The legal framework
Pakistan has not enacted a general personal data protection law; successive drafts of a Personal Data Protection Bill have been prepared without being passed. In the meantime, the Prevention of Electronic Crimes Act 2016 criminalises unauthorised access, identity misuse and non-consensual distribution of intimate images, and sectoral regulators impose confidentiality duties on banks and telecoms.
Key points
| General data protection law | Not yet enacted; drafts pending |
|---|---|
| PECA 2016 | Criminalises unauthorised access, data interference and misuse of identity information |
| Intimate images | Non-consensual distribution is an offence, with takedown powers |
| Regulators | State Bank and the Telecommunication Authority impose sectoral confidentiality obligations |
| Constitutional privacy | Article 14 protects the privacy of the home and the dignity of the person |
| Practical route | The FIA Cybercrime Wing handles complaints about misuse of personal data online |
| No statute in force | Successive draft bills have not been enacted |
| Constitutional route | Article 14 and Article 199 petitions before the High Court |
| Sectoral rules | Banking and telecom regulators impose confidentiality duties |
| PECA | Criminalises unauthorised access and identity data misuse |
In practice
- For online misuse of your data or images, complain to the FIA Cybercrime Wing, which has a dedicated complaint portal and helpline.
- For banking or telecom data, complain to the sectoral regulator, which can compel a response.
- For services based in Europe, invoke the GDPR — it often produces a faster result than domestic routes.
- Keep evidence: URLs, screenshots and timestamps.
- Use the sector regulator where one exists: banking and telecom complaints have real channels.
- Document everything; without a regulator, evidence is all you will have.
Cost and coverage
Complaints to the FIA and to regulators are free.
Recent changes
The Digital Rights Foundation and other organisations run helplines specifically for online harassment and privacy violations, which are often the fastest practical route.
Where to go
- FIA Cybercrime Wing complaint portal and helpline.
- Digital Rights Foundation Cyber Harassment Helpline.
- Pakistan Telecommunication Authority for telecom-related complaints.
Worth knowing
Where a foreign platform is involved, a GDPR request can succeed even from Pakistan if the company operates in Europe — worth trying alongside the domestic complaint. With no data protection authority, sectoral regulators are the only administrative route. For anything else, the constitutional petition is the realistic option.
Official sources and links
- Government of Pakistan — official government portal