Pakistan unveils National Data Governance Policy 2026 to transform digital governance

In a move to reshape Pakistan’s digital governance landscape, the Ministry of Information Technology and Telecommunication has unveiled the National Data Governance Policy 2026, declaring government data a “strategic national asset” and introducing sweeping rules on data sovereignty, privacy, artificial intelligence, cross-border data transfers and citizens’ digital rights.

The policy, prepared under the framework of the Digital Nation Pakistan initiative, establishes for the first time a comprehensive governance regime for public-sector data, requiring all federal ministries, departments, regulators, public-sector companies and their contractors to comply with uniform standards governing the collection, storage, sharing and disposal of government data.

The policy places Pakistan among a growing number of countries adopting strict digital sovereignty measures, asserting that government data must remain under the country’s “lawful authority and effective control.”

Sensitive government and personal data will generally be required to remain physically hosted and processed within Pakistan, while any offshore processing will need prior approval and additional safeguards.

One of the most significant provisions bars public bodies from creating multiple copies of citizens’ personal data. Instead, agencies will be required to rely on designated “Primary Data Registers” as the single authoritative source of information, with data exchanged through a governed National Data Exchange platform known as WASL.

The policy also embraces the “once-only principle,” under which citizens should not be asked repeatedly to provide the same information to different government agencies, paving the way for seamless digital public services.

In a major shift toward citizen-centric governance, the framework recognizes extensive digital rights, including the right to know which government officials have accessed personal data, the right to correct inaccurate records, data portability, erasure where legally permissible, and meaningful human review of automated government decisions.

The policy also requires granular consent wherever consent is the legal basis for data processing.

Privacy protections have been significantly strengthened, with mandatory Privacy Impact Assessments for high-risk processing, stricter safeguards for sensitive personal data and children’s information, and mandatory breach notification requirements for public institutions.

READ MORE: Can budget FY27 help accelerate Pakistan’s digital growth?

Artificial intelligence features prominently in the policy. Government agencies deploying AI systems that make legally significant decisions will be required to ensure explainability, continuous monitoring, meaningful human oversight and public transparency.

Public bodies will also have to publish details of automated decision-making systems in a public registry maintained by the

(PDA). The policy further introduces controls over the government’s use of generative AI, including safeguards against factual inaccuracies, intellectual property violations and data leakage.

The document also lays the foundation for a national data economy by permitting structured public-private partnerships, data trusts, controlled access for researchers and innovators, and regulated licensing of government datasets. However, it makes clear that commercialization cannot override citizens’ privacy rights or compromise Pakistan’s sovereign control over critical government databases.

Institutionally, the policy assigns the Pakistan Digital Authority the central role in overseeing implementation, issuing binding standards, monitoring compliance and establishing a National Data Governance Council comprising federal ministries, provincial governments, regulators and other stakeholders. Every public body will also be required to appoint a Chief Data Officer responsible for implementing the framework.

Compliance will be measured through annual self-assessments, audits and a new National Data Maturity Index that will rank public bodies on governance, security, data quality, openness and citizen empowerment. Persistent non-compliance could trigger binding corrective directions and enforcement measures by the Pakistan Digital Authority.

The policy will take effect after federal cabinet approval and notification in the official Gazette. Public bodies will then be required to align existing systems, contracts and processes with the new framework according to implementation timelines to be issued under the forthcoming National Data Strategy. Existing contracts involving government data must be updated within twelve months of the policy becoming effective.