Home › Law library › Pakistan SBP/PTA data rules

Pakistan SBP/PTA data rules

SBP Framework on Outsourcing to Cloud Service Providers (BPRD Circular 01/2023) and PTA Critical Telecom Data and Infrastructure Security Regulations

Sourced · 11/14 facts confirmed by two sources. Last verified 10 October 2026

Next full re-check due: April 2027. Regulator news is checked monthly; changes are logged in the change log.

Cite this page: GlanceDesk Jurisdiction, “Pakistan SBP/PTA data rules (Pakistan)”, glancedeskjurisdiction.com/laws/pk-sectoral, last verified 10 October 2026.

Pakistan Privacy

Status: SBP cloud framework in force (16 Jan 2023; existing arrangements to comply by 31 Dec 2023). PTA CTDISR first issued 2020; revised version consulted to 7 Nov 2025.✓Sources: sbp.org.pk, pta.gov.pk, meatechwatch.com
Who it applies to: SBP: banks, MFBs, DFIs, EMIs, PSOs/PSPs using cloud services. PTA: all licensed telecom operators and their supply chains.✓Sources: sbp.org.pk, sbp.org.pk, meatechwatch.com
Size thresholds: SBP framework covers both material and non-material cloud workloads, using a risk-based approach.✓Sources: sbp.org.pk, sbp.org.pk
Regulator: State Bank of Pakistan (SBP); Pakistan Telecommunication Authority (PTA)✓Sources: sbp.org.pk, pta.gov.pk
Breach or incident reporting: SBP: report all security incidents and breaches to SBP under its Enterprise Technology Governance & Risk Management Framework (the cloud framework sets no hour limit). PTA: the revised CTDISR-2025 reportedly requires major incidents to be reported within 24 hours (news report; PTA text not seen).✓Sources: sbp.org.pk, meatechwatch.com
Deadline to answer personal data requests: Not applicable (no general data subject rights regime); banking secrecy complaints go to the Banking Mohtasib.
Data protection officer: No sectoral DPO requirement; SBP's cloud framework instead requires a designated security incident response team and board/IT steering committee oversight.✓Sources: sbp.org.pk, practiceguides.chambers.com
Local representative: Not applicable.✓Sources: sbp.org.pk, practiceguides.chambers.com
Sending data abroad: SBP: onshore cloud is preferred; banks, MFBs, digital banks, DFIs and designated PSOs/PSPs may put only non-material workloads offshore (material ones need SBP approval), while EMIs and non-designated PSOs/PSPs may go offshore; never to hostile jurisdictions. PTA: revised CTDISR reportedly requires telecom data to stay in Pakistan.✓Sources: sbp.org.pk, sbp.org.pk, meatechwatch.com
Cookies and consent: PTA spam regulations (2009): telemarketers must register, respect the Do Not Call Register, and include an unsubscribe option in marketing SMS.
Maximum penalty: Being verified

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

Banks/fintechs: map all cloud workloads and comply with SBP's 2023 cloud outsourcing framework.

Recent changes

PTA circulated a revised CTDISR-2025 replacing CTDISR-2020 (announced Aug 2025; comments due 7 Nov 2025). News reports say it requires local data hosting and 24-hour incident reporting; PTA's 2024-25 cybersecurity report describes it as pending implementation.✓

Sources

Primary source: https://www.sbp.org.pk/bprd/2023/C1.htm
Second source: https://meatechwatch.com/2025/11/05/pta-finalizes-new-cybersecurity-regulations-mandating-local-data-hosting-for-telecoms/
Regulator: State Bank of Pakistan (SBP); Pakistan Telecommunication Authority (PTA)

Sources used for the independent check (6)

= confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.