Citizens will soon have the right to track exactly which government officials are accessing their personal data, under a new draft policy aimed at stripping public agencies of data ownership.
The Ministry of Information Technology and Telecommunication has opened the draft Data Governance Policy 2026 for public consultation, uploading the document to its website for feedback until July 10.
The framework explicitly declares that government data is a strategic national asset held in trust for the public, meaning state institutions are merely custodians rather than owners of citizen information.
Under this proposed system, public bodies must tell citizens who viewed their data, when it happened, and why.
“This right shall not be denied except on narrow grounds expressly provided by law, with reasons recorded,” the draft policy states.
Individuals can also claim their personal records in structured, machine-readable formats and request direct transfers between public departments if technically and legally possible.
The Pakistan Digital Authority (PDA) will oversee and implement these regulations under the Digital Nation Pakistan Act, 2025. However, the policy does not cover personal data held outside the public sector, judicial proceedings, primary legislation or in sensitive domains like national security, defence and parliament.
IT and Telecommunication Minister Shaza Fatima stated that rapid digitisation makes these data protection regulations essential. She noted that the framework will be officially notified after incorporating public suggestions gathered by the July 10 deadline.
Operationally, federal ministries, statutory corporations, regulators, autonomous bodies and public-sector companies must comply.
The rules also apply to private contractors, partners and any entity managing government data through public funding. Provincial governments are being encouraged to set up identical systems.
The framework mandates that public data be open by default via a National Open Data Portal, excluding classified files. All data processing must also respect the right to privacy under Article 14 of the Constitution.
Once a standalone Personal Data Protection law passes, this policy will automatically update to align with it.
For security, departments must use Privacy-Enhancing Technologies matching national safety instruments. Sensitive information requires mandatory encryption, tighter access controls and shorter retention periods, while children’s profiles are protected from behavioral advertising.
If a high-risk data breach occurs, public bodies must alert both the PDA and affected citizens.
Sovereignty rules dictate that government data must stay under Pakistani control, with cross-border transfers blocked unless they meet specific safety criteria and jurisdiction approvals.
