Data Privacy & Digital Rights
Pakistan has no general data protection statute (the Personal Data Protection Bill remains draft). Practical protections come from PECA 2016 (cyberstalking, modesty offences, NCII), the Banking Companies Ordinance (banking secrecy), and the constitutional right to dignity. NCII victims should use StopNCII.org alongside the NCCIA criminal route.
Covered in this guide:
Pakistan does not yet have a general data protection law. The Personal Data Protection Bill — most recently in circulation as the draft Personal Data Protection Act 2025 — remains in Parliament and is not enforced. In its absence, your digital-rights protections come from scattered statutes: the Prevention of Electronic Crimes Act 2016 (cyberstalking §24, modesty offences §21, dignity offences §20, child pornography §22, spoofing §26); the Pakistan Telecommunication (Re-organisation) Act 1996 (telecom secrecy); the Banking Companies Ordinance 1962 (banking confidentiality); and Article 14 of the Constitution (dignity of person, privacy of home).
For non-consensual intimate imagery (NCII), 'deepfake' sexual content, or sextortion, the criminal path runs through the NCCIA under PECA §§ 21 and 24 — and victims should also use StopNCII.org in parallel. StopNCII generates a hash of the image on your device and shares the hash with participating platforms so they can detect and remove uploads; the actual image never leaves your device. The service is available in Urdu and requires the depicted person to be 18+ at the time the image was taken. For minors, use takeitdown.ncmec.org instead.
Key Laws
Prevention of Electronic Crimes Act 2016 (PECA)
Act XL of 2016 — sections 20, 21, 22, 24, 26
§20 offences against dignity of a natural person; §21 offences against modesty of a natural person and minor (use of electronic means resulting in reputational damage or breach of privacy — up to 7 years' imprisonment, fine up to PKR 5,000,000); §22 child pornography; §24 cyber stalking; §26 spoofing.
Prevention of Electronic Crimes (Amendment) Act 2025
Enacted 29 January 2025
Added §26-A (false / fake information — up to 3 years' imprisonment, PKR 2,000,000 fine); established Digital Rights Protection Authority (DRPA), Social Media Protection and Regulatory Authority (SMPRA), and gave NCCIA exclusive investigation powers under amended Section 30. Subject to active human-rights legal challenge.
Personal Data Protection Bill (draft, not yet law)
Draft Personal Data Protection Act 2025 (earlier draft 2023)
Would establish a National Commission for Personal Data Protection. Successive drafts since 2005 have not passed Parliament. Until enactment, Pakistan has no general statutory right of access, erasure, or portability of personal data.
Pakistan Telecommunication (Re-organisation) Act 1996
Act XVII of 1996 — section 54 (interception lawful only on authorised order)
Underpins the Pakistan Telecommunication Authority (PTA). Section 54 limits lawful interception of telecommunications. PTA can require operators to block SIMs and remove unlawful content.
Constitution of Pakistan 1973
Articles 14, 4
Article 14 — inviolability of the dignity of man and (subject to law) the privacy of home. Article 4 — right of individuals to be dealt with in accordance with law. Used as constitutional backstop where statutory privacy protection is thin.
Removing Non-Consensual Intimate Imagery (NCII)
NCII — non-consensual intimate imagery — runs on a parallel-path response in Pakistan. The criminal path is the NCCIA under PECA §21 (offences against modesty of a natural person and minor): use of...
Cyberstalking and Online Harassment Under PECA
Cyberstalking is a cognisable offence in Pakistan under Section 24 of the Prevention of Electronic Crimes Act 2016. The section criminalises the use of an information system to coerce, intimidate,...
What Protects Your Data Without a Personal Data Protection Act
Pakistan does not yet have a general data protection statute. Successive drafts of a Personal Data Protection Bill — most recently the draft Personal Data Protection Act 2025, and before it the 2023...