Prevention of Electronic Crimes Act (PECA) 2016

Briefing

By Rahnuma · AI-generated

The Prevention of Electronic Crimes Act (PECA) 2016 is Pakistan's primary cybersecurity legislation establishing offenses, investigative powers, and prosecution procedures for electronic crimes. The Act extends to all Pakistanis worldwide and covers extraterritorial offenses affecting persons or systems in Pakistan (Section 1). Chapter II defines 21+ offenses ranging from unauthorized access (Section 3) and data interference (Section 5) to cyber terrorism (Section 10) and hate speech (Section 10A), with penalties scaling from 3 months to 14 years imprisonment. Chapter III establishes the investigation agency framework, data preservation powers (Section 28), real-time collection authority (Section 36), and a forensic laboratory requirement (Section 37). Chapter V addresses prosecution and trial procedures including compoundable offenses (Section 40), while Chapter VI mandates preventive measures including Computer Emergency Response Teams (Section 46). Service provider liability limitations are codified in Section 35.

Plain-language explanation

PECA 2016 is Pakistan's main law for tackling computer and internet crimes. It creates specific crimes with set punishments and gives police powers to investigate digital offenses. If someone hacks into your company's database without permission, they face up to 3 months in prison or Rs. 50,000 fine under Section 3. If they damage or destroy your critical systems, penalties rise to 7 years and Rs. 10 million under Section 8. The law also covers online fraud, identity theft, spreading viruses, cyber stalking, and hate speech. Telecom companies and internet service providers must keep records of who contacted whom for at least one year and hand these over to police with a court order. Businesses can face fines up to Rs. 10 million for failing to follow government security directives. However, service providers have legal protection if they merely host content without actively participating in crimes. The Authority can order removal of unlawful online content, with appeal rights to the High Court within 30 days.

Compliance & opportunity checklist

Conduct employee training on identifying and preventing unauthorized access to company information systems (Sections 3, 5)
Implement data backup and integrity verification systems to protect against malicious code attacks (Section 20)
Verify that SIM card distributors comply with subscriber verification requirements under Section 15
Ensure spam and marketing communications include unsubscribe options as required by Section 22(2)
Review privacy settings and content moderation policies to protect against dignity violations under Section 18
Retain traffic data and subscriber information for minimum one year per Section 29 requirements
Establish incident response procedures aligned with Computer Emergency Response Team protocols (Section 46)
Document compliance measures and preserve evidence chain of custody for potential investigations (Section 32)

Key numbers

Unauthorized access to information system

3 months imprisonment or Rs. 50,000 fine imprisonment/fine

· Section 3

Interference with critical infrastructure

7 years imprisonment or Rs. 10 million fine imprisonment/fine

· Section 8

Cyber terrorism

14 years imprisonment or Rs. 50 million fine imprisonment/fine

· Section 10

Hate speech

7 years imprisonment imprisonment/fine

· Section 10A

Child pornography

7 years imprisonment or Rs. 5 million fine imprisonment/fine

· Section 19A

Data retention failure (first offense)

Rs. 10 million fine

· Section 29(3)

Data preservation period

90 days days

· Section 28(1)

Traffic data retention minimum

1 year year

· Section 29(1)

Real-time collection maximum

7 days days

· Section 36(1)

Appeal period

30 days days

· Section 44

Authority review application

30 days days

· Section 34(4)

Cyber stalking (minor victim)

5 years or Rs. 10 million imprisonment/fine

· Section 21(2)

Frequently asked

By Rahnuma · AI-generated

What constitutes unauthorized access under PECA and what are the penalties?

Under Section 3, unauthorized access means accessing an information system or data not available to the general public, without authorization or in violation of authorization terms. Gaining such access with dishonest intention is punishable with up to 3 months imprisonment or Rs. 50,000 fine, or both. Section 5 increases penalties for interference with information systems to 2 years or Rs. 500,000.

How does PECA protect against cyber terrorism and what are the maximum penalties?

Section 10 defines cyber terrorism as committing or threatening offenses under Sections 6-9 with intent to coerce or intimidate government/public, advance inter-faith hatred, or advance objectives of proscribed organizations. The maximum penalty under Section 10 is 14 years imprisonment or Rs. 50 million fine, or both. Section 10A separately criminalizes hate speech advancing sectarian or racial hatred with up to 7 years imprisonment.

What are the data retention obligations for service providers?

Section 29 mandates that service providers retain traffic data for a minimum of one year (or as notified by the Authority) and provide it to investigation agencies upon court warrant. Non-licensees violating this face Rs. 10 million fine for first offense; subsequent violations carry 6 months imprisonment or fine. Licensees face violation of license terms under the Telecom Re-organization Act.

Can companies be held liable for content on their platforms under PECA?

Section 35 provides significant liability protections for service providers. No civil or criminal liability attaches unless specific actual knowledge and willful intent to participate is proven. Providers have no obligation to proactively monitor content. They are protected when acting in good faith and may temporarily withhold disclosure of investigations for up to 14 days (extendable by court order).

What remedies are available to individuals whose dignity or privacy has been violated online?

Under Section 18, any person whose reputation or privacy has been harmed by false information displayed through information systems may apply to the Authority for removal, destruction, or blocking access to such content. The Authority must pass forthwith orders deemed reasonable. Similar remedies exist for cyber stalking (Section 21) and offenses against modesty (Section 19).

Ask about this document

Cited in

No editorial items currently cite this document.

Related instruments

Depends on AI

National Cybersecurity Policy 2021 (Final)

The National Cybersecurity Policy 2021 relies on PECA's enforcement framework and criminal provisions to prosecute cyber incidents, unauthorized access, and critical infrastructure attacks defined under the Act.

Enables AI

PECA: Online Content Rules 2021

PECA: Online Content Rules 2021 operationalizes PECA's Chapter II offences by prescribing specific procedures for compliance, takedown requests, and content moderation obligations for service providers.

Part of AI

PECA Amendment Bill (2025)

The PECA Amendment Bill 2025 directly amends provisions of PECA 2016, modifying offences, penalties, or enforcement mechanisms established in the parent Act.

Part of AI

PECA: Online Content Rules 2021

These rules are made under sections 37 and 51 of PECA 2016, making them subordinate legislation that forms part of the PECA framework.

Part of AI

PECA Amendment Bill (2025)

The amendment directly modifies the Prevention of Electronic Crimes Act 2016, inserting new definitions, establishing the Social Media Protection and Regulatory Authority, and expanding enforcement mechanisms, thereby forming an integral part of the

Conflicts AI

Copyright Ordinance 1962: IT/Software Amendments

PECA 2016 establishes digital/cyber crime penalties that may overlap with or supersede copyright infringement remedies for software and digital content under the Copyright Ordinance, creating potential jurisdictional and enforcement conflicts for IT

Depends on AI

PECA: Online Content Rules 2021

These rules are explicitly made under section 37 and section 51 of PECA 2016, which provides the statutory foundation and defines what constitutes unlawful online content.

Discuss this document

Start a discussion

Rate this briefing

Cite this document

Use the canonical URL for citations and references.

https://pashapolicy.production1.jugaar.ai/documents/prevention-of-electronic-crimes-act-peca-2016