Pakistan. Cybersecurity. Act

PECAPrevention of Electronic Crimes Act, 2016

In force

Partly verified

Medium confidence. Personal Data Protection Bill (2023 draft, 72h breach notice, National Commission for Personal Data Protection) remains a draft not passed by either House as of Mar 2026, so excluded. Assent date from general knowledge.

§1Summary

Synopsis

Pakistan's cybercrime statute, criminalising unauthorised access, copying or transmission of data and the misuse of another person's identity information. In the absence of a data protection law it is the main legal tool against personal data misuse; the 2025 amendment added social media regulation and a false-information offence.

Key themes

cybercrime
unauthorised access
identity information
social media regulation
data retention by service providers

Unique features

Section 16 makes unauthorised obtaining, selling or use of identity information an offence and lets data subjects seek blocking/destruction via the PTA.

SaaS relevance

Relevant as criminal backdrop and for service-provider traffic-data retention and law enforcement access; social media platforms may need SMPRA registration.

§2Obligations

Extraterritorial: Yes
Breach notification: None
DPO: No
Cross-border transfers: None general
Maximum penalty: s16: up to 3 years' imprisonment and/or PKR 5 million fine

§3Dates

Key dates

Adopted 22 August 2016
In force 2016
Amended by Prevention of Electronic Crimes (Amendment) Act 2025 creating the Social Media Protection and Regulatory Authority (SMPRA), National Cyber Crime Investigation Agency (NCCIA) and Social Media Protection Tribunal.

§4Text and authority

Text

Authoritative text na.gov.pk

Authority

National Cyber Crime Investigation Agency (NCCIA); Pakistan Telecommunication Authority (PTA); SMPRA

§5Where it applies

Domestic law of: Pakistan

§6Sources and verification

Sources consulted

Verification

Medium confidence.

Partly verified