Pakistan has not joined any agreement with binding commitments to open transfers of data across borders.

Pakistan does not have a comprehensive regime in place for all personal data, but it has sectoral regulations. The Prevention of Electronic Crimes Act 2016 contains some provisions on data protection. It prevents unauthorised acts with respect to information systems and provides for related offences as well as mechanisms for their investigation, prosecution and trial. Under the Act, unauthorised access, copying, or interference with information systems or data is a punishable offence and shall be punished with imprisonment or a fine. In addition, there is some sectoral regulation on data in the banking and telecom sectors.

Section 31 of the Prevention of Electronic Crimes Act includes data retention provisions that make it mandatory for service providers to hold traffic data for a one-year minimum or as “authorised officers” see fit. Art. 32 states that a service provider shall, within its existing or required technical capability, retain the specified traffic data for a minimum period of one year or such period as the Authority may notify from time to time and, subject to the production of a warrant issued by the Court, provide that data to the investigation agency or the authorised officer whenever so required.

Section 31 of the Prevention of Electronic Crimes Act discusses “expedited preservation and acquisition of data”. It allows an authorised agent to require a person to hand over data without producing a court warrant if it is believed that it is “reasonably required” for a criminal investigation. This can be termed as a blanket authorisation provision that gives the executive direct authority to take action without any judicial oversight or scrutiny. In addition to this, no test as to what amounts to a reasonable requirement is provided in the section. This is problematic because the lack of requisite checks and balances affords the executive a discretionary power that can be used to violate fundamental rights.
Section 35 provides law enforcement officers various powers relating to information systems. One of these is a power to require any person who is in possession of “decryption information of an information system, device or data under investigation” to grant the officer access to such data, device or information system “in unencrypted or decrypted intelligible format” for the purposes of investigating the offence.
Section 39 allows for "Real-time collection and recording" of data: "[i]f a Court is satisfied on the basis of information furnished by an authorised officer that there are reasonable grounds to believe that the content of any information is reasonably required for the purposes of a specific criminal investigation, the Court may order, with respect to information held by or passing through a service provider, to a designated agency as notified under the Investigation for Fair Trial Act 2013 or any other law for the time being in force having capability to collect real-time information, to collect or record such information in real-time coordination with the investigation agency for provision in the prescribed manner."

The Prevention of Electronic Crimes Act (PECA) establishes a safe harbour regime for intermediaries for copyright infringements. According to Art. 38 of the PECA, there is a civil or criminal liability limitation for service providers for content posted by users unless it is proven that the service provider had “specific actual knowledge and willful intent to proactively and positively participate” in cybercrimes committed the Act. However, it is reported that the Removal and Blocking of Unlawful Online Content (Procedure, Oversight, and Safeguards) Rules 2020 passed in November 2020 create new obligations and liabilities for social media companies, which can be in contradiction of limitation of intermediary liability provisions for technology companies in PECA.

The Prevention of Electronic Crimes Act (PECA) establishes a safe harbour regime for intermediaries beyond copyright infringements. According to Art. 38 of the PECA, there is a civil or criminal liability limitation for service providers for content posted by users unless it is proven that the service provider had “specific actual knowledge and willful intent to proactively and positively participate” in cybercrimes committed to the Act. However, it is reported that the Removal and Blocking of Unlawful Online Content (Procedure, Oversight, and Safeguards) Rules 2020 passed in November 2020 create new obligations and liabilities for social media companies, which can be in contradiction of limitation of intermediary liability provisions for technology companies in PECA.

Pakistan mandates functional and accounting separation for operators with significant market power (SMP) in the telecom market.

There are no ownership restrictions on sectors relevant for digital trade. However, it is reported that Pakistan prohibits foreign ownership in all sectors for citizens/companies from India and Israel.

It is reported that Pakistan implements investment screening mechanisms for inbound foreign investments, blocking those deemed to pose a risk to national security based on the screening process. While the Board of Investment serves as the official lead agency for investment screening, it lacks the internal capacity to conduct such screenings and relies heavily on intelligence agencies to carry out the necessary due diligence.

Pakistan is not a party to the Patent Cooperation Treaty (PCT).

The Copyright Ordinance of 1962 establishes a clear framework of copyright exceptions based on the fair dealing model, allowing the lawful use of copyrighted works by others without prior permission. Section 57, introduced through the 2000 amendment, outlines these exceptions, which include uses such as research or private study, criticism or review, and the public reading or recitation of reasonable excerpts from published literary or dramatic works, among others.

Copyright is not adequately enforced online in Pakistan. It is reported that piracy remains widespread, including with respect to digital content and software. Furthermore, numerous cable operators provide pirated content and litigants with experience in these tribunals raise concerns over the lack of capacity, inconsistency of rulings, nominal fines, and a general lack of expertise among tribunal judges.

Pakistan has not signed the World Intellectual Property Organization (WIPO) Copyright Treaty.

Pakistan has not signed the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Pakistan lacks a comprehensive regime for the protection of trade secrets.