Pakistan’s approach to protecting citizens’ personal data has long been reactive. Despite the Prevention of Electronic Crimes Act (2016) criminalising data theft, successive governments have done little to secure their own departments — the country’s largest repositories of personal information.

The federal government’s draft Data Governance Policy 2026, released for consultation in June, is the first serious attempt to close that gap.

Prepared by the Pakistan Digital Authority (PDA), set up in 2024 to oversee Pakistan’s digital public infrastructure initiative, the policy seeks to regulate how federal government bodies collect, process, retain and share data. More importantly, the draft moves beyond simply digitising government services to balancing efficiency with privacy and transparency.

While important questions remain about surveillance, artificial intelligence and implementation, the policy introduces several principles that could significantly improve both public service delivery and data protection.

Pakistan’s new draft Data Governance Policy tackles decades of bureaucratic data hoarding and insider leaks — but broader AI oversight and surveillance concerns remain

Pakistan’s new draft Data Governance Policy tackles decades of bureaucratic data hoarding and insider leaks — but broader AI oversight and surveillance concerns remain

A STEP TOWARDS ACCOUNTABILITY

Perhaps its most important declaration appears at the start of the proposal: government data is not the property of the agency that holds it. Public institutions are custodians, not owners, of citizens’ information. This reflects a fundamental principle underpinning modern privacy frameworks around the world — that personal data ultimately belongs to the individual, not the organisation collecting it.

That principle has practical implications.

Anyone who has dealt with Pakistan’s bureaucracy knows the frustration of repeatedly submitting the same documents to different government offices.

Whether applying for a pension, transferring property, updating identity records or accessing welfare programmes, citizens are routinely asked to provide information the state already possesses. Women often face an additional burden, with some departments unnecessarily demanding copies of a husband’s or another male relative’s documents.

‘THE ONCE-ONLY PRINCIPLE’

The draft addresses this through the “once-only principle”, under which citizens should not be asked to provide the same information to the state more than once, unless required by law........

© Dawn (Magazines)