Pakistan’s digital landscape has surged in recent years – over 116 million people now use the internet and there are more than 200 million mobile connections. Yet the country still “lacks a comprehensive legal and institutional framework” to safeguard personal data. In practice, this vacuum has left citizens exposed. Indeed, in 2024 a national cyber alert revealed that the login credentials and passwords of more than 180 million Pakistani internet users had been stolen in a global data breach, and a Joint Investigation Team confirmed that details of 2.7 million citizens were illicitly siphoned from the National Database and Registration Authority (NADRA) between 2019 and 2023.
For a country whose courts have long recognised privacy as a fundamental right as shown in the Lahore High Court in M.D. Tahir v State Bank of Pakistan held that unauthorised collection of personal data was an “extraordinary invasion” of liberty. Pakistan’s main cybercrime law, the Prevention of Electronic Crimes Act 2016 (PECA), punishes identity theft and unauthorised data access, but it is not a full-fledged privacy statute. PECA’s Section 16, for example, bans obtaining or selling another’s “identity information” without consent, but the law contains few positive rights or detailed safeguards for everyday data handling.
A Draft Law Stuck in Limbo
In 2023 the federal government introduced a Personal Data Protection Bill (PDPB) 2023 to fill the gap, even proposing a dedicated Data Protection Commission. The draft Bill (referred to here as PDPB or PDPA) would define “personal data” broadly, create a National Commission for Personal Data Protection (NCPDP), and require data controllers to give data subjects detailed notices about data collection, purpose, retention, and their rights. In theory, this would bring Pakistan closer to international norms. However, the Bill remains mired in Parliament. Legal analysts warn it has serious flaws. Even in draft form, it carves out sweeping exemptions for vague concepts like “national security,” “public interest” or “legitimate interest,” loopholes that could allow powerful agencies to escape accountability. As one commentator put it, unless these loopholes are closed and the Commission is given “real independence and enforcement powers, the law will fail before it begins.”
Without a robust, GDPR-style privacy law, citizens have little legal recourse and businesses gain no clear rules
For now, no independent data protection authority exists. Under PECA, enforcement of data offences falls to the Federal Investigation Agency (FIA) and the Pakistan Telecommunication Authority (PTA). PECA authorises the FIA (via its Cyber Crime wing) to investigate data breaches and allows victims to seek relief in court, while the PTA can block or order destruction of unlawfully-used data on a subject’s reques. But without a specialised regulator or clear sanctions tailored to privacy violations, enforcement is piecemeal and often reactive. Broken Institutions and Weak Enforcement
Reports of gross data leaks have exposed enforcement weaknesses. In 2024 police investigations revealed that NADRA itself had suffered a massive breach: data of 2.7 million citizens, much of it exported overseas, was traced back to insiders at NADRA offices in Karachi, Multan and Peshawar. Criminal proceedings were launched, but many citizens had already suffered identity theft and fraud. Similarly, in September 2025 media outlets documented thousands of Pakistanis (including ministers and generals) whose personal details (home addresses, travel histories, call logs and even scanned national ID cards) had been posted for sale online. The PTA and new cybercrime agencies have acted belatedly, blocking over 1,300 illicit websites and apps, but critics say enforcement remains weak. An Express Tribune investigation noted that despite assurances, “weak enforcement” has allowed the illicit data trade to flourish. Dozens of online platforms continue selling sensitive personal data for small sums e.g. just 500 rupees for a mobile user’s location or 2,000 rupees for detailed call records.
These breaches have clear consequences. Digital security experts warn that harvested credentials and PII are “weaponized by malicious actors” for phishing and social engineering. Indeed, the government’s own Cyber Emergency Team warned that the 180-million credential leak could enable account takeovers, identity theft and unauthorised access to government and financial accounts=. Pakistani banks have felt the effect: a recent spike in unauthorised transactions prompted a major bank to advise customers to avoid untrusted websites and social-media scams. In one case a customer lost Rs1.4 million (approximately £4,000) after his Meezan Bank debit card was charged without consent.
By contrast, global data-privacy norms emphasise individual control and rights. The European Union’s GDPR, for example, mandates explicit consent for data processing and heavy penalties for breaches. Under GDPR, companies must allow users to see what data they hold and to withdraw consent – rights Pakistan currently lacks.
A recent Pakistani analysis highlights the gap: GDPR would fine violators up to 4% of global turnover, whereas the draft PDPB (if passed) would envisage fines of at most a few million dollars. It also notes that even Malaysia now has a comprehensive data-protection law, and California grants users the right to opt out of sale of their information. These examples underscore Pakistan’s deficiency: without robust, GDPR-style privacy law, citizens have little legal recourse and businesses gain no clear rules.
Human Toll and Calls for Reform
For individuals, the practical effects are immediate. Leaks and weak consent regimes mean strangers – even criminals – can build detailed dossiers on ordinary people. Pakistan’s swirling tales of fraud suggest that everyone is a potential target. A fintech researcher warns that, in today’s Pakistan, data is “more than information; it is the currency of identity, commerce, and governance,” and that each major breach “erodes personal freedoms” and chips away at citizens’ trust. ‘
Citizens have already suffered: families’ bank accounts drained, social-media accounts hijacked, and worst of all, victims of extortion when their friends and family are fooled by phishing scams. Muhammad Asim, a cybersecurity expert, stresses that without legal protection “people remain vulnerable to financial fraud, harassment and blackmail resulting from data leaks”. In effect, every data breach or sloppy data sale leaves someone with stolen money or a stolen identity.
Legal scholars and advocates agree that the solution must begin with law. The stalled Privacy Bill needs urgent strengthening: narrower exemptions, strict breach-notification rules and real enforcement powers. The draft’s proposal to create a National Commission for Personal Data Protection is a start, but without independence and resources it will be toothless. Experts argue that without a stringent law, digital fraud will only grow as Pakistan “rapidly transitions towards a digital economy”. In the meantime, regulators have begun some damage control, by blocking illegal data sites and warning users to tighten passwords and use multi-factor authentication, but these are stopgaps.
The contrast with international norms is telling. In Europe or North America, data breaches of this scale would prompt heavy fines, mandatory notifications and immediate consumer remedies. In Pakistan, there is no such safety net. As one commentator concluded, “Data protection is not a luxury, it is a necessity. Without urgent reform, we risk undermining public trust in digital platforms, isolating our economy, and leaving citizens exposed to exploitation”. Until lawmakers act decisively, Pakistan’s data privacy will remain perilously under-protected – with ordinary people left to pick up the pieces.