the major global providers have no full Pakistani region as of mid-2026. The legal work sits in the exceptions and the paperwork: sectoral localisation rules for regulated entities, customer contracts that promise where data lives, and your own privacy policy disclosing offshore hosting. Choose regions deliberately, document the arrangement, and keep an eye on localisation proposals in the draft data-protection regime.

There is no general, cross-sector breach-notification law in force as of mid-2026 — mandatory notification exists in pockets, through sectoral regulators such as the State Bank for its licensees and the PTA's security regulations for telecom operators, and through whatever your contracts promise customers [CURRENT SECTORAL REQUIREMENTS — TO BE VERIFIED BY REVIEWING LAWYER]. Contractual notification duties are usually the binding ones for tech businesses: B2B agreements routinely require notice within short defined windows. An incident-response plan should map every notification duty before the incident, because counting them during one is misery.

The Prevention of Electronic Crimes Act 2016 criminalises, among other things: unauthorised access to information systems and data, unauthorised copying or interference, electronic forgery and fraud, identity crime, cyberstalking and harassment, offences against dignity and modesty, hate speech, and spamming and spoofing. Amendments — most recently in 2025 — have reshaped the enforcement and content-regulation architecture around the offences. For businesses, the fraud, unauthorised-access and data-theft provisions are the ones most often invoked, in both directions.

As of mid-2026, cybercrime complaints go to the National Cyber Crime Investigation Agency (NCCIA), which took over the mandate previously held by the FIA's cybercrime wing, and complaints can be lodged through its reporting channels or at its circle offices. A business complaint moves faster when it arrives investigation-ready: preserved logs and screenshots, a timeline, the financial trail, and the specific PECA offences engaged. Treat the complaint as the start of a process that benefits from legal follow-up, not a fire-and-forget report.

Preserve evidence before you remediate — forensic images, logs, the phishing message — because cleanup that destroys the trail weakens every later step. Then, in parallel: contain and restore, file the NCCIA complaint, check the notification duties in your customer contracts and any sectoral rules, and use platform recovery processes for hijacked accounts, which respond better to documented ownership evidence. If money moved, notify the banks on both ends immediately; recall of funds is time-critical. Legal privilege over the investigation is worth establishing early if litigation looks likely.

Yes. Unauthorised access, copying or transmission of data under the Prevention of Electronic Crimes Act 2016 can apply to insiders who exceed their authority, alongside civil claims for breach of confidence and breach of the employment contract's confidentiality and IP terms. The recurring evidentiary problem is authorisation: prosecutions falter where the employee had broad legitimate access and nothing defined its limits. Access controls, confidentiality undertakings and logging are what convert 'we trusted them' into a provable case.

Yes — the absence of a data-protection statute does not mean the absence of liability. Exposure runs through contract, where your agreements and published policies promised security or confidentiality; through negligence, where careless handling causes provable loss; and through sectoral regulators where you are licensed. For B2B businesses the sharpest edge is contractual: indemnities and breach clauses in customer agreements often specify exactly what a leak costs. Security spending and vendor due diligence are, in that light, litigation defence.

Unsolicited bulk messaging is not a free-for-all: the Prevention of Electronic Crimes Act 2016 contains a spamming offence directed at unsolicited transmissions, and the PTA regulates telemarketing and bulk SMS through its frameworks for telecom operators, including opt-out and blocking mechanisms [CURRENT PTA REGULATIONS — TO BE VERIFIED BY REVIEWING LAWYER]. Consent-based marketing with a working unsubscribe is both the defensible position and the direction the draft data-protection regime points. Bought contact lists are where legal risk and brand damage meet.

There is no AI-specific statute in force as of mid-2026. The federal government has moved at policy level — a National AI Policy has been through approval processes [STATUS — TO BE VERIFIED BY REVIEWING LAWYER] — while actual legal exposure for AI use runs through existing law: contract, negligence, PECA 2016 for misuse, copyright for training data and outputs, and sectoral regulators where AI touches finance, health or telecom. Businesses deploying AI should treat governance as contractual and internal for now, and watch the policy space, because rules tend to follow incidents.

Only if your paper allows it. Check three layers: your privacy policy and terms — training is a purpose users must actually have been told about; your B2B contracts — customer agreements and DPAs frequently prohibit using customer data beyond service delivery, and training on one customer's data to benefit others is a classic breach; and confidentiality obligations attaching to specific data sets. Anonymisation and aggregation reduce risk if done genuinely rather than nominally. If the current documents do not cover training, amend them prospectively rather than assuming silence is consent.

Unsettled. The Copyright Ordinance 1962 was built around human authorship and has no provision addressing works generated by AI, and there is no Pakistani case law resolving the question, as of mid-2026. In practice, ownership is being allocated by contract: AI platform terms state what rights users get in outputs, and businesses should mirror the point in employment, contractor and customer agreements so that whatever rights exist land in the right hands. For anything brand-critical, human authorship and creative input remain the safer foundation for enforceable rights.

The business deploying it, in the first instance — Pakistani law has no AI-specific liability regime, so a customer harmed by an AI-assisted decision or output will sue the company they dealt with, in contract or negligence, not the model vendor. Your recourse against the vendor is whatever the platform terms give you, which is typically very little: broad disclaimers and tight liability caps are standard. The working protections are operational and contractual — human review at consequential decision points, accuracy disclaimers in your own customer terms, and vendor contracts negotiated rather than clicked through where the stakes justify it.

Expect to sign them. EU, UK and increasingly other foreign customers are themselves legally required to bind their processors, so a Pakistani SaaS provider handling their users' personal data will be handed a DPA — covering processing instructions, security measures, sub-processor controls, breach notification and audit rights — plus standard contractual clauses for the transfer, since Pakistan holds no adequacy status. Review before signing: DPAs allocate real liability, and the sub-processor and breach-notice clauses must match what your own stack and vendors can actually deliver. A pre-prepared, honest DPA of your own shortens every enterprise sales cycle.