Internationally, compliance is controlled by applicable information security regulations such as the United States (US) Health Insurance Portability and Accountability Act (HIPAA) and the European Union (EU) General Data Protection Regulation (GDPR). Countries have set regulatory and standard requirements to be met for the exchange of information internally or externally.
There has also been much debate in Pakistan and Azad Jammu and Kashmir (AJK) about data security and transfer issues. It is hard to predict the full impact of the EU referendum on Pakistan and AJK, but in short, the change will be minimal. Further, Pakistan and AJK need to focus on e-commerce, data protection, data transfer, and data breach regulations to keep up with United Kingdom (UK) cybersecurity measures. Longer term, there is still likely lots to do—particularly with the UK putting in place agreements to replace current EU deals, and many variations are currently possible.
Data protection in Pakistan and AJK
Previously, a cybercrime bill was passed by the National Assembly Standing Committee on IT, which is a reactive rather than proactive approach in absence of the UK Electronic Data Protection Act. The proposed Electronic Data Protection Act—drafted and proposed in 2005—so far has not been published.
On May 19, 2023, the Ministry of Information Technology and Telecommunication released a new Personal Data Protection Bill (PDPB).[1] The proposed law intends to regulate the collection, processing, use, disclosure, and transfer of personal data, and also provides for offenses concerning the violation of data privacy rights of individuals. Similar to HIPAA and GDPR, the proposed bill recommends standards for data processing (e.g., compliance, legal obligation, consent, and research).
There is currently no approved and implemented law regulating the protection of data in Pakistan and AJK. In the absence of a Pakistani and AJK data protection law, introducing a cybercrime law could be overwhelming for civil rights and businesses in the country. Therefore, I suggest the Pakistani and AJK governments publish a data protection law as a proactive measure to limit unauthorized disclosure of their citizens. It is essential for our nation and government agencies to analyze and review international laws to find best practices. This proposed act would likely require covered entities to implement physical, technical, and administrative safeguards. A few improvements are suggested below to keep up with developed countries’ data security standards.
