Navigating the New Frontier of Data Privacy in Pakistan
As Pakistan moves toward a comprehensive digital economy, the legal framework for data privacy is undergoing a seismic shift. For organizations handling citizen data, the transition from voluntary best practices to mandatory legal obligations is now a critical business imperative. This note outlines the salient features of the pending Personal Data Protection Bill (“PDPB”), 2023 (latest published draft, May 2023), and the “Mandatory Data Protection Measures for Organizations Handling PII” issued in August 2025 by the National Cyber Emergency Response Team (“PKCERT”) (the “PKCERT Advisory”).