The government's deadline for finalizing the draft of Personal Data Protection Bill 2023 is just over a week away. The draft reveals several stringent measures aimed at safeguarding personal data across Pakistan.

The draft of the Personal Data Protection Bill 2023 proposes comprehensive regulations to ensure the security of personal data across country. It also outlines heavy fines for individuals and companies disclosing personal information.

Key provisions

- The bill prohibits the transfer of personal data abroad if it jeopardizes national security or public interest. Personal data will not be transferred to any unauthorized person or system outside the ambit of the law, and sensitive information will be stored on domestic servers and digital infrastructure.

- The legislation stipulates that personal data should not be retained longer than necessary for any purpose.

- A new regulatory body, the National Commission for Personal Data Protection, will oversee data protection, transparency, and accountability. The commission will monitor cross-border data transfers and ensure compliance with the law. It has also imposed strict conditions for cross-border transfers of personal data, including authorization from the commission.

Also Read: Pakistan's Data Protection Bill pending since 2018

- The commission is mandated to address complaints within 30 days of receipt. It will also be responsible for creating a mechanism to share sensitive personal data with the government when necessary.

Fines and penalties

- Disclosing or disseminating personal data without authorization could result in a fine of up to $125,000. Government institutions and companies will be obliged to ensure the protection of personal data.
- Failure to implement necessary security measures may incur a fine of $500,000.
- Severe violations by data controllers and processors could lead to fines of up to $2 million.

The commission will also have the authority to suspend or terminate the registration of data controllers and processors found in violation of the Act. Decisions made by the commission can be appealed to the high court or a special tribunal.

This legislation represents a significant step towards strengthening data protection in Pakistan and aligns with global standards for safeguarding personal information.