EFU Life Eyes Waada Digital Acquisition
June 30, 2026
Pakistan declares government data a strategic asset, introducing sweeping rules on sovereignty, privacy, AI, and citizens’ digital rights
In a decisive step toward reshaping Pakistan’s digital governance framework, the Ministry of Information Technology and Telecommunication has introduced the National Data Governance Policy 2026. The policy, prepared under the Digital Nation Pakistan initiative, designates government data as a “strategic national asset” and sets out comprehensive rules on sovereignty, privacy, artificial intelligence, and citizens’ digital rights.
For the first time, a unified governance regime will apply across all federal ministries, regulators, public-sector companies, and contractors. These entities must now comply with standardized rules for collecting, storing, sharing, and disposing of government data. The policy asserts that sensitive government and personal data must remain under Pakistan’s lawful authority, with offshore processing permitted only under strict approvals and safeguards.
A key innovation is the establishment of Primary Data Registers, which will serve as the single authoritative source of citizens’ personal information. Public bodies will be prohibited from creating multiple copies of such data, instead relying on the WASL National Data Exchange platform for secure sharing. This supports the “once-only principle,” ensuring citizens are not repeatedly asked to provide the same information to different agencies, paving the way for streamlined digital services.
The framework also enshrines extensive digital rights. Citizens will gain the right to know which officials accessed their data, correct inaccuracies, request erasure where legally permissible, and demand human review of automated decisions. Privacy protections are strengthened through mandatory Privacy Impact Assessments, stricter safeguards for sensitive and children’s data, and compulsory breach notifications.
Artificial intelligence receives particular attention. Agencies deploying AI for legally significant decisions must ensure transparency, explainability, and human oversight. Details of automated systems will be published in a public registry maintained by the Pakistan Digital Authority (PDA), which will oversee implementation, compliance, and standards. Controls have also been introduced to regulate generative AI, guarding against factual inaccuracies, intellectual property violations, and data leakage.
The policy lays the foundation for a national data economy, enabling structured public-private partnerships, controlled researcher access, and regulated licensing of datasets. However, commercialization cannot override privacy rights or compromise sovereign control. Compliance will be tracked through annual audits and a National Data Maturity Index, ranking institutions on governance, security, openness, and citizen empowerment.
Pending federal cabinet approval and Gazette notification, public bodies will be required to align systems and contracts within twelve months, marking a transformative shift in Pakistan’s digital governance landscape.
