Home › Law library › Pakistan PDP Bill
Pakistan PDP Bill
Personal Data Protection Bill (Ministry of IT & Telecommunication draft, 2023 version)
Sourced · 10/14 facts confirmed by two sources. Last verified 10 October 2026
Next full re-check due: . Regulator news is checked monthly; changes are logged in the change log.
Cite this page: GlanceDesk Jurisdiction, “Pakistan PDP Bill (Pakistan)”, glancedeskjurisdiction.com/laws/pk-pdpb, last verified 10 October 2026.
Pakistan Privacy
- Status
- Bill — not yet law. As of Aug 2026 Pakistan has no comprehensive data protection law; the 2023 draft has not passed Parliament.✓
- Who it applies to
- Proposed: controllers and processors handling personal data in Pakistan; final scope may change on enactment.✓
- Size thresholds
- Not applicable until enacted.✓
- Regulator
- None yet. The bill proposes a National Commission for Personal Data Protection within six months of the law taking effect.✓
- Breach or incident reporting
- Proposed: notify the Commission and affected people without undue delay, within 72 hours where feasible (not in force).✓
- Deadline to answer personal data requests
- Being verified
- Data protection officer
- Being verified
- Local representative
- Being verified
- Sending data abroad
- Proposed (not in force): 'critical' personal data must be processed only on servers in Pakistan; other data may go abroad to countries with adequate protection, or with Commission-approved safeguards or explicit consent.✓
- Cookies and consent
- Being verified
- Maximum penalty
- Proposed (not law): May 2023 draft allows fines up to USD 2 million (or PKR equivalent) for unremedied contraventions, with lower caps for unlawful processing (USD 125,000; USD 500,000 for sensitive and USD 1 million for critical data).✓
Facts marked “Being verified” are still being confirmed and are not given as answers.
What you must do✓
- Treat the PDP Bill as pending; no statutory duties apply yet.
- Follow sectoral rules (SBP, PTA) and PECA in the meantime.
- Prepare a 72-hour breach response plan, which the draft would require.
- Map personal data flows now to speed up compliance when the law passes.
- Watch MoITT and Parliament for enactment and Commission set-up.
Recent changes
No enactment as of October 2026 (Chambers, March 2026; Express Tribune, August 2026). MoITT's May 2023 draft got cabinet in-principle approval and, per MoITT in January 2025, was in final consultations; MoITT opposed a separate 2023 Senate private member's bill.✓
Sources
- Primary source: https://moitt.gov.pk/SiteImage/Misc/files/Final%20Draft%20Personal%20Data%20Protection%20Bill%20May%202023.pdf
- Second source: https://tribune.com.pk/story/2625470
- Regulator: None yet. The bill proposes a National Commission for Personal Data Protection within six months of the law taking effect.
Sources used for the independent check (6)
- https://moitt.gov.pk/SiteImage/Misc/files/Final Draft Personal Data Protection Bill May 2023.pdf
- https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/pakistan
- https://tribune.com.pk/story/2625470
- https://tribune.com.pk/story/2428142/bill-on-personal-data-privacy-gets-cabinet-nod
- https://digitalpolicyalert.org/event/11990-issued-draft-of-the-pakistan-personal-data-protection-bill-including-data-localisation-requirements
- https://propakistani.pk/2025/01/25/it-ministry-opposes-senators-data-protection-bill-over-legal-flaws/amp/
= confirmed by two independent sources, at least one official. How we verify
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@