Pakistan’s digital space is expanding rapidly. With more than 116 million internet users and over 200 million mobile connections, the country is plugged firmly into the global information economy. Despite this rapid progress, the country still lacks a comprehensive legal and institutional framework needed to keep citizens’ personal data safe. The result is a digital ecosystem riddled with breaches, fraud, and a growing distrust of state institutions.
The warning signs could not be clearer. In April 2025, the National Cyber Emergency Response Team (PKCERT) revealed that more than 180 million usernames, passwords, and login credentials of Pakistani internet users had been stolen in a global data breach. Citizens were advised to reset passwords and enable multi-factor authentication as important but temporary fixes. When such breaches occur at scale, they are not simply technical accidents; they are symptoms of systemic weakness.
A year back in 2024, a Joint Investigation Team (JIT) report confirmed that personal records of 2.7 million citizens had been stolen from the National Database and Registration Authority (NADRA) and sold abroad. For an institution tasked with safeguarding national identity, the breach was devastating. Ordinary citizens paid the price, facing fraudulent financial transactions, online harassment, and identity theft. This is not just a matter of digital inconvenience. It is about rights.
Nearly twenty years ago, the Lahore High Court in M.D. Tahir v. State Bank of Pakistan held that unauthorised collection of personal data was an “extraordinary invasion” of liberty, recognising privacy as a fundamental right. And yet, Pakistan today still lacks a meaningful legal framework for privacy protection. The Prevention of Electronic Crimes Act of 2016, the country’s main cyber law, deals with online offences but offers little in the way of data governance or user rights protection.
In the digital age, data is more than information; it is the currency of identity, commerce, and governance
The Personal Data Protection Bill 2023 was meant to address this gap. It proposes fines and establishes a National Commission for Personal Data Protection. But the bill remains stuck in Parliament. Worse, even in draft form, it contains sweeping exemptions for “national security”, “public interest”, and “legitimate interest”, vague terms that could be abused to shield powerful institutions from accountability. Unless these loopholes are closed and the commission is given real independence and enforcement powers, the law will fail before it begins.
The contrast with global best practices is striking. The European Union’s General Data Protection Regulation (GDPR) requires explicit consent for data use and imposes heavy penalties for violations. California’s Consumer Privacy Act gives individuals the right to know what data companies collect and to opt out of its sale. Even Malaysia has enacted comprehensive data protection laws that not only protect citizens but also enhance investor confidence.
The lesson is clear: effective data protection laws are not just about safeguarding privacy. They are about building trust, encouraging innovation, and enabling economic growth. Weak protections, on the other hand, deter investment and leave citizens exposed to fraud, manipulation, and exploitation.
For Pakistan, the way forward is both urgent and obvious. Parliament must not only pass the data protection bill but also strengthen it. Exemptions must be narrowed, anonymised data should be brought under protection, and breach-disclosure requirements must be made mandatory. Both public and private data handlers must be subject to oversight, and citizens must have accessible avenues for redress when their rights are violated.
But legal reform alone will not be enough. Public trust in digital governance requires transparency and participation. Open consultations with technologists, industry experts, and rights advocates would improve the quality of the law and its enforcement. At the same time, investment in digital literacy is essential so that citizens can recognise risks, protect their information, and exercise their rights effectively.
In the digital age, data is more than information; it is the currency of identity, commerce, and governance. Every breach erodes personal freedoms, undermines investor confidence, and chips away at the credibility of the state. Pakistan cannot afford to remain inaction. The question is no longer whether Pakistan should act on data protection, but whether it can afford not to. The credibility of the state and the security of every citizen’s digital identity now depend on passing a strong, transparent, rights-based data protection law. Anything less will leave Pakistan’s digital ambitions dangerously exposed.