Pakistan’s IT industry has raised concerns over the draft National Data Governance Policy 2026, warning that unclear compliance requirements and proposed data localization rules could create challenges for IT exporters, freelancers and technology companies serving international clients. The Pakistan IT Industry Association highlighted its concerns in a member briefing published on August 12 regarding the draft policy released by the Ministry of IT and Telecommunication in July, which remains listed as a draft policy subject to further development.
PASHA’s major concern centers on the draft framework’s proposed data localization requirements, under which sensitive personal and government data would generally need to be hosted and processed within Pakistan, while transferring such information abroad would require prior regulatory approval. The association warned these provisions could affect software exporters, freelancers and distributed technology teams if remote international access to data ends up being treated as a cross border transfer, an issue particularly relevant for companies serving overseas customers who rely on international cloud infrastructure.
Beyond data localization, PASHA identified the lack of a clear distinction between public sector and private sector data as one of the most significant gaps in the draft policy, calling for greater clarity especially around public private partnerships where companies may handle government related information. The association also raised concerns about proposed mechanisms for licensing or pricing non personal public data, arguing that such monetization could create tension with the government’s stated role as custodian rather than owner of public data.
PASHA further questioned the draft policy’s absence of strong financial penalties for non compliance, arguing that audits without meaningful monetary sanctions could weaken enforcement compared with data governance regimes in other jurisdictions. While the association acknowledged that the National Data Governance Policy could become an important foundation for Pakistan’s digital ecosystem and AI readiness, it has called for clearer definitions, compliance obligations, data localization requirements and rules governing cross border data access before the framework is implemented, given Pakistan’s heavy reliance on cross border digital services within its IT export sector.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
