Legal Help · Published August 5, 2026
Privacy Policy Requirements for Pakistani Websites
The comprehensive law is still pending in Parliament — here's what actually governs user data today, and why you shouldn't wait for the new law to act.
Quick answer
Pakistan has no comprehensive data protection law yet — the Personal Data Protection Bill 2023 has Cabinet approval but is still awaiting Parliament. Right now, PECA Section 38 is what actually bites: transferring someone's personal data without consent is a criminal offence, up to 3 years' imprisonment or a PKR 1 million fine. A clear privacy policy — what you collect, why, and how it's handled — is still smart practice and often required by the platforms you use.
The framework, layer by layer
Pakistan doesn't have a comprehensive data protection law yet
As of this writing, the Personal Data Protection Bill 2023 has Cabinet approval but hasn't been enacted by Parliament — meaning there's no single, dedicated statute setting out mandatory privacy policy requirements the way GDPR does in the EU.
PECA Section 38 is the real enforcement teeth right now
It's a criminal offence for a service provider with access to someone's personal or sensitive data to transfer it without consent — up to 3 years' imprisonment or a fine up to PKR 1 million. A website's privacy policy operates in the shadow of this provision, whether it says so explicitly or not.
A privacy policy is still a smart, and increasingly expected, practice
Even without a mandatory checklist, a clear privacy policy — what data you collect, why, how it's stored, and who it's shared with — builds user trust, and is often required by payment processors, app stores, and advertising platforms Pakistani businesses actually use.
Watch the Personal Data Protection Bill
Once enacted, the PDPB is expected to introduce more specific, GDPR-influenced requirements for data collection, consent, and cross-border transfer — businesses operating now should expect to need updates once it passes, not treat today's practices as permanent.
Why "there's no law yet" isn't the same as "there's no risk"
International legal reviews of Pakistan's data landscape, including the International Bar Association's overview, consistently flag that PECA's criminal provisions already create meaningful exposure for businesses handling user data carelessly, even without a dedicated privacy statute. A business that treats the absence of a comprehensive law as meaning "no rules apply" is misreading the situation — Section 38 alone is a real criminal risk for mishandled or unauthorized data transfers, separate from any future civil compliance regime.
The practical move for any Pakistani business collecting user data now is to build reasonable privacy practices today — clear disclosure, consent for data sharing, and secure storage — rather than waiting for the Personal Data Protection Bill to pass before taking data handling seriously. Retrofitting good practices after a breach or complaint is far more costly than building them in from the start.
What Wakeel.org can help with
Explaining the current legal landscape and what a privacy policy should generally cover, in plain English or Urdu.
What it cannot do
It cannot draft the final policy or confirm compliance for your specific business — a licensed advocate should handle that.
Frequently asked questions
Is a privacy policy legally required for websites in Pakistan?
There's no single comprehensive data protection law that mandates a specific privacy policy format yet. That said, PECA Section 38 criminalises unauthorized transfer of personal data by a service provider, and having a clear privacy policy is both good practice and often required by third-party platforms (payment processors, app stores).
What is the Personal Data Protection Bill and has it become law?
The Personal Data Protection Bill 2023 is Pakistan's proposed comprehensive data protection statute — it has Cabinet approval but, as of this writing, hasn't been enacted by Parliament. Once passed, it's expected to introduce more specific privacy requirements.
What does PECA say about handling user data?
Section 38 of PECA 2016 makes it a criminal offence for a service provider with access to someone's personal or sensitive data to transfer that data without their consent, punishable by up to 3 years' imprisonment or a fine up to PKR 1 million.
What should a privacy policy for a Pakistani website include?
At minimum: what personal data you collect, why you collect it, how it's stored and secured, who it might be shared with, and how users can contact you about their data — even without a specific legal mandate, this is what builds trust and satisfies most third-party platform requirements.
Can Wakeel.org draft a privacy policy for my website?
Wakeel.org can explain the current legal landscape and what a privacy policy generally should cover. It cannot draft the final policy or confirm compliance for your specific business — a licensed advocate should handle that, especially once the Personal Data Protection Bill is enacted.
General educational information, not legal advice. See our full disclaimer.
Sources — check these directly to verify
Related reading
Building a privacy policy for your site or app?
Ask Wakeel what to cover today — then get a licensed advocate to finalize it.