ISLAMABAD: Pakistan this month published a draft National Data Governance Policy that would establish the country’s first unified framework governing how federal agencies collect, store, share and use government data, while introducing new rules for artificial intelligence, cross-border data transfers and citizens’ digital rights.
The draft policy, released on June 26 by the Ministry of Information Technology and Telecommunication for public consultation, seeks to create common standards across the federal government, establish new institutions to oversee data governance and lay the foundations for a digital public infrastructure in which government agencies exchange information through a common framework rather than isolated databases. It would require federal cabinet approval before taking effect.
The policy comes as governments worldwide increasingly seek to regulate the use of public-sector data and artificial intelligence while balancing national security, privacy and economic interests. Pakistan has in recent years accelerated its digital governance agenda through the Digital Nation Pakistan Act and broader efforts to digitize public services.
“Government data is a strategic national asset of the Islamic Republic of Pakistan, held in trust for the people,” the draft policy says, adding that government data should be governed for “sovereignty, public value, citizen empowerment, and lawful use.”
The policy makes clear that government agencies would no longer treat data as their own property.
“Public bodies are custodians, not proprietors,” it says. “Custodianship carries the duty of stewardship: to protect, to maintain quality, to make discoverable, to share lawfully, and to disclose proportionately.”
To reduce duplication across government, the framework proposes establishing a governed National Data Exchange, known as WASL, through which federal agencies would securely exchange information instead of creating separate copies of the same datasets. It also proposes designating a single authoritative government source for key national records, including areas such as identity, land, addresses and vehicles.
The draft also introduces a “once-only” principle aimed at reducing bureaucracy.
“The citizen shall not be required to provide the same information to the State more than once, unless such repetition is necessary by law or for verification,” it says.
The framework sets out a risk-based approach for the government’s use of artificial intelligence, requiring greater oversight of systems that could have legal or similarly significant effects on citizens.
“The Government of Pakistan shall harness artificial intelligence, automated decision-making, and emerging data-intensive technologies for public value, while protecting rights, ensuring lawful use, and preserving meaningful human oversight where required,” the policy says.
It also says citizens should have greater control over personal information held by the government, including the right to know what data is held about them, who has accessed it, when it was accessed and for what purpose. The policy would also allow citizens to seek corrections to inaccurate records, request deletion where legally permitted, obtain their data in a machine-readable format and ask for human review of significant decisions made by automated systems.
On cross-border data transfers, the policy proposes that sensitive government and personal data generally remain hosted and processed within Pakistan, while allowing offshore processing only in specified circumstances subject to approval and safeguards. Open government data would face no residency restrictions.
The framework also proposes making public-sector data open by default unless restricted by law, while introducing common standards for interoperability, cybersecurity, privacy protections and data quality across federal institutions.
Implementation would be overseen by the Pakistan Digital Authority, which would designate a National Chief Data Officer, require federal agencies to appoint their own Chief Data Officers and establish a National Data Governance Council to coordinate implementation across the federal government and provinces.
Compliance would be monitored through audits and a National Data Maturity Index measuring how effectively public bodies implement the framework.
The ministry has invited public feedback on the draft before it is finalized and submitted to the federal cabinet for approval
