Personal Data Protection Bill 2023 (Draft)
Briefing
By Rahnuma · AI-generatedThe Personal Data Protection Bill 2023 (Draft) is Pakistan's comprehensive framework for regulating personal data processing, published by the Ministry of IT & Telecom in May 2023. The Bill establishes rights for data principals (individuals) including access, correction, and erasure rights under Part II, and creates obligations for data controllers and processors in Part III including lawful basis requirements, consent standards, and privacy by design mandates. Part IV governs cross-border data transfers requiring adequacy assessments or appropriate safeguards, while Part V creates the Data Protection Commission as the enforcement authority with investigation, audit, and penalty powers under Section 46. The Bill applies to organizations processing personal data of data principals in Pakistan or those offering goods/services to them.
Plain-language explanation
The Personal Data Protection Bill 2023 is Pakistan's proposed law to protect how companies handle personal information about customers, employees, and other individuals. If passed, it would require businesses to get clear permission before collecting data, tell people what data they collect and why, keep that data secure, and let individuals see or delete their information upon request. For example, if you run an e-commerce store collecting customer names, addresses, and purchase history, you would need explicit consent at checkout, a privacy notice explaining data use, and the ability for customers to request deletion of their account data. The Bill creates a new government body called the Data Protection Commission to oversee compliance and issue fines up to 50 million rupees for serious violations. Companies processing data of Pakistani residents would need to appoint privacy contacts, maintain processing records, and report security breaches within 72 hours. The draft version is currently under review and timelines for implementation would be set upon enactment.
Compliance & opportunity checklist
- Map all personal data processing activities and document lawful bases per Section 21 requirements for controllers
- Update customer consent mechanisms to meet the 'free, specific, informed and unambiguous' standard in Section 9 before the Act's effective date
- Review and amend all third-party processor agreements to include Data Processing Addenda compliant with Section 24
- Establish a 72-hour breach notification process and designate internal escalation procedures under Section 38 obligations
- Appoint a Data Protection Officer if your organization exceeds the employee or data volume thresholds under Section 33
- Conduct cross-border transfer assessments for any international data flows and execute Standard Contractual Clauses where needed per Section 28
Key numbers
Breach notification to Commission
72 hours
· Section 38
Maximum tier-one penalty (most serious violations)
50 million PKR
· Section 46(a)
Maximum tier-two penalty (lesser violations)
50 million PKR or 3% global turnover
· Section 46(b)
Data Protection Officer exemption threshold
100 employees
· Section 33(2)
Commission composition
Chairperson plus 4 members
· Section 41
Consent withdrawal validity requirement
100 % equivalent effort to consent
· Section 9(3)
Effective date (upon enactment)
TBD
· Section 1
Parts in the Bill structure
6 Parts
· Overall structure
Consent validity requirement
4 conditions (free, specific, informed, unambiguous)
· Section 9(1)
Criminal offense penalty for repeated violations
3 years imprisonment
· Section 48
Frequently asked
By Rahnuma · AI-generatedDoes this Bill apply to our company if we only process employee data internally?
Yes, the Bill applies broadly to any organization processing personal data of individuals located in Pakistan, regardless of whether the processing is for internal HR purposes or external commercial activities. Section 2 establishes the territorial scope covering controllers and processors established in Pakistan or those targeting Pakistani data principals. Small enterprises processing below the threshold defined in Section 51 may receive exemptions, but most commercial entities will need to comply.
What are the consequences if we experience a data breach?
Under Section 38, controllers must notify the Data Protection Commission of any personal data breach within 72 hours of becoming aware of it, and notify affected data principals when the breach is likely to result in high risk to their rights. Failure to notify constitutes a violation under Section 44. Penalties for breach-related violations can reach up to PKR 50 million or 3% of annual global turnover under the tier-two penalty structure in Section 46.
Can our company continue transferring customer data to our overseas parent company or cloud providers in the US and EU?
Cross-border transfers under Part IV require either that the destination country has been declared adequate by the Commission, or that appropriate safeguards are in place such as Standard Contractual Clauses or Binding Corporate Rules approved under Section 28. Organizations should conduct transfer impact assessments and document the legal basis for each international data flow. The Bill restricts transfers to countries without adequate protection unless specific derogations under Section 27 apply.
What compliance steps should we prioritize first?
Priority actions include: (1) conducting a data mapping exercise to identify all personal data processing activities under Section 21 obligations; (2) updating consent mechanisms to meet the free, specific, informed, and unambiguous standard in Section 9; (3) establishing breach notification procedures within the 72-hour window; (4) reviewing third-party processor agreements for Data Processing Addenda requirements under Section 24; and (5) appointing a Data Protection Officer if your organization meets the thresholds in Section 33.
Ask about this document
Cited in
No editorial items currently cite this document.
Related instruments
Depends on P@SHA
National AI Policy 2025 (Approved)
Responsible-AI governance rests on the data protection framework.
Conflicts AI
Digital Nation Pakistan Act 2025
Section 28 of the Digital Nation Act 2025 (id:18) explicitly states the Act shall override other laws, creating a potential conflict with the Personal Data Protection Bill 2023 (id:13) on matters of data governance and data protection regulations.
Depends on AI
Digital Nation Pakistan Act 2025
The Act's data governance framework and digital identity mechanisms rely on the legal foundation provided by the Personal Data Protection Bill 2023 for lawful processing and privacy safeguards.
Depends on AI
PECA: Online Content Rules 2021
The rules require compliance with data privacy and data localization obligations as stipulated in the Personal Data Protection Bill 2023.
Discuss this document
Start a discussionRate this briefing
Cite this document
Use the canonical URL for citations and references.
https://pashapolicy.production1.jugaar.ai/documents/personal-data-protection-bill-2023-draft