Delivering in Pakistan: No Data Protection Law Yet, a Criminal Statute Doing the Work, and Export Mechanics That Decide How You Get Paid

Pakistan is the market on this list where the compliance question is smallest and the commercial question is largest, which is the reverse of everywhere else here.

There is no data protection law#

As of 2026, Pakistan has no enacted data protection statute. A revised Personal Data Protection Bill has not been published in final form or submitted to Parliament as of May 2026.

The reported direction of the revision includes an enhanced definition of sensitive data, adding caste and ethnicity; mandatory age verification and parental consent for children's data; and stronger provisions on consent withdrawal.

What is doing the work instead is the Prevention of Electronic Crimes Act (PECA) 2016, amended in January 2025. PECA is a criminal statute, not a privacy framework, which is a genuinely different thing: it addresses data misuse as an offence rather than establishing rights, lawful bases and processor obligations. The 2025 amendments established the National Cyber Crime Investigation Agency, which replaced the FIA's cybercrime wing.

The practical effect is that a Pakistan-only system has fewer compliance obligations than the same system anywhere else on this list. That is a real advantage today and a poor thing to build around.

The localisation question is unresolved and worth watching#

Government has continued to push data localisation requirements through the draft Bill, and industry bodies have objected on the grounds that locally established cloud services cannot match the security and efficiency of the global providers.

Neither position is settled, and there is no in-country region from any major hyperscaler. For a system with a multi-year life, the sensible posture is the same one we recommend for Saudi Arabia for different reasons: design so that moving data in-country later is a configuration change rather than a migration. That option costs very little to preserve now and a great deal to create later.

The part that actually decides your project#

For most organisations engaging with Pakistan, the binding constraints are commercial rather than regulatory.

Exporters of digital services must register with the State Bank of Pakistan for foreign exchange and remittance compliance. This is not optional and it governs how money actually reaches you. The SBP has introduced reforms to simplify export realisation, standardise documentation, set transaction processing timelines and strengthen complaint resolution, which has made this materially less painful than it was.

PSEB registration carries a tax position. Export-oriented IT and IT-enabled services companies registered with the Pakistan Software Export Board have enjoyed income tax exemption on export revenue, stated as running until June 2026. That date has now passed. Whether it was extended, replaced or allowed to lapse is exactly the kind of thing that changes a business case, so confirm the current position with PSEB or your tax adviser before relying on it. We are not going to assert a status we have not verified as at today.

Why we are credible here specifically#

We build and operate ZeMe, a production AI system working with Pakistan Stock Exchange data, and we publish an annual Pakistan AI Adoption Report from the fiscal figures rather than from anecdote.

That is a different kind of claim from the other markets on this list. In the UK and the USA we describe how we would work. Here we are pointing at something running.

The report's finding worth repeating: the sector runs a $3.9 billion trade surplus, and 25% of IT exports now come from individual freelancers rather than firms. That second number changes how you should think about capacity here, because a large part of it is not organised into companies you can contract with.

What we would do differently here#

Solve the payment mechanics first. SBP registration and the remittance path decide whether the engagement works at all, and they are usually discovered late.

Do not build around the absence of a privacy law. It is a temporary state. Building to a reasonable baseline now costs little; retrofitting rights, consent and deletion into a live system after a law arrives is expensive.

Preserve the residency option. No in-country hyperscaler region exists and localisation is under active debate. Portability is cheap to keep and costly to add.

Where we are honest about our limits#

Pakistan's technology sector is discussed largely through anecdote or national pride, and neither is useful for planning. Where we have figures we cite them; where the position is genuinely unresolved, as with localisation and the PSEB tax exemption, we say it is unresolved rather than picking the convenient reading.

Start here#

AI Readiness Assessment for the use case, or AI Automation if you are automating a high-volume process and want it kept running.

Sources#

• Data Protection and Privacy 2026, Pakistan, Chambers
• Data protection laws and regulations 2026, Pakistan, ICLG
• Data privacy and protection in Pakistan, International Bar Association
• State Bank of Pakistan, export receipts and exporter facilitation

What else is coming for Pakistan