Home › Compare laws side by side › PECA vs EU GDPR
PECA vs EU GDPR
Prevention of Electronic Crimes Act, 2016 (as amended by the Prevention of Electronic Crimes (Amendment) Act, 2025) (Pakistan) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.
| Topic | PECA Pakistan 13/14 facts confirmed by two sources | EU GDPR European Union (EEA) ✓ Confirmed by two sources |
|---|---|---|
| Status | In force. The 2025 Amendment Act got presidential assent 29 January 2025; constitutional challenges were being heard in the Islamabad High Court (as of July 2025), with no ruling found.✓ | In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓ |
| Who it applies to | Offences involving information systems and data in Pakistan, including unauthorised access, misuse of identity information and online content; service providers have data retention duties; social media platforms can be made to register.✓ | Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓ |
| Size thresholds | No size threshold. Service providers must retain traffic data for at least one year; social media platforms may be required to register with SMPRA.✓ | None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓ |
| Regulator | National Cyber Crime Investigation Agency (NCCIA, replaced the FIA's cybercrime role); Social Media Protection and Regulatory Authority (SMPRA); Pakistan Telecommunication Authority (PTA).✓ | National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓ |
| Breach or incident reporting | PECA sets no general breach-notification duty for businesses; sectoral rules (PTA, SBP) apply.✓ | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ |
| Deadline to answer personal data requests | Not applicable (PECA is a criminal statute; no data subject rights regime).✓ | 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓ |
| Data protection officer | Not applicable; no officer requirement under PECA.✓ | DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓ |
| Local representative | Being verified | Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓ |
| Sending data abroad | Not addressed by PECA.✓ | Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓ |
| Cookies and consent | Not addressed by PECA. Using someone's identity information without authorisation is an offence.✓ | Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓ |
| Maximum penalty | Cyber terrorism: up to 14 years and/or PKR 50 million. Unauthorised use of identity information: up to 3 years and/or PKR 5 million. Spreading fake information (s.26A): up to 3 years and/or PKR 2 million.✓ | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ |
= confirmed by two independent sources, at least one official.
Facts marked “Being verified” are still being confirmed and are not given as answers.
Who each law applies to
- PECA
- Offences involving information systems and data in Pakistan, including unauthorised access, misuse of identity information and online content; service providers have data retention duties; social media platforms can be made to register.
- EU GDPR
- Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.
What you must do under PECA
- Never use or share anyone's identity information without authorisation.
- If you are a service provider, retain traffic data for at least one year.
- If you run a social media platform, be ready to enlist with SMPRA and act on its orders (it must act on fake-information complaints within 24 hours).
- Train staff on unauthorised access and data misuse offences.
- Preserve logs and cooperate with lawful NCCIA requests.
- Review published content against the s.26A fake-information offence.
What you must do under EU GDPR
- Identify a lawful basis for every processing purpose and record it.
- Publish a clear privacy notice covering purposes, recipients, retention and rights.
- Keep a record of processing activities and sign Art 28 contracts with processors.
- Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
- Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
- Answer access, erasure and other rights requests within one month.
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@