P@SHA says unclear data classifications, localization rules and enforcement mechanisms could create compliance challenges for technology companies and IT exporters.
The Pakistan Software Houses Association (P@SHA) has raised concerns over Pakistan’s proposed National Data Governance Policy, warning that gaps in data classification, localization and enforcement could create compliance challenges for technology companies and IT exporters.
P@SHA outlined its concerns in a policy paper titled “Analysis of Pakistan’s Data Governance Policy,” which reviews the draft framework released by the Ministry of Information Technology and Telecommunication in July 2026.
The association described the policy as an important step toward strengthening Pakistan’s artificial intelligence readiness and broader digital ecosystem but said several provisions require greater clarity before the framework is finalized.
One of the key concerns is the lack of a clear distinction between public-sector and private-sector data. P@SHA said the ambiguity could create uncertainty for technology companies that handle data across different jurisdictions and operate under different business models.
The association also highlighted potential difficulties linked to proposed data localization requirements and restrictions on accessing or processing information outside Pakistan.
According to P@SHA, such provisions could affect IT exporters serving overseas clients, using international cloud infrastructure or operating across multiple markets. As Pakistan’s technology industry increasingly relies on cross-border digital services, cloud platforms and international data flows, the association said regulatory clarity is particularly important.
Under the proposed framework, government data would be classified as a strategic national asset. Public institutions would serve as custodians and protectors of citizens’ data rather than owners.
The policy also proposes reducing repeated data collection by government institutions through the use of core data registries. A central platform would facilitate data sharing between public-sector entities.
The draft further proposes making the Pakistan Digital Authority the central data regulator, with responsibilities covering oversight, implementation and enforcement.
P@SHA also questioned provisions concerning the licensing and pricing of non-personal government data. The association said monetizing such information could potentially conflict with the government’s role as a data custodian, particularly when data is collected from citizens or generated through public institutions.
It also raised concerns about the financial penalties proposed for non-compliance, arguing that a system relying primarily on audits and monitoring may not provide sufficient enforcement.
P@SHA said the final framework should include clearer compliance mechanisms, stronger accountability provisions and more precise responsibilities for public- and private-sector entities.
About The Author
