Pakistan: Issued draft of the Pakistan Personal Data Protection Bill including cross-border transfer of personal data

On 19 May 2023, the Pakistan Ministry of Information Technology and Telecommunication (MITT) released a draft of the Pakistan Personal Data Protection Bill. In particular, Chapter V of the draft regulates the transfer of personal data outside Pakistan and establishes that data shall not be transferred to any unauthorised person or system. Transfer of personal data outside the territory of Pakistan is authorised only after fulfilling necessary explicit consent requirements under the Act. In the absence of an adequate data protection legal regime of the country of destination, transfer of personal data outside Pakistan will be authorised if there is a binding agreement, the explicit consent of the data does not conflict with the public interest or national security of Pakistan, international cooperation is required under relevant international obligations, and any further conditions that may be specified by the competent authority.