Section 16(1) of PECA 2016 (“Section 16(1)”), reproduced below for ease of reference, puts restriction on the collection and procession of personal data without the consent of the person whose personal data is being collected and processed:

“Whoever obtains, sells, possesses, transmits or uses another person’s identity information without authorization shall be punished with imprisonment for a term which may extend to three years or with fine which may extend to five million rupees, or with both.”

Under PECA Amendment 2025, Section 26A (Punishment for false and fake information), any person who intentionally shares or spreads information through an information system which they know, or reasonably believe, to be false, and which is likely to cause fear, panic, disorder, or unrest among the public, may be punished with imprisonment for up to three (3) years, a fine of up to PKR 2,000,000, or both.

The PDPB, in addition, provides for the imposition of an obligation upon the data controller to notify the data subject, in writing, regarding the following:

• the collection of personal data pertaining to the data subject, along with its description;
• the legal basis of such data collection and data processing; the retention period;
• the purpose for such data collection and data processing;
• information relating to the source of such personal data;
• information regarding cross border transfer of data;
• informing the data subject of their rights under the PDPB, including the right to request access to the personal data collected and processed, right to request correction of personal data collected and processed, and provide contact information of the data controller;
• the choices and means of restricting the processing of personal data;
• the third parties to whom the personal data may be disclosed;
• the mandatory or voluntary nature of data collection and data processing; and
• the consequences of failing to supply mandatory personal data.

As per the PDPB, where the processing pertains to critical personal data, the PDPB shall (if implemented in its current form) require the same to be processed in a server or digital infrastructure within Pakistan.

It must be noted, however, that the PDPB is yet to be promulgated into law and therefore the content of the promulgated legislation may differ from the draft.