P@SHA Flags Gaps in Pakistan’s Draft Data Governance Policy, Warns of Risks for IT Exporters

The Pakistan Software Houses Association (P@SHA) has raised a series of concerns over the country’s proposed National Data Governance Policy, warning that unresolved issues around data classification, localization, and enforcement could create challenges for Pakistan’s technology sector and IT exporters.

P@SHA outlined its concerns in a policy paper titled “Analysis of Pakistan’s Data Governance Policy,” which examines the draft framework released by the Ministry of Information Technology and Telecommunication in July 2026.

The association acknowledged the policy as an important step for Pakistan’s artificial intelligence readiness and broader digital ecosystem, but said several areas require greater clarity before the framework is finalized.

According to P@SHA, one of the key gaps in the draft is the absence of a clear distinction between public-sector and private-sector data. The association warned that this ambiguity could create compliance uncertainty for technology companies handling data across different jurisdictions and business models.

Data Localization and Export Concerns

P@SHA also highlighted potential difficulties for IT exporters arising from proposed data localization requirements and restrictions on accessing or processing data outside Pakistan.

The association said such provisions could affect companies that serve overseas clients, rely on international cloud infrastructure or operate across multiple markets.

Pakistan’s IT sector has increasingly depended on cross-border digital services, cloud platforms and international data flows, making regulatory clarity particularly important for exporters.

Under the proposed policy, government data would be treated as a strategic national asset, while public institutions would act as custodians and protectors of citizens’ data rather than owners of that information.

The framework also proposes reducing repeated collection of the same information by different government bodies. Instead, institutions would rely on core data registries, while a central platform would facilitate data sharing between public-sector entities.

The draft further proposes making the Pakistan Digital Authority the central data regulator, with powers related to oversight, implementation and enforcement.

P@SHA Questions Licensing and Enforcement Model

P@SHA has also questioned provisions related to the licensing and pricing of non-personal government data.

The association said monetizing such data could potentially conflict with the government’s role as a data custodian, particularly where information is collected from citizens or generated through public institutions.

It also raised concerns about the absence of sufficiently strong financial penalties for non-compliance, warning that a system based largely on audits and monitoring may not be enough to ensure effective enforcement.

P@SHA said the final framework would need a clearer compliance mechanism, stronger accountability provisions, and more precise rules governing the responsibilities of both public and private entities.

The proposed National Data Governance Policy is expected to play a central role in shaping how Pakistan collects, stores, protects, and shares data across government institutions.

Its final structure could also have wider implications for artificial intelligence, cloud computing, cybersecurity, digital services, and IT exports, particularly as Pakistan seeks to expand its role in the global digital economy.

Also read:

P@SHA Leadership Crisis Erupts as Chairman Rejects No-Confidence Vote, Calls Removal Illegal