PAKISTAN Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, S.U.Khan Associates
legitimate purposes and must not be further pro - cessed in a way that is incompatible with those purposes. • Data Minimisation: The data collected must be adequate, relevant, and limited to what is neces - sary to achieve the stated processing purpose. • Regulatory Registration: Data controllers and processors operating in Pakistan must register with the Commission in the prescribed manner or notify the Commission if already registered with another public authority. • Appointment of Data Protection Officer: Data controllers or processors classified as “significant” by the Commission must appoint a data protection officer with adequate knowledge of personal data processing and related risks. Rights of Data Subjects The Draft Bill provides the following rights to data subjects: • Right to Access: A data subject has the right of access to their personal data and may obtain confirmation from a data controller as to whether their personal data is being processed or has been processed. • Right to Correction: A data subject may make a data correction request in writing to a data control - ler or data processor. • Right to Withdraw Consent: A data subject may withdraw his/her consent by giving a written notice. • Right to Prevent Processing Likely to Cause Dam - age or Distress: A data subject has the right to pre - vent the processing, subject to certain conditions, by providing a data subject notice. • Right to Erasure: A data subject has the right to request that the data controller erase his/her per - sonal data without undue delay. • Right to Nominate: A data subject has the right to nominate anyone to exercise his/her rights in the event of death or disability. • Right to Redressal of Grievance: A data subject may file a complaint with the data controller, and in case where a data controller fails to resolve his/her grievance, the data subject may file a compliant with the Commission. • Right to Data Portability and Automated Process - ing: A data subject shall have the right to receive
his/her personal data from the data controller in a proper form, and the right not to be subject to a decision based solely on automated processing. Compliance “To Dos” As Pakistan’s Personal Data Protection Bill is still in draft form, its provisions do not yet offer a complete or enforceable compliance framework. In this interim period, it is prudent for organisations to align their data protection practices not only with the principles reflected in the Draft Bill, but also with established international best practices, particularly those embod - ied in the GDPR, to ensure a higher level of data pro - tection, regulatory readiness, and future compliance once the law is enacted. 1.3 Special Categories of Personal Data Under the Draft Bill, sensitive and critical personal data may only be processed on an exceptional basis. Gen - erally, explicit consent of the data subject is required, provided such consent is not restricted by any other applicable law. In addition, processing is permitted only when one of the following conditions is met: • where it is necessary for clearly defined purposes, including employment-related legal rights and obligations, • for protection of vital interests where consent can - not reasonably be obtained; • for medical purposes subject to confidentiality; • for legal proceedings and legal advice; • for the establishment or defence of legal rights; • for administration of justice under court orders, or the exercise of functions conferred by law; and • where the data has been deliberately made public by the data subject. The Commission retains the power to impose addi - tional conditions or restrict the application of certain grounds through orders published in the Gazette. Children’s Personal Data Processing Personal data relating to a child must be processed in a way that safeguards the child’s rights and best inter - ests. Before processing such data, data controllers and processors are required to verify the child’s age and obtain consent from a parent or legally authorised guardian in accordance with rules prescribed by law.
360 CHAMBERS.COM
Powered by FlippingBook