PECA

Pakistan Cybercrime

Status

In force. The 2025 Amendment Act got presidential assent 29 January 2025; constitutional challenges were being heard in the Islamabad High Court (as of July 2025), with no ruling found.✓Sources: na.gov.pk, tribune.com.pk

Who it applies to

Offences involving information systems and data in Pakistan, including unauthorised access, misuse of identity information and online content; service providers have data retention duties; social media platforms can be made to register.✓Sources: sja.gos.pk, na.gov.pk, practiceguides.chambers.com

Size thresholds

No size threshold. Service providers must retain traffic data for at least one year; social media platforms may be required to register with SMPRA.✓Sources: sja.gos.pk, na.gov.pk

Regulator

National Cyber Crime Investigation Agency (NCCIA, replaced the FIA's cybercrime role); Social Media Protection and Regulatory Authority (SMPRA); Pakistan Telecommunication Authority (PTA).✓Sources: na.gov.pk, sja.gos.pk

Breach or incident reporting

PECA sets no general breach-notification duty for businesses; sectoral rules (PTA, SBP) apply.✓Sources: sja.gos.pk, practiceguides.chambers.com

Deadline to answer personal data requests

Not applicable (PECA is a criminal statute; no data subject rights regime).✓Sources: sja.gos.pk, practiceguides.chambers.com

Data protection officer

Not applicable; no officer requirement under PECA.✓Sources: sja.gos.pk, practiceguides.chambers.com

Local representative

Being verified

Sending data abroad

Not addressed by PECA.✓Sources: sja.gos.pk, practiceguides.chambers.com

Cookies and consent

Not addressed by PECA. Using someone's identity information without authorisation is an offence.✓Sources: sja.gos.pk, practiceguides.chambers.com

Maximum penalty

Cyber terrorism: up to 14 years and/or PKR 50 million. Unauthorised use of identity information: up to 3 years and/or PKR 5 million. Spreading fake information (s.26A): up to 3 years and/or PKR 2 million.✓Sources: sja.gos.pk, na.gov.pk

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Never use or share anyone's identity information without authorisation.
• If you are a service provider, retain traffic data for at least one year.
• If you run a social media platform, be ready to enlist with SMPRA and act on its orders (it must act on fake-information complaints within 24 hours).
• Train staff on unauthorised access and data misuse offences.
• Preserve logs and cooperate with lawful NCCIA requests.
• Review published content against the s.26A fake-information offence.

Recent changes

2025 Amendment (assent 29 Jan 2025): created SMPRA, NCCIA (replacing the FIA Cyber Crime Wing) and Social Media Protection Tribunals (90-day case target), platform enlistment, and the s.26A fake-information offence. Challenges were being heard in the Islamabad High Court as of July 2025.✓

Sources

• Primary source: https://na.gov.pk/uploads/documents/1470910659_707.pdf
• Second source: https://www.thenews.com.pk/latest/1277421-peca-amendment-bill-gets-presidents-assent
• Regulator: National Cyber Crime Investigation Agency (NCCIA, replaced the FIA's cybercrime role); Social Media Protection and Regulatory Authority (SMPRA); Pakistan Telecommunication Authority (PTA).

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.