By Staff Reporter
ISLAMABAD: The Ministry of Information Technology and Telecommunication has published a draft Data Governance Policy for 2026, opening it to public comment and casting government-held data as a strategic national asset that must be managed in trust for citizens rather than treated as the property of the agencies that hold it.
The draft, posted on the ministry’s website, will remain open for public submissions until July 10. Officials said it would be formally notified once relevant feedback has been incorporated.
Speaking on the policy, Minister for Information Technology and Telecommunication Shaza Fatima said the rapid pace of digitisation across government had made clear rules on data protection and use necessary. She said the consultation period would run until July 10, after which the ministry would finalise the policy in light of public input.
The draft sets out the policy’s central principle in direct terms: government data belongs to the public, not to whichever ministry, department or agency happens to hold it. Public bodies, it states, act as custodians of that data rather than its owners, a distinction that underpins much of the document’s approach to access, accountability and individual rights.
Among its central provisions, the policy would give citizens the right to find out which government officials or entities have accessed their personal data, when that access occurred and for what purpose it was used. The draft describes this as a right that cannot be withheld except on narrow, legally defined grounds, and only where the reasons for withholding it are formally recorded.
The policy also lays out requirements for how personal data is technically safeguarded. Public bodies that process such data would be required to deploy Privacy-Enhancing Technologies suited to their specific functions, operating under two supporting instruments referenced in the draft: a Data Security Standards Instrument and a Privacy by Design and Impact Assessment Instrument.
Citizens would additionally gain the right to request their own personal data in a structured, machine-readable format, and to have it transferred directly between government bodies where doing so is both technically possible and legally permitted, a provision similar to data portability rules adopted in some other jurisdictions.
Oversight of the framework would fall to the Pakistan Digital Authority, which the draft designates as the national body responsible for issuing, supervising and implementing the policy and its associated instruments under the Digital Nation Pakistan Act, 2025.
On data sovereignty, the policy states that government data must remain under Pakistan’s lawful authority and effective control at all times. Transfers of that data across borders would only be permitted under defined governance mechanisms, in justified circumstances and with adequate safeguards in place, rather than as a matter of routine practice.
The draft’s scope is broad, extending to federal ministries, divisions, departments, attached departments and subordinate offices, along with statutory corporations, regulators, authorities, commissions, autonomous bodies and public-sector companies operating under federal jurisdiction. It would also apply to entities that receive public funds to manage government data, as well as contractors, processors, concessionaires, grantees and other partners that perform public functions or process government data on the federal government’s behalf. Provincial governments are encouraged, though not required, to adopt the policy or to develop their own equivalent frameworks.
On openness, the draft proposes that public-sector data be open by default, made available through a National Open Data Portal in machine-readable formats accompanied by appropriate metadata, except where classification rules or statutory restrictions apply.
The policy requires that all processing of personal data by public bodies be lawful, fair and transparent, in keeping with the constitutional right to privacy guaranteed under Article 14 of Pakistan’s Constitution. Personal data may only be processed on recognised lawful grounds, among them consent, contractual obligations, legal requirements, vital interests or the performance of public functions. The draft notes that once Pakistan enacts a comprehensive Personal Data Protection law, the policy will be revised to bring it into line with that statutory framework.
Sensitive personal data would be subject to heightened protections under the draft, including stricter access controls, mandatory encryption, shorter data retention periods, a requirement for an explicit lawful basis for processing, and enhanced audit requirements. Children’s data would receive a further layer of protection, with age-appropriate notices, limits on profiling and behavioural advertising, and provisions for parental or guardian involvement where required.
The draft also sets out breach-notification obligations, requiring public bodies to inform the Pakistan Digital Authority without undue delay following any personal data breach. Where a breach is found to pose a high risk to individuals’ rights and freedoms, affected citizens must be notified directly as well.
On the question of data leaving the country, the policy permits cross-border transfers of government data only through approved pathways, with decisions guided by the classification and sensitivity of the data involved, its intended use, and the legal jurisdiction of the recipient.
The draft explicitly excludes certain categories from its scope: personal data held outside the public sector, primary legislation, judicial proceedings, and matters falling within specific national security, defence, parliamentary or judicial domains.
Copyright © 2021 Independent Pakistan | All rights reserved
