The Ministry of Information Technology and Telecommunication has released the draft Data Governance Policy 2026 for public consultation, proposing a comprehensive framework for managing, protecting, and sharing government data. The ministry has invited public feedback until July 10 before finalising the policy, which aims to strengthen data governance as Pakistan’s digital transformation accelerates.
According to the draft, government data will be recognised as a strategic national asset held in trust for citizens, while public institutions will act only as custodians rather than owners of that information. The proposed policy also grants citizens the right to know who within the government accessed their personal data, when it was accessed, and for what purpose, unless legal restrictions apply with documented reasons.
The policy further allows citizens to obtain their personal data in a structured, commonly used, and machine-readable format. Where legally and technically possible, individuals may also request direct transfers of their personal data between public bodies. Additionally, government institutions handling personal information will be required to adopt privacy-enhancing technologies and stronger data protection measures.
Under the proposal, the Pakistan Digital Authority will oversee implementation of the policy under the Digital Nation Pakistan Act 2025. The framework will apply to federal ministries, departments, regulators, autonomous bodies, public-sector companies, and private organisations managing government data on behalf of the federal government. Provincial governments have also been encouraged to adopt similar data governance standards.
The draft policy requires all public-sector data processing to remain lawful, transparent, and consistent with privacy protections guaranteed under Article 14 of Pakistan’s Constitution. It also introduces stricter safeguards for sensitive personal information, stronger protections for children’s data, mandatory reporting of data breaches, and tightly controlled cross-border data transfers. Once Pakistan enacts a comprehensive personal data protection law, the government plans to update the policy to align with the new legal framework.