Pakistan: Issued draft of Pakistan Personal Data Protection Bill including data protection regulation

On 19 May 2023, the Pakistan Ministry of Information Technology and Telecommunication (MITT) released a draft of the Pakistan Personal Data Protection Bill (PDPB) containing data protection measures. The draft regulates the processing of personal data and the obligations of data controllers and data processors. It has extra-territorial scope, and applies to data controllers and processors in Pakistan or connected to Pakistan. The Act prohibits data processing unless the data controller obtains prior consent from the data subject. Moreover, under the new regulation, a data breach should be notified to the National Commission for Personal Data Protection (NCPDP) and to the data subject. Users have the right to: be informed about the processing of their personal data; access or have a copy of their personal data processed by a data controller (under the payment of a fee), request correction or erasure of such data, withdraw the consent to personal data processing, among others. Finally, the draft emphasises the protection of children's personal data and establishes legal grounds for data processing.