PAKISTAN Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, S.U.Khan Associates
and its disclosure should be restricted to parties directly involved, such as legal advisers, auditors or regulatory bodies, and only when essential. Data subjects must be transparently informed about the collection, purpose and any sharing of their personal data. Furthermore, if personal data is transferred across borders, the buyer, processor or controller must ensure that the receiving country has adequate data protection measures in place to safeguard the privacy and security of the data. 5. International Considerations 5.1 Restrictions on International Data Transfers Under the Draft Bill, the transfer of personal data outside Pakistan is only permissible in the fol - lowing cases: • equivalent protection; • explicit consent of the data subject; and • under a framework to be devised by the NCPDP. In the absence of an adequate data protection legal regime, the NCPDP may allow for the trans - fer of personal data outside Pakistan in the fol - lowing cases: • for a binding contract/agreement; • with explicit consent of the data subject that does not conflict with the public interest or national security of Pakistan; • when international co-operation is required under relevant international obligations; and • any further conditions specified by the NCPDP.
It should be noted that critical personal data is not allowed to be transferred outside Pakistan. Under the Draft Bill, the NCPDP is required to devise a mechanism for keeping some compo - nents of sensitive personal data within Pakistan (ie, data localisation). The NCPDP shall also devise a mechanism for sharing sensitive personal data with the gov - ernment of Pakistan, provided that the data relates to public order or national security and is required within the parameters of applicable law. 5.2 Government Notifications and Approvals Under the Draft Bill, one permissible mode of cross-border transfer of personal data is a “mechanism to be devised by the NCPDP”. On establishment of the NCPDP, said mechanism may contain any approval requirements for all or any class of personal data. 5.3 Data Localisation Requirements The Draft Bill provides that critical personal data is only to be kept within Pakistan. 5.4 Blocking Statutes There are no blocking statutes related to data privacy or otherwise. 5.5 Recent Developments No such developments have been noted.
340 CHAMBERS.COM
Powered by FlippingBook