ISLAMABAD — In a major step toward rewriting the rules of the country’s digital landscape, the Ministry of Information Technology and Telecommunication (MoITT) has officially released the draft National Data Governance Policy 2026 for public consultation.
Minister for IT and Telecommunication Shaza Fatima Khawaja confirmed that the sweeping framework is now open for public feedback, with stakeholders and citizens invited to submit their suggestions until July 10, 2026.
A Shift from Ownership to Custodianship
The cornerstone of the new policy is a fundamental redefinition of how state data is handled. Moving forward, government data is officially classified as a “strategic national asset” