Legal Help · Published September 15, 2026
Cybercrime Punishments in Pakistan
A section-by-section reference to what PECA 2016 actually punishes — and how much prison time or fine each offence carries.
Quick answer
Under PECA 2016, punishments range from a fine of PKR 50,000 for basic unauthorized access (Section 3) up to 20 years' imprisonment for the most serious child-exploitation offences (Section 22). Everyday cases like online defamation (Section 20) top out at 3 years and PKR 1 million; electronic fraud (Section 14) at 2 years and PKR 10 million. All figures below are statutory maximums — a judge has discretion within that ceiling.
The pattern behind the penalties
Punishment scales with what was targeted, not just what was done
The same underlying act — unauthorized access — carries a very different sentence depending on whether it targeted an ordinary system (Section 3, up to 3 months) or critical infrastructure (Sections 6–8, up to 7 years). Courts and investigators look first at what system was involved.
Offences against people carry the heaviest everyday penalties
Sections 20, 21, and 22 — covering dignity, modesty, and child sexual abuse material — carry some of PECA's most serious penalties, up to 20 years for the most severe child-exploitation offences, reflecting how central these provisions are to actual prosecutions.
The 2025 amendment added a new offence with real teeth
Section 26A, added by the PECA Amendment Act 2025, criminalises spreading false information likely to cause fear, panic, or unrest online — up to 3 years imprisonment and a fine of up to PKR 2 million — and is investigated exclusively by the NCCIA.
Fines and prison terms are maximums, not fixed sentences
Every figure in PECA is an upper limit — "up to" — not a mandatory sentence. Actual sentencing depends on the facts, any aggravating factors, and the judge's discretion within that ceiling.
PECA 2016 penalties, section by section
A reference table, not an exhaustive list — always confirm the current wording with a lawyer or the official statute, since penalties can be revised by amendment.
| Section | Offence | Punishment (maximum) |
|---|---|---|
| Section 3 | Unauthorized access to a computer/information system | Up to 3 months imprisonment, fine up to PKR 50,000, or both |
| Section 4 | Unauthorized copying or transmission of data | Up to 6 months imprisonment, fine up to PKR 100,000, or both |
| Section 5 | Interference with an information system or data | Up to 2 years imprisonment, fine up to PKR 500,000, or both |
| Sections 6–8 | Unauthorized access to, or interference with, critical infrastructure | Up to 7 years imprisonment, fine up to PKR 10 million, or both |
| Section 10 | Cyber terrorism (critical-infrastructure offences committed to threaten security or coerce the government) | Up to 14 years imprisonment, fine up to PKR 50 million, or both |
| Section 13 | Electronic forgery | Up to 3 years imprisonment and/or fine up to PKR 250,000 (up to 7 years / PKR 5 million if it involves critical infrastructure) |
| Section 14 | Electronic fraud | Up to 2 years imprisonment, fine up to PKR 10 million, or both |
| Section 16 | Unauthorized use of identity information | Up to 3 years imprisonment, fine up to PKR 5 million, or both |
| Section 20 | Offences against the dignity of a natural person (includes online defamation) | Up to 3 years imprisonment, fine up to PKR 1 million, or both |
| Section 21 | Offences against modesty (non-consensual intimate images; higher where a minor is involved) | Up to 5 years imprisonment and fine up to PKR 5 million (up to 7 years where a minor is involved) |
| Section 22 | Child sexual abuse material | 14 to 20 years imprisonment, fine not less than PKR 1 million |
| Section 24 | Cyberstalking | Imprisonment and fine as prescribed, with enhanced punishment where the victim is a minor |
| Section 26A | Spreading false information likely to cause fear, panic, or unrest (added by the 2025 amendment) | Up to 3 years imprisonment, fine up to PKR 2 million, or both |
Why the section number matters more than the headline
The same real-world incident can be charged under several different PECA sections depending on how it's framed by the complainant and investigated by the National Cyber Crime Investigation Agency (NCCIA) — a hacked account used to send fraudulent messages could touch Section 3 (unauthorized access), Section 14 (electronic fraud), and Section 16 (identity misuse) simultaneously, each with its own penalty ceiling. This is one reason two cases that sound similar in the news can end in very different sentences: the charge sheet, not just the underlying conduct, drives the maximum exposure.
What Wakeel.org can help with
Explaining what a specific PECA section covers and its general penalty range, in plain English or Urdu.
What it cannot do
It cannot predict which sections a court will apply to your specific facts or what sentence you're likely to receive — a licensed advocate should handle that.
Frequently asked questions
What is the maximum punishment under PECA 2016?
The most severe penalties are for child sexual abuse material and related child-exploitation offences (Sections 22, 22A–22C), carrying 14 to 20 years' imprisonment. Among the broader cybercrime offences, cyber terrorism (Section 10) carries up to 14 years and a fine of up to PKR 50 million.
What is the punishment for hacking someone's account in Pakistan?
Basic unauthorized access under Section 3 carries up to 3 months' imprisonment and a fine of up to PKR 50,000. If data was copied or transmitted (Section 4), it rises to up to 6 months, and if the system or data was interfered with or damaged (Section 5), up to 2 years.
What is the punishment for online defamation in Pakistan?
Section 20 of PECA — offences against the dignity of a natural person, which covers most online defamation cases — carries up to 3 years' imprisonment, a fine of up to PKR 1 million, or both.
Are PECA punishments the maximum sentence a judge must give?
No. Every PECA penalty is expressed as an upper limit ("up to"), not a mandatory minimum. A judge has discretion to impose a lower sentence, a fine only, or the maximum, depending on the facts and any aggravating circumstances.
Can Wakeel.org tell me the exact punishment I'm facing?
Wakeel.org can explain what a specific PECA section generally provides for and how the penalty ranges work. It cannot predict the sentence a specific court will impose in a specific case — sentencing depends on facts only a licensed advocate reviewing your case can assess.
General educational information, not legal advice. See our full disclaimer.
Related reading
Not sure which PECA section applies to you?
Ask Wakeel to explain the relevant section — then verify with a licensed advocate before you act.