PAKISTAN Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, S.U.Khan Associates
2.3 Collective Redress Mechanisms The Draft Bill does not provide for any collective redress mechanism. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation Currently, Pakistan does not have a specific, stan - dalone regulation dedicated exclusively to governing the use of internet of things (IOT) services. 3.2 Interaction of Data Regulation and Data Protection The interplay between these domains is rooted in the necessity to align data regulation frameworks with data protection principles rather than allowing them to conflict. Regulatory bodies such as the PTA and the SBP monitor compliance with data regulations within their domains. The NCPDP, once operational, will oversee compli - ance with the Draft Bill, impose penalties for violations and manage grievances. 3.3 Rights and Obligations Under Applicable Data Regulation There is no applicable information in this jurisdiction. 3.4 Regulators and Enforcement There is no applicable information in this jurisdiction.
The complaint must be filed in a simple written format, and the complainant must certify that they have not already or concurrently filed any application, com - plaint or suit before any other forum or court. An individual whose identity information has been obtained, possessed, distributed or used without authorisation may file a complaint with the Federal Investigation Agency (FIA). Where the victim seeks to block access to identifiable information or secure its destruction, they may approach the Pakistan Tel - ecommunication Authority (PTA), established under the Pakistan Telecommunication (Re-Organization) Act 1996. Any malpractice carried out by a bank with respect to the secrecy of customers’ data may be challenged before the banking muhtasib (banking ombudsman). Once an investigation is initiated and the relevant law is applied, administrative fines are imposed in accord - ance with the provisions of the respective laws that define the offence and prescribe the corresponding fines or penalties. As of January 2026, there are no publicly reported cases of administrative fines having been issued in Pakistan specifically for breaches of individual privacy rights. The Draft Bill, however, provides for fines of up to USD2 million for unlawful processing of personal data. 1.9 Enforcement Trends No enforcement trends have been recorded.
2. Privacy Litigation 2.1 Privacy Litigation Overview
4. Sectoral Topics 4.1 Use of Cookies
The absence of a data protection law has resulted in a corresponding absence of dedicated privacy litiga - tion in Pakistan. 2.2 Recent Case Law There is no applicable information in this jurisdiction.
The Draft Bill does not specifically address require - ments regarding the use of cookies; however, it has laid down the basic principles for processing, such as purpose specification, limitation, lawfulness, transpar - ency, data retention, etc. These need to be followed by data controllers and processors while using cook - ies.
362 CHAMBERS.COM
Powered by FlippingBook