Home › Law library › Pakistan PDP Bill
PK
Pakistan PDP Bill
Personal Data Protection Bill (Ministry of IT & Telecommunication draft, 2023 version)
Sourced. Last verified 9 October 2026
Pakistan Privacy
- Status
- Bill — not yet law. As of Aug 2026 Pakistan has no comprehensive data protection law; the 2023 draft has not passed Parliament.
- Who it applies to
- Proposed: controllers and processors handling personal data in Pakistan; final scope may change on enactment.
- Size thresholds
- Not applicable until enacted.
- Regulator
- None yet. The bill proposes a National Commission for Personal Data Protection within six months of the law taking effect.
- Breach or incident reporting
- Proposed: notify the Commission and affected people without undue delay, within 72 hours where feasible (not in force).
- Deadline to answer personal data requests
- Being verified
- Data protection officer
- Being verified
- Local representative
- Being verified
- Sending data abroad
- Being verified
- Cookies and consent
- Being verified
- Maximum penalty
- Being verified
Facts marked “Being verified” are still being confirmed and are not given as answers.
What you must do
- Treat the PDP Bill as pending; no statutory duties apply yet.
- Follow sectoral rules (SBP, PTA) and PECA in the meantime.
- Prepare a 72-hour breach response plan, which the draft would require.
- Map personal data flows now to speed up compliance when the law passes.
- Watch MoITT and Parliament for enactment and Commission set-up.
Recent changes
No enactment. MoITT set a new drafting deadline in March 2025; commentators in Aug 2026 still urge enactment of the 2023 draft.
Sources
- Second source: https://tribune.com.pk/story/2625470
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email [email protected].