Nearly three years after Pakistan's federal cabinet first approved a Personal Data Protection Bill (PDPB) in mid-2023, the legislation remains stuck in parliamentary limbo — and the longer it sits, the louder industry groups and civil society warn that its cross-border data transfer regime would do more harm than good. The bill's combination of hard data localization for 'critical' personal data, a government-controlled regulator with sweeping discretion, and adequacy determinations made on Islamabad's terms threatens to wall off a market of more than 240 million people from the global digital economy.
Pakistan plainly needs a data protection law. It is one of the largest jurisdictions in the world without comprehensive privacy legislation, and citizens currently rely on a patchwork of constitutional protections, sectoral telecom rules, and the Prevention of Electronic Crimes Act (PECA) 2016. The case for codifying user rights — consent, access, deletion, breach notification — is overwhelming. The problem is not the existence of the PDPB. It is the architecture the Ministry of IT and Telecommunication (MoITT) has chosen.
Three design choices that should worry policymakers
The PDPB's draft text, as reported in successive rounds of public consultation, rests on three pillars that, taken together, point firmly toward digital protectionism rather than rights protection.
First, mandatory localization of 'critical' personal data. The bill empowers the government to designate categories of data that must be stored and processed exclusively on servers physically located in Pakistan. The definition of 'critical' is left to executive notification, meaning the scope can expand with a stroke of a pen. India experimented with a similar open-ended approach in its 2018 draft and ultimately walked it back; Pakistan would be importing the worst version of a model that more mature jurisdictions have abandoned.
Second, a government-controlled National Commission for Personal Data Protection. Unlike the genuinely independent data protection authorities envisaged under the EU's GDPR or contemplated in India's Digital Personal Data Protection Act, 2023, the proposed Pakistani commission would sit under executive influence, with members appointed by the federal government. That same body would decide which foreign countries are 'adequate' destinations for transfers — a determination that is functionally a trade decision dressed up as a privacy assessment.
Third, a narrow and bureaucratic transfer regime. Where modern frameworks accept layered safeguards — standard contractual clauses, binding corporate rules, certification schemes — Pakistan's draft leans heavily on case-by-case approvals and country-level whitelists. For small and mid-sized exporters that cannot afford a Karachi data center, that is the regulatory equivalent of a closed door.
What the evidence says about localization
The economic case against blanket data localization is by now well established. The European Centre for International Political Economy (ECIPE) has repeatedly estimated that strict localization mandates can shave meaningful percentages off GDP and investment in adopting economies, while OECD work on cross-border data flows has consistently found that open transfer regimes correlate with higher digital trade and services exports. The Asia Internet Coalition (AIC) — whose members include Google, Meta, Amazon, and Apple — has publicly urged Islamabad to align the PDPB with international best practice, warning that the current draft would 'restrict the free flow of data' and undermine Pakistan's own digital ambitions.
The irony is sharp. Pakistan's IT export sector has been one of the few bright spots in an otherwise constrained macroeconomy, with the State Bank of Pakistan reporting record monthly IT and IT-enabled services exports through 2024 and 2025. Those exports depend almost entirely on the ability of Pakistani firms to move data — payroll, customer records, code repositories — across borders to clients in the US, UK, and Gulf. A law that turns every routine transfer into a regulated event is a tax on the country's most promising industry.
A better path: proportionate, interoperable, rights-protective
Pakistan does not have to choose between privacy and openness. A proportionate PDPB would:
- Anchor cross-border transfers in safeguards, not geography. Permit transfers wherever the exporting controller can demonstrate equivalent protections via contracts, codes of conduct, or certifications — the model now used from Brazil's LGPD to Singapore's PDPA.
- Establish a genuinely independent commission, with fixed tenures, parliamentary oversight, and a clear judicial appeal route — not an executive arm dressed in regulator's robes.
- Reserve localization for a narrowly defined sliver of truly sensitive data (for example, certain financial or biometric records), with sunset clauses and impact assessments built in.
- Plug into existing interoperability initiatives — the Global CBPR Forum, ASEAN's Model Contractual Clauses — rather than building a one-country adequacy regime from scratch.
Privacy protection and free data flows are not opposing values. The countries that have grown fastest in digital services are precisely those that have built credible rights frameworks and kept their borders open to data.
The window is closing
Pakistan's parliament has an opportunity, before the PDPB returns for its next reading, to redraft a bill that protects citizens without isolating them. The current draft, if passed as cabinet-approved, would make Pakistan a cautionary tale rather than a model — and would push the very platforms its 240 million users rely on toward harder choices about whether to keep serving the market at all. A pro-innovation, rights-protective alternative is well within reach. It just requires Islamabad to choose interoperability over insulation.