Pakistan’s personal data protection bill remains stuck in draft form, leaving millions of citizens without any legal shield against the unauthorized collection and misuse of their sensitive information. While the global digital economy has moved toward strict data governance, Pakistan continues to operate in a legal vacuum where your financial, health, and biometric data has no clear protection.

The status of the personal data protection bill

For years, discussions surrounding a comprehensive privacy framework have reached the same conclusion: we don't have one. The draft legislation, which aims to regulate how government and private entities handle user information, has been under review since at least 2018. Successive administrations have promised a rollout, but the bill remains trapped in a cycle of revisions, committee reviews, and bureaucratic delays.

Without this law, ordinary Pakistanis are at the mercy of corporate privacy policies that are often intentionally opaque. When you sign up for a service, download a mobile app, or register for a government portal, you are essentially handing over your data without a statutory guarantee that it won't be sold or compromised.

Why your digital privacy is at risk

  • No mandatory breach notification: If a company loses your data, they are not legally obligated to inform you.
  • Lack of 'right to be forgotten': You currently have no legal mechanism to demand that a company delete your personal profile.
  • Data sovereignty issues: Without a law, there are no strict mandates on where server infrastructure must be located or how cross-border data transfers are handled.

What you should do now

Until a formal law is passed, you must treat your digital footprint as high-risk. Start by reviewing the permissions on your smartphone; check which apps have access to your contacts, camera, and location. If you don't need a specific app to have that access, turn it off in your settings. Furthermore, avoid sharing your CNIC number or phone number on public forums or with unverified businesses, as there is currently no legal recourse if that information is harvested for scams or telemarketing.

What to watch next

Keep an eye on the Ministry of Information Technology and Telecommunication (MoITT) website for any updates regarding the next parliamentary session. Until the government prioritizes the personal data protection bill as a national security issue rather than just a regulatory hurdle, the burden of protecting your identity remains entirely on your shoulders. Advocacy groups continue to lobby for the bill's passage, but until a version is signed into law, the digital landscape in Pakistan remains a 'wild west' for data brokers.