Key Points
- Sensitive data to remain hosted in Pakistan, with strict rules for cross-border transfers
- Citizens gain new digital rights, including access logs, data correction, portability and human review of AI decisions
- Pakistan Digital Authority is designated as the lead regulator for implementation and compliance
ISLAMABAD: Pakistan has unveiled its National Data Governance Policy 2026, introducing the country’s first comprehensive framework for governing public-sector data and declaring government data a strategic national asset.
With the new national data policy in place, Islamabad accelerates its digital transformation agenda under the Digital Nation Pakistan initiative.
The policy establishes uniform rules for the collection, storage, sharing, use and disposal of government data across all federal ministries, divisions, attached departments, regulators, autonomous bodies, public-sector enterprises and contractors handling public information.
It aims to strengthen digital governance, improve service delivery, safeguard citizens’ privacy and enhance trust in government-led digital services.
The framework places Pakistan among a growing number of countries seeking stronger digital sovereignty. The concept of sovereignty asserts that government data must remain under the country’s lawful authority and effective control.
As a general rule, sensitive government information and personal data to be hosted and processed within Pakistan.
Any overseas processing will require prior approval, risk assessments and additional safeguards to ensure national security and data protection.
Pakistan bars multiple copies of citizen information
One of the policy’s most significant reforms prohibits government institutions from maintaining multiple copies of citizens’ personal information.
Instead, agencies will rely on designated Primary Data Registers serving as the single authoritative source of official records.
Information sharing among public bodies will occur through the National Data Exchange platform, known as WASL, reducing duplication and improving the accuracy and consistency of government databases.
ALSO READ: Pakistan Govt Tables ‘Digital Nation Pakistan Bill 2024’ in Parliament
The policy also adopts the internationally recognised “once-only principle.” Under the principle, citizens should not be required to resubmit the same information to multiple government departments.
Pakistani citizens’ digital rights
A major feature of the framework is its emphasis on citizens’ digital rights. Individuals will have the right to know which government officials have accessed their personal data.
The rights would also include requesting corrections to inaccurate records, obtaining copies of their information in portable formats, seeking erasure of data where legally permissible and receiving meaningful human review of government decisions made through automated systems.
The policy also requires explicit and granular consent whenever consent forms the legal basis for processing personal information.
Privacy Impact Assessment
Privacy protections have been significantly strengthened with mandatory Privacy Impact Assessments for high-risk data processing activities. It would also ensure enhanced safeguards for sensitive personal information and children’s data.
Artificial intelligence occupies a central place in the new framework. Government agencies deploying AI systems for decisions of legal or significant public consequences will be required to ensure explainability, transparency, and continuous monitoring.
Pakistan Digital Authority
Public institutions must also disclose automated decision-making systems through a public registry maintained by the Pakistan Digital Authority (PDA).
The policy further establishes safeguards governing the public sector’s use of generative artificial intelligence.
Government agencies will be expected to implement measures to minimise factual inaccuracies, prevent intellectual property violations and guard against the leakage of confidential or sensitive information through AI systems.
Allowing careful public-private partnership, the policy makes clear that commercial use of public data cannot override citizens’ privacy rights or compromise Pakistan’s sovereign control over critical government databases.
Institutional responsibility for implementation rests primarily with the Pakistan Digital Authority. The authority will issue binding technical standards, oversee compliance and establish a National Data Governance Council.
The council will comprise representatives from federal ministries, provincial governments, regulators and other stakeholders. Every public-sector organisation will also be required to appoint a Chief Data Officer.
Compliance will be monitored through annual self-assessments, independent audits and a National Data Maturity Index. Institutions that repeatedly fail to comply with the framework may face binding corrective directions and enforcement actions issued by the Pakistan Digital Authority.
The policy will become operational after approval by the federal cabinet and publication in the Official Gazette. Public institutions will then be required to align their information systems, contractual arrangements and operational processes with the new framework.
