Pakistan Personal Data Protection Bill (PDPB 2023, pending) + PECA 2016/2025: AI Compliance Requirements
Pakistan's only currently-BINDING cyber/data law is PECA 2016 (Prevention of Electronic Crimes Act, effective 2016-08-19), as significantly amended by the Prevention of Electronic Crimes Amendment Act 2025 (passed January 2025) — which added Section 26A, criminalizing dissemination of "false or fake information" likely to cause fear/panic/unrest, and created a Social Media Protection & Regulatory Authority, a National Cybercrime Investigation Authority, a Social Media Complaint Council, and Social Media Protection Tribunal(s). The Personal Data Protection Bill (PDPB 2023) remains PENDING — approved in principle by the Federal Cabinet, introduced in the Senate, but STILL NOT ENACTED as of mid-2026 despite an earlier "anticipated enforcement target" of January 2025 having already passed. Organizations operating in Pakistan or processing data of Pakistani residents face existing PECA 2016/2025 obligations now and should prepare for PDPB enactment, but should not treat PDPB's proposed duties as currently binding. Pakistan has the world's 5th-largest internet user base (~125M users), making it a significant market for AI services.
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
August 19, 2016
PECA 2016 (binding now): PKR 10,000,000 (~$35,000 USD) and up to 7 years imprisonment for the most serious offenses. PECA Amendment Act 2025, Section 26A (binding now): up to 3 years imprisonment plus PKR 2,000,000 fine for disseminating "false or fake information" likely to cause fear, panic, or unrest. PDPB 2023 (PROPOSED, NOT YET LAW): PKR 25,000,000 (~$89,000 USD) for organizations — do not treat as a current binding ceiling.
What Your Business Must Do
5 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
PECA Amendment Act 2025, Section 26A — False/Fake Information Offense
High PriorityPECA Amendment Act 2025 (passed January 2025) added Section 26A, criminalizing dissemination of "false or fake information" likely to cause fear, panic, or unrest. AI-generated content (deepfakes, synthetic text/images/audio, AI-fabricated news) accessible to or targeting Pakistani users can trigger liability if it qualifies as false/fake information under this standard. Enforced by the newly created Social Media Protection & Regulatory Authority, National Cybercrime Investigation Authority, Social Media Complaint Council, and Social Media Protection Tribunal(s).
PECA 2016 Data and AI Compliance
High PriorityPECA 2016 Sections 9-21 govern unauthorized access, data damage, and electronic fraud. AI systems deployed in Pakistan must ensure they do not inadvertently facilitate data theft, unauthorized profiling, or privacy violations under PECA. PTA has authority to block non-compliant digital services. AI systems in telecom, fintech, and media must obtain PTA pre-approval for deployment.
Consent and Privacy Notice Requirements (PDPB 2023 — PENDING, not yet law)
Lower PriorityPDPB 2023 Chapter 3 PROPOSES requiring data fiduciaries to obtain informed consent before processing personal data and provide a clear privacy notice describing: identity of controller, purposes of processing, AI automated decision-making, data subject rights, and cross-border transfer information, in English and Urdu. NOT YET BINDING — PDPB remains pending in Parliament as of this cycle. Monitor for enactment; not a current legal obligation.
Data Principal Rights and Grievance Mechanism (PDPB 2023 — PENDING, not yet law)
Lower PriorityPDPB 2023 Chapter 5 PROPOSES granting Pakistani residents rights to access, correct, erase, and port personal data, with AI automated decisions explainable and subject to human review, a designated DPO for large-scale processing, and a 30-day grievance mechanism. NOT YET BINDING — PDPB remains pending in Parliament as of this cycle. Monitor for enactment; not a current legal obligation.
