IT Industry Warns National Data Policy Could Hit Pakistan’s IT Exporters

Meanwhile, the Pakistan IT Industry Association (P@SHA) has triggered concern over ambiguities, compliance requirements and feasible data residency implications for IT exporters under Pakistan's draft National Data Governance Policy 2026.

Key points

• Add ProPakistani to Preferred Sources and see more of our stories in Google Search and Top Stories.
• The framework additionally calls for the appointment of a National Chief Data Officer and dedicated Chief Data Officers in every federal public body.
• Add as a preferredSource on Google Follow on Google News Join WhatsApp.
• The draft policy proposes establishing the Pakistan Digital Authority (PDA) as a central data regulator.
• Public institutions would be assessed annually through a National Data Maturity Index.

In a member briefing published on August 12, P@SHA remarked the draft policy, issued by the Ministry of IT and Telecommunication in July 2026, is Pakistan's first unified framework for the collection, protection and sharing of administration data.

Meanwhile, the draft policy is based on the principle that public sector data should be treated as a strategic national asset. It additionally sets standards and operating arrangements to allow administration entities to share and employ data more effectively.

According to P@SHA, the proposed framework at present applies to public sector data rather than private sector data. Nevertheless, the association stated the distinction between the two needs further clarification, particularly in cases involving public-private partnerships. Pakistan's IT Exports Surge 18% to $417 Million in July. Govt to Act as Data Custodian.

Under the proposed framework, administration departments would act as custodians of citizen data rather than its owners. They would hold the information in trust for citizens.

In practice, the policy additionally introduces a "once-only" principle, under which administration agencies would avoid keeping duplicate citizen records. Instead, they would rely on designated Primary Data Registers.

Data sharing between administration agencies would take place through a centrally governed platform called WASL. It is conceptually modeled on Estonia's X-Road system. Pakistan Farms to Employ AI for Crop and Pest Detection. Pakistan Digital Authority to Regulate Data.

Notably, the draft policy proposes establishing the Pakistan Digital Authority (PDA) as a central data regulator. The authority would have enforcement, audit and corrective powers.

In practice, the framework additionally calls for the appointment of a National Chief Data Officer and dedicated Chief Data Officers in every federal public body.

Public institutions would be assessed annually through a National Data Maturity Index. The index would measure areas such as governance, security, data quality, openness and citizen empowerment. AI and Privacy Rules Proposed.

Meanwhile, the proposed framework additionally includes provisions covering artificial intelligence governance and citizen privacy rights.

AI systems applied by public bodies for automated decision-making would have to be explainable, logged in a public PDA registry and subject to human oversight.

Generative AI systems would additionally face safeguards covering factual inaccuracies, intellectual property violations and data leaks.

Citizens would receive a number of rights under the proposed policy. These would include the ability to view access logs, correct personal data, export information and request deletion where legally permitted.

Administration bodies would additionally be required to adopt Zero-Trust cybersecurity architecture, a security approach that does not automatically trust users or devices even after they enter a network. They would additionally have to report data breaches to the PDA without delay. Data Localization Raises Reservations for IT Exporters.

One of the key provisions in the draft policy would generally require sensitive personal and administration data to be hosted and processed within Pakistan.

Transfers of such data outside the country would require prior regulatory approval.

Meanwhile, non-sensitive public data would be published by default through a National Open Data Portal in machine-readable formats, allowing computers and software systems to process the information more easily.

P@SHA remarked the proposed localization requirements could affect software exporters, freelancers and distributed technology teams if remote international access to data is considered a cross-border data transfer. P@SHA Seeks Clarity on Public and Private Data.

P@SHA identified the lack of a clear distinction between public and private data as the most critical gap in the draft policy.

Notably, the association additionally triggered concern concerning proposed data monetization mechanisms. It remarked these could create tension between the government's role as a custodian of public data and provisions that allow the licensing or pricing of non-personal public data.

P@SHA additionally pointed to the absence of strict financial penalties for non-compliance.

Meanwhile, the association cautioned that audits without meaningful monetary sanctions could weaken enforcement when compared with data governance regimes in jurisdictions including the European Union, Singapore and India.

P@SHA remarked the draft policy remains an notable building block for Pakistan's AI readiness and digital ecosystem. Nevertheless, it stated the framework needs greater clarity on definitions, compliance obligations and cross-border data access before it is implemented. Stay Connected with ProPakistani.

Obtain the latest tech news, telecom insights, and product launches wherever you prefer. Follow on Google Discover.

For now, IT Industry Warns National Data Policy Could Hit Pakistan's IT Exporters remains the part of the story worth watching, and further updates are likely as more details are confirmed.