Read the new Data Governance Policy, 2026, by the Ministry of IT & Telecom, and it is genuinely hard to find fault with the ideas inside it. The Federal Government calls itself a custodian of citizens' data rather than an owner. It talks about privacy by design instead of privacy as an afterthought bolted on once something goes wrong. It promises people the right to know who, inside the government, has looked at their data, and the right to correct it, move it or have it deleted. Consent has to be specific, not the usual scroll and click box that nobody reads. On paper, this is the vocabulary of the European Union's data protection regime, not the vocabulary Pakistani policy documents usually reach for.

The trouble begins the moment one asks what happens when a citizen actually tries to use these rights. In Europe, a person whose data has been mishandled can go to an independent data protection authority. That authority does not report to the ministry........

© The Express Tribune