Data Localization for Sensitive Categories (PDPB 2023 — PENDING, not yet law)
Lower PriorityPDPB 2023 PROPOSES mandatory data localization for sensitive personal data categories (health, financial, biometric, government ID) of Pakistani nationals, with cloud AI services required to store primary copies on Pakistan-based servers absent PDPC approval or standard contractual clauses. NOT YET BINDING — PDPB remains pending in Parliament as of this cycle. Monitor for enactment; not a current legal obligation.
Recent Regulatory Guidance
Pakistan PDPB 2023 (MoITT draft) + draft National AI Policy; deepfakes under PECA 2016
Pakistan's Ministry of Information Technology and Telecommunication (MoITT) published the final draft Personal Data Protection Bill in May 2023 (introduced in the Senate in February 2023), which proposes a National Commission for Personal Data Protection to supervise compliance, and separately prepared a draft National AI Policy (2023) for an AI-enabling ecosystem covering ethics and standardization. Pending enactment of the PDPB, AI-driven processing and deepfake content involving Pakistani citizens are addressed under the Prevention of Electronic Crimes Act (PECA) 2016, enforced by the FIA and PTA (the FIA Cyber Crime Wing recorded roughly 1,200 deepfake-related complaints in 2023). Organizations should document lawful basis, transparency, and data-subject rights for AI processing of Pakistani-resident data and prepare for PDPB registration once enacted.
Prevention of Electronic Crimes Amendment Act 2025 (passed January 2025)
The PECA Amendment Act 2025 added Section 26A, criminalizing dissemination of "false or fake information" likely to cause fear, panic, or unrest — up to 3 years imprisonment (reduced from an initially-proposed 7) plus a PKR 2,000,000 fine. It established four new bodies: the Social Media Protection & Regulatory Authority, the National Cybercrime Investigation Authority, the Social Media Complaint Council, and the Social Media Protection Tribunal(s) — whose members are executive-appointed, with appeals bypassing the High Courts directly to the Supreme Court. Multiple human-rights organizations (Amnesty International, Human Rights Watch, the International Federation of Journalists) have criticized the "false information" standard as vague and a press-freedom risk. Directly relevant to AI compliance: AI-generated misinformation or fabricated content accessible in Pakistan can trigger Section 26A liability.
Key Case Law & Precedent
FTC Operation AI Comply (Sept 2024)
US Federal Trade Commission · 2024Pakistan is not bound by US enforcement and no specific Pakistani instrument citing this action was independently confirmed this cycle. Provided as an illustrative international comparator: the FTC's enforcement sweep against deceptive AI marketing claims illustrates the kind of AI-deception conduct that could separately implicate PECA 2016's dignity-and-deception offenses, or the anticipated PDPB 2023's transparency obligations once enacted, for AI-driven services reaching Pakistani users.
Outcome: Five FTC orders, including DoNotPay $193K and Rytr permanent ban
Case referenceFrequently Asked Questions
Does Pakistan Personal Data Protection Bill (PDPB 2023, pending) + PECA 2016/2025 apply to my business?
Pakistan's only currently-BINDING cyber/data law is PECA 2016 (Prevention of Electronic Crimes Act, effective 2016-08-19), as significantly amended by the Prevention of Electronic Crimes Amendment Act 2025 (passed January 2025) — which added Section… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under Pakistan Personal Data Protection Bill (PDPB 2023, pending) + PECA 2016/2025 is: PECA 2016 (binding now): PKR 10,000,000 (~$35,000 USD) and up to 7 years imprisonment for the most serious offenses. PECA Amendment Act 2025, Section 26A (binding now): up to 3 years imprisonment plus PKR 2,000,000 fine for disseminating "false or fake information" likely to cause fear, panic, or unrest. PDPB 2023 (PROPOSED, NOT YET LAW): PKR 25,000,000 (~$89,000 USD) for organizations — do not treat as a current binding ceiling.. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with Pakistan Personal Data Protection Bill (PDPB 2023, pending) + PECA 2016/2025?
The 5 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://moitt.gov.pk/personal-data-protection-billLast updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan