Why Pakistan Is Stalling On Data Protection: A Nation's Digital Dilema

Introduction — the unfulfilled promise of data protection

Despite rapid digitization in Pakistan and frequent data breaches (including leaks of sensitive personal information), the country still lacks an enacted, comprehensive data-protection law. Over the past several years, successive versions of the proposed Personal Data Protection Bill, 2023 and earlier drafts (as far back as 2005) have been prepared — but none has successfully become law.

Observers, activists, and some lawmakers have repeatedly asked: Why the delay, if citizens' privacy and rights are at stake? The answer lies in a tangle of political, economic, institutional and geopolitical considerations.

Driving forces behind reluctance

1. Conflicting state interest: surveillance, control & access to data

One of the chief reasons appears to be that the state itself including powerful institutions has a vested interest in keeping data flows and control largely unchecked. As noted by a detailed 2024 analysis, many previous drafts of the law excluded government agencies and public bodies from the ambit of data protection; in other words, even if the law were passed, state entities handling massive citizen databases (e.g. identity registries) might remain outside its scope.

Moreover, versions of the 2023 bill that attempted to close that gap introduced stringent data-localization and state-access provisions. Critics argue that these measures reflect a government ambition not to protect citizens' privacy but to assert "ownership" over citizens' data, enabling increased surveillance, control over online communications, and politicized use of personal data.

In short: a comprehensive, robust privacy law could constrain the state's ability to surveil or access data at will — a constraint the government may not be willing to accept.

2. Institutional and procedural objections

The most recent attempt to pass the bill a Private Member's Bill introduced in the Senate was formally opposed by the Ministry of Information Technology and Telecommunication (MoITT). The ministry argued that the bill violated the constitution's legislative procedures, specifically the "Rules of Business 1973," because it lacked consultations with critical divisions (e.g. Law and Finance), and involved potential expenditure from the federal consolidated fund making it constitutionally ineligible.

In effect, this provides a procedural/legalistic reason to reject or further delay the bill. Officials say they prefer to move forward with a "government bill," not a private member's proposal.

The ministry also claims it is working on its own draft (a version "aligned with international standards") and that more stakeholder consultations are underway.

Thus the reluctance reflects, in part, bureaucratic inertia and a preference for a version of the law shaped by the state rather than independent or civil society actors.

3. Economic and business-sector pushback

The proposed data-protection law also faces internal resistance from parts of the business community notably international tech companies and investors who warn the law could hinder foreign investment or complicate business operations in Pakistan.

Specifically, mandatory data-localization (requiring that "critical personal data" be stored on servers within Pakistan) and restrictions on cross-border data transfer have been identified as major deterrents for global firms, many of which prefer to host data in more established hubs.

4. Lack of political will & prioritization

Beyond institutional or business pushback, there seems to be a deeper lack of political urgency. According to commentary from legal experts, ordinary citizens, and civil-society voices, the repeated delays reflect a broader failure to prioritise data privacy in a rapidly digitising society.

While the state has showed eagerness and followed through on other cyber-laws (e.g., amendments to the Prevention of Electronic Crimes Act, 2016, or new "e-safety" legislation) that expand the scope for state control over online content, the data protection law seems to be treated as optional or negotiable.

This indicates a political calculus: guaranteeing state control and surveillance may be seen as more strategically important especially in a country with ongoing security, social, and political challenges — than safeguarding individual privacy.

Consequences of continued delay

• Vulnerability to data breaches and misuse: Without legal protection, citizens' personal information from identity documents to telecom metadata remains exposed. Indeed, recent reports reveal that data of hundreds of thousands of citizens (e.g. applicants for pilgrimage) ended up on the "dark web."
• Unchecked state surveillance: In the absence of privacy safeguards, state agencies — potentially including intelligence services access citizen data without oversight or accountability.
• How is a privacy regulation deficient Pakistan viewed internationally : Companies don't have to comply with strict data protection laws and this makes it easier for them. Local security agencies are not the only ones interested in data. International security agencies freely use data supplied to them by the government of Pakistan.

Conclusion — a tension between control and protection

The reluctance of Pakistan's government to pass a robust data-protection law reflects a deeper structural and political tension. On one hand, privacy advocates, citizens, and many businesses argue such a law is necessary to protect personal data, build trust, and enable safe digital growth. On the other, the state along with some powerful private actors perceives greater advantage in maintaining broad access to data: for surveillance, political leverage, regulatory control, and geopolitical positioning.

Until that tension is resolved, either by civil pressure, international leverage, or political realignment, Pakistan's data-protection legislation will likely remain unfinished and its citizens exposed.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.