With only a week left until the finalization deadline for the draft of the Personal Data Protection Bill 2023, the government is gearing up to implement several measures to safeguard personal data. The proposed law includes hefty fines for individuals and companies that disclose personal information.
According to the proposed law, the Personal Data Protection Act will apply across Pakistan. It will prohibit the transfer of data abroad if it conflicts with national security or public interest, and personal data will not be transferred to any unauthorized person or system outside the legal framework.
Sensitive personal data will be processed only within servers and digital infrastructure located in Pakistan. Personal data cannot be retained longer than necessary for any purpose. A National Commission for Personal Data Protection of Pakistan will be established to ensure transparency and accountability in data protection.
The draft law states that the commission will also monitor cross-border data transfers. Strict conditions, including the commission’s approval, will be imposed for transferring personal data across borders. The commission will establish a mechanism for sharing sensitive personal data with the government and will resolve complaints within 30 days of receipt.
Under the act, fines ranging from $125,000 to $2,000,000 may be imposed. A fine of $125,000 will be levied for the disclosure or dissemination of personal data. Government agencies and companies will be obligated to ensure the protection of personal data.
Failure to take necessary security measures will result in a fine of $500,000. Data controllers and processors violating the act will face fines of up to $2,000,000. The commission will also have the authority to suspend or revoke the registration of data controllers and processors. Appeals against the commission’s decisions can be made to the High Court or a special tribunal.
