The HR Legal Hub
Remote-Work Policy
Pakistan's labour statutes were written for premises, not laptops. Remote and hybrid work is lawful and common — but it runs on a stack of old rules applied by analogy, and the employer without a written policy is taking every open question by default.
Remote work arrived in Pakistan faster than legislation could follow it. Software houses hire across provinces, back-office teams serve foreign clients from home, and hybrid weeks are ordinary — while the statutes that govern all of it still speak of establishments, premises, and registers kept at the workplace. This article sets out what actually governs remote and hybrid arrangements as of July 2026 and what a written policy must settle. Several points below are genuinely unsettled; those are marked, and the working method for each is to take a deliberate position and document it.
No statute, same stack
Pakistan has no remote-work act, and none of the provincial labour codes has been amended to address distributed work directly. What that means is not deregulation but analogy. A remote employee is still an employee: the standing-orders framework still classifies a remote workman, wages still fall due under the Payment of Wages Act, 1936 lineage, EOBI contributions still accrue under the Employees' Old-Age Benefits Act, 1976, provincial social security still applies, and the shops and establishments law still governs the establishment the employee is attached to. The questions the statutes do not answer — whose province, whose electricity bill, what counts as the workplace — are answered instead by the contract and the policy. An employer without a written policy has answered them all by silence, and silence is construed against the drafter.
The province problem
The labour statutes allocate coverage by establishment location. A remote workforce breaks that assumption: the company is registered in Karachi, the employee works from Multan, and two provincial regimes — Sindh's and Punjab's — each have a plausible claim on the relationship. No statute or settled authority resolves the conflict [JURISDICTION OVER REMOTE EMPLOYEES — TO BE VERIFIED BY REVIEWING LAWYER], and a labour court in the employee's home province is unlikely to hold that it cannot hear its own resident.
The manageable response has three parts. Know where people actually are — an updated register of approved work locations, because "somewhere in Punjab" is not a compliance posture. Re-run the applicability analysis when hiring puts staff in a new province for the first time, since thresholds, figures, and forums shift. And on points where the candidate provinces diverge — leave figures, notice formalities — comply with the stricter one, which costs little and removes the argument. Employees who move provinces without telling anyone defeat all of this, so the policy should oblige staff to notify location changes and make approval of the new location explicit.
The contract layer
The single most valuable sentence in a remote-work policy states what remote work is: an arrangement approved by the company for a stated role, at a stated location, revocable on stated notice. Without it, a long-running remote arrangement hardens into a term of employment, and the return-to-office email becomes a unilateral variation — for a workman, the raw material of a grievance; for anyone, the start of an argument the employer created.
The contract or policy should therefore carry: the approved place of work; the company's right to recall to the office on defined notice; the employee's duty to maintain a workable, safe, and confidential workspace; hours and availability; and the statement that all other terms of employment continue unchanged. Hybrid arrangements deserve the same precision — which days, decided by whom, changeable how. Vague hybrid custom is where attendance disputes are born.
Hours need particular care. The shops and factories lineage limits working hours and premiums overtime for covered staff, and none of it switches off at home [APPLICATION OF HOURS LIMITS TO REMOTE WORK — TO BE VERIFIED BY REVIEWING LAWYER]. Since the employer can no longer see the workday, the policy substitutes structure for sight: defined working hours, a rule that overtime must be authorised in advance to be claimed, and honest time recording. Pakistan has no right-to-disconnect statute; a company that wants evening quiet writes it into policy or accepts the always-on default it has silently set.
Money: equipment, expenses, and allowances
Statute is silent on who buys the laptop, so drafting decides. The clean pattern: company-issued equipment for any role touching confidential or client data, recorded in an asset register, returnable at exit under the same discipline as the final settlement; a stated position on internet and power — a flat allowance, or an explicit statement that gross salary covers it; and uniform application, because ad hoc generosity becomes precedent. Allowances have tax consequences under the Income Tax Ordinance, 2001 and belong in the payroll design conversation, not in a manager's improvisation [TAX TREATMENT — TO BE VERIFIED BY REVIEWING LAWYER].
One overlooked corner: injuries. A workman injured at a home workstation raises a compensation question the Workmen's Compensation Act, 1923 lineage never contemplated [COVERAGE OF HOME-WORKING INJURIES — TO BE VERIFIED BY REVIEWING LAWYER]. The policy cannot settle the statute's scope, but it can require prompt reporting and preserve the record on which any claim will turn.
Data, devices, and watching the watchers
Remote work moves company data onto home networks and kitchen tables, and as of mid-2026 Pakistan still has no general data-protection statute in force — the Personal Data Protection Bill has circulated in successive drafts without enactment [LEGISLATIVE STATUS — TO BE VERIFIED BY REVIEWING LAWYER]. The operative constraints are the Prevention of Electronic Crimes Act, 2016, whose unauthorised-access and data-interference offences cut both ways — they protect the company against intrusion and constrain how far the company may reach into systems and accounts it does not own — plus contractual confidentiality obligations owed to clients, and sector rules for regulated businesses.
The policy's security core is short: company data only on company-controlled systems or approved, enforced configurations; encryption, screen locks, unique credentials, VPN access; no client work over shared household accounts or public networks; and an incident-reporting duty measured in hours with a named recipient. On monitoring, the defensible position is disclosed oversight of company systems: say in the policy what is logged — email on company accounts, endpoint activity on company devices, access records — obtain signed acknowledgment, and keep monitoring proportionate to a stated purpose. Covert or personal-device surveillance is where both PECA exposure and constitutional privacy arguments concentrate.
Two more doctrines follow the worker home. The anti-harassment framework, amended in 2022, should be treated as covering conduct on video calls and chat platforms; extend the code of conduct to online interactions expressly and train the inquiry committee accordingly. And a remote employee who works from abroad — increasingly common and casually approved — creates tax residence, withholding, and exchange-control questions in two countries at once [CROSS-BORDER REMOTE-WORK TREATMENT — TO BE VERIFIED BY REVIEWING LAWYER]. Make foreign remote work an exception requiring advice and written approval, not a Slack message.
Writing the policy
Assemble it in one document with signed acknowledgment: eligibility and approval; approved location and the duty to notify moves; recall rights; hours, availability, and overtime; equipment and expenses; security and monitoring disclosure; online conduct; incident reporting; and the annual review commitment. None of it is exotic drafting. Its value is that every question above gets answered once, deliberately, by the employer — instead of repeatedly, by default, in front of whichever forum the unanswered question eventually reaches.
The Checklist
Remote-work policy build checklist
Decisions to make and record before a remote or hybrid arrangement is offered to anyone.
- State in the policy that remote work is an arrangement the company approves, not an entitlement, unless you intend otherwise.
- Record each employee's approved work location and the provinces where remote staff actually sit.
- Re-run the labour-law applicability map whenever a remote hire puts staff in a new province.
- Reserve in writing the right to recall remote staff to the office, with a stated notice period.
- Define working hours, core availability windows, and how overtime is authorised and recorded remotely.
- State who provides equipment, who insures it, and what happens to it at exit.
- Decide the expense position — internet, power, workspace — and apply it uniformly.
- Issue company devices where the work touches confidential data, or set enforceable minimum standards for personal ones.
- Require screen locks, disk encryption, unique credentials, and a VPN for access to company systems.
- Tell staff in the policy exactly what the company logs and monitors on its systems, and obtain signed acknowledgment.
- Prohibit work on client-confidential matters from shared or public devices and networks.
- State how workplace injuries at a home workstation are to be reported and handled.
- Extend the anti-harassment code expressly to video calls, chat platforms, and messaging.
- Set a security-incident reporting duty with a named recipient and a deadline in hours.
- Take advice before approving any employee to work from outside Pakistan, and record the approval.
- Review the policy annually against pending data-protection legislation and provincial labour changes.
Questions, Answered
What clients ask most.
There is no dedicated remote-work statute as of mid-2026. The existing stack — standing orders, shops and establishments law, wage statutes, EOBI and social security, the harassment framework — continues to apply to remote employees, sometimes awkwardly. Regulation by analogy is still regulation; the absence of a remote-work act does not create a rule-free zone.
Unsettled, and the honest answer is to plan for both: the province of the registered establishment and the province where the employee actually works each have a claim to reach the relationship [REMOTE-WORK JURISDICTION ANALYSIS — TO BE VERIFIED BY REVIEWING LAWYER]. Practically, comply with the stricter position on any point where the two diverge, and record the reasoning.
Monitoring company-owned systems and accounts, disclosed in advance and acknowledged in writing, is the defensible model. Covert surveillance, webcam monitoring, or reaching into personal devices and accounts is where the risk concentrates — under the Prevention of Electronic Crimes Act, 2016's unauthorised-access offences and constitutional privacy jurisprudence [LIMITS ON EMPLOYEE MONITORING — TO BE VERIFIED BY REVIEWING LAWYER]. Monitor what you own, say that you do, and log access to the logs.
No statute answers this yet, so the contract and policy do. Most Pakistani employers either pay a flat monthly allowance or fold the cost into gross salary and say so. Whatever you choose, choose it in writing and apply it uniformly — and remember allowances carry payroll-tax treatment under the Income Tax Ordinance, 2001 that should be confirmed with your tax adviser [TAX TREATMENT OF REMOTE-WORK ALLOWANCES — TO BE VERIFIED BY REVIEWING LAWYER].
If the contract or policy reserved the right, yes, on reasonable notice. If remote work was granted with no recall language and has run for years, the employee may argue it became a term of employment that cannot be changed unilaterally — for workmen, an adverse unilateral change is grievance material. Reserve the right now, in writing, before you need it.
Proceed on the basis that it does. The Protection Against Harassment of Women at the Workplace Act, 2010, as amended in 2022, carries definitions of workplace broad enough to reach work interactions beyond physical premises [APPLICATION OF THE AMENDED DEFINITIONS TO VIRTUAL CONDUCT — TO BE VERIFIED BY REVIEWING LAWYER]. Your code of conduct and inquiry committee should treat online conduct between colleagues as squarely covered, because the Ombudsperson likely will.
Prepared by The First Counsel · As of 2026-07-12 · Pending professional review — statements flagged in the text are being verified
This publication is provided for general information only. It is not legal advice, and neither reading it nor corresponding with the firm about it creates a lawyer–client relationship. The position stated must be verified against current law before it is relied upon.