Home › Law library › PECA
PK
PECA
Prevention of Electronic Crimes Act, 2016 (as amended by the Prevention of Electronic Crimes (Amendment) Act, 2025)
Sourced. Last verified 9 October 2026
Pakistan Cybercrime
- Status
- In force. The 2025 Amendment Act got presidential assent 29 January 2025; constitutional challenges were pending in court as of mid-2026.
- Who it applies to
- Offences involving information systems and data in Pakistan, including unauthorised access, misuse of identity information and online content; service providers have data retention duties; social media platforms can be made to register.
- Size thresholds
- No size threshold. Service providers must retain traffic data for at least one year; social media platforms may be required to register with SMPRA.
- Regulator
- National Cyber Crime Investigation Agency (NCCIA, replaced the FIA's cybercrime role); Social Media Protection and Regulatory Authority (SMPRA); Pakistan Telecommunication Authority (PTA).
- Breach or incident reporting
- Being verified
- Deadline to answer personal data requests
- Not applicable (PECA is a criminal statute; no data subject rights regime).
- Data protection officer
- Not applicable; no officer requirement under PECA.
- Local representative
- Being verified
- Sending data abroad
- Not addressed by PECA.
- Cookies and consent
- Not addressed by PECA. Using someone's identity information without authorisation is an offence.
- Maximum penalty
- Cyber terrorism: up to 14 years and/or PKR 50 million. Unauthorised use of identity information: up to 3 years and/or PKR 5 million. Spreading fake information (s.26A): up to 3 years and/or PKR 2 million.
Facts marked “Being verified” are still being confirmed and are not given as answers.
What you must do
- Never use or share anyone's identity information without authorisation.
- If you are a service provider, retain traffic data for at least one year.
- If you run a social media platform, prepare to register with SMPRA and meet 24-hour takedown orders.
- Train staff on unauthorised access and data misuse offences.
- Preserve logs and cooperate with lawful NCCIA requests.
- Review published content against the s.26A fake-information offence.
Recent changes
2025 Amendment (assent 29 Jan 2025): created SMPRA, NCCIA and Social Media Protection Tribunals (90-day case target), platform registration, and s.26A fake-news offence. Court challenges ongoing in 2026.
Sources
- Primary source: https://na.gov.pk/uploads/documents/1470910659_707.pdf
- Second source: https://www.thenews.com.pk/latest/1277421-peca-amendment-bill-gets-presidents-assent
- Regulator: National Cyber Crime Investigation Agency (NCCIA, replaced the FIA's cybercrime role); Social Media Protection and Regulatory Authority (SMPRA); Pakistan Telecommunication Authority (PTA).
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email [email protected].