Privacy Policy (Pakistan)

A Privacy Policy in Pakistan sets out the rules the organisation expects to be followed and the standards against which conduct will be judged.

Section 3 of the Prevention of Electronic Crimes Act 2016 criminalises unauthorised access to information systems, and Section 5 prohibits unauthorised copying or transmission of critical data. Section 10 of PECA addresses data privacy violations involving electronic communication — making it an offence to obtain, transmit, or use electronic data without authorisation. Businesses that collect personal data of Pakistani citizens through websites, mobile applications, or digital platforms are directly subject to PECA's data protection obligations, making a thorough Privacy Policy both a legal requirement and a trust signal for users.

The Personal Data Protection Bill (PDPB) — which Pakistan has been working to enact since 2018 and which mirrors principles of the European Union's General Data Protection Regulation (GDPR) — is expected to introduce thorough data protection obligations including mandatory data collection consent, data subject rights (access, correction, deletion), data breach notification requirements, and the appointment of a Data Protection Officer (DPO). Although the PDPB has not yet been enacted as at 2025, businesses in Pakistan preparing Privacy Policies compliant with PECA are advised to adopt PDPB-aligned practices in anticipation of enactment.

The Pakistan Telecommunication Authority (PTA), operating under the Pakistan Telecommunication (Re-organisation) Act 1996, regulates the collection and use of personal data by telecom operators, internet service providers (ISPs), and digital platforms. The PTA's Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards) Rules 2021 require digital platforms operating in Pakistan to establish a local representative and comply with PTA data-sharing directions. Social media platforms, e-commerce operators, and fintech companies regulated by the State Bank of Pakistan (SBP) under the Electronic Money Institutions Regulations 2019 must maintain Privacy Policies disclosing their data practices.

The Electronic Transactions Ordinance 2002 (ETO) provides the legal framework for electronic contracts and digital signatures in Pakistan and implicitly recognises the validity of electronically published Privacy Policies accepted by users via website click-through agreements. Section 2(f) of the Electronic Transactions Ordinance 2002 defines an electronic document to include any information generated, communicated, received, or stored in electronic form, and a Privacy Policy published on a website satisfies this definition.

For financial institutions — including commercial banks, microfinance banks, and electronic money institutions regulated by the State Bank of Pakistan (SBP) — the SBP's Consumer Protection Framework 2022 and Prudential Regulations require clear disclosure of data collection and sharing practices in consumer-facing documents, including Privacy Policies. The Securities and Exchange Commission of Pakistan (SECP), which regulates insurance companies, non-banking financial companies (NBFCs), and capital market intermediaries, similarly requires data protection disclosures in customer-facing documents.

A Privacy Policy Pakistan that is drafted in compliance with PECA 2016, the Electronic Transactions Ordinance 2002, and in anticipation of the PDPB provides Pakistani businesses with a defensible position before the FIA Cyber Crime Wing, the PTA, the SBP, and the SECP in the event of a data privacy complaint or regulatory investigation. Forms-legal.com users in Pakistan should publish this Privacy Policy on their website's footer and link to it from all data collection forms.

A Privacy Policy is required for every business, website, and mobile application in Pakistan that collects, processes, or stores personal data of users, customers, or employees, in compliance with the Prevention of Electronic Crimes Act 2016 and the Electronic Transactions Ordinance 2002.

A Privacy Policy is needed for e-commerce platforms — whether registered as companies with SECP under the Companies Act 2017 or as sole proprietorships — that collect customers' names, addresses, CNIC numbers, payment card information, and purchase history through their websites or mobile applications.

A Privacy Policy is required for fintech companies and electronic money institutions (EMIs) regulated by the State Bank of Pakistan (SBP) under the EMI Regulations 2019, mobile banking applications operated by commercial banks under SBP licensing, and digital lending platforms regulated by SECP under the NBFC (Non-Banking Finance Companies) Regulations.

A Privacy Policy is needed for social media platforms, content creators, and digital marketing agencies that collect user data for targeted advertising, analytics, and customer profiling in Pakistan, given the PTA's authority under the Removal and Blocking of Unlawful Online Content Rules 2021.

A Privacy Policy is required for healthcare providers, telemedicine platforms, and health-tech companies that collect patients' medical records, health data, and CNIC information — categories of sensitive personal data requiring heightened protection under PECA 2016 and in anticipation of the Personal Data Protection Bill.

A Privacy Policy is needed for educational institutions, ed-tech platforms, and online learning providers that collect students' personal data, academic records, and parental information — particularly data of minors (under 18 years) — where additional consent requirements apply under Pakistani law.

A Privacy Policy is required for employers and HR departments that collect and process employees' personal data — including CNIC, biometric data for attendance systems, salary details, and medical records — in compliance with PECA 2016 and the SBP's cybersecurity framework for financial institutions.

A Privacy Policy is needed for any Pakistani business that transfers personal data outside Pakistan's borders — to cloud servers, offshore service providers, or foreign parent companies — as cross-border data transfers attract regulatory scrutiny under the PTA's data localisation guidelines.

Parties in Pakistan should publish the Privacy Policy prominently on their website and application before launching data collection activities, and update it whenever there is a material change in data processing practices.

A valid Privacy Policy for Pakistan under the Prevention of Electronic Crimes Act 2016 and the Electronic Transactions Ordinance 2002 must contain the following essential elements.

Organisation Identification: Full legal name of the data controller (business or organisation), SECP company registration number (for companies incorporated under the Companies Act 2017), registered office address, and a dedicated privacy contact email address to which users can address data inquiries.

Scope of Personal Data Collected: A clear list of categories of personal data collected — including name, CNIC number, email address, phone number, payment information, device identifiers, IP addresses, location data, and biometric data — specifying which data is collected automatically (via cookies, analytics tools) and which is voluntarily provided by the user.

Purpose of Data Collection: A specific statement of the purposes for which each category of personal data is collected and processed — such as order fulfilment, payment processing, fraud prevention, marketing, regulatory compliance, or customer support — consistent with the principle of purpose limitation anticipated by the Personal Data Protection Bill.

Legal Basis for Processing: The lawful basis for processing personal data — whether user consent (obtained through an opt-in mechanism in accordance with the Electronic Transactions Ordinance 2002), contractual necessity, legal obligation (including compliance with PTA directions, FBR requirements, or SBP regulations), or legitimate business interest.

Data Sharing and Third Parties: Disclosure of all third parties with whom personal data is shared — including payment processors (e.g. 1Link, NIFT, JazzCash, EasyPaisa), cloud service providers, analytics platforms, and government authorities (FIA, PTA, FBR, SBP) — along with the legal basis for each sharing arrangement.

Data Retention: The period for which personal data is retained — linked to the purpose of collection, regulatory requirements (FBR requires financial records for six years under Section 174 of the Income Tax Ordinance 2001; SBP requires KYC records for five years under AML/CFT regulations), and the principle of storage limitation.

User Rights: A statement of users' rights over their personal data — including the right to access, correct, delete, and withdraw consent — and the mechanism for exercising those rights, including a response timeline (30 days is the international standard adopted by PDPB drafts).

Cookies Policy: Disclosure of cookie use — including essential cookies, analytics cookies (Google Analytics, Adobe Analytics), and marketing cookies — with an opt-out mechanism for non-essential cookies, consistent with PTA guidance on digital platforms.

Security Measures: A description of technical and organisational security measures implemented to protect personal data — including SSL/TLS encryption, access controls, regular security audits, and incident response procedures — consistent with PECA 2016 obligations and the SBP's Cyber Security Framework for Banks.

Data Breach Notification: A commitment to notify affected users and the relevant authority (PTA, SBP, or SECP depending on the sector) in the event of a data breach affecting their personal data, including the timeframe for notification (72 hours is the standard anticipated by the PDPB).

Policy Updates: A statement of how and when the Privacy Policy will be updated, with a mechanism to notify users of material changes (email notification or prominent website banner).

Forms-legal.com provides this Privacy Policy Pakistan template as a starting point for PECA 2016-compliant data governance. Businesses should consult a technology law specialist and their Data Protection Officer (if appointed) for sector-specific compliance under SBP, SECP, or PTA regulatory frameworks.

Under the Companies Act 2017, the Securities and Exchange Commission of Pakistan (SECP) maintains the register of Pakistani companies. Section 16 of the Companies Act 2017 governs company incorporation. The Contract Act 1872 governs general contractual obligations. The Federal Board of Revenue (FBR) administers corporate tax under the Income Tax Ordinance 2001. The High Courts (Lahore, Sindh, Peshawar, Balochistan, Islamabad) have original and appellate jurisdiction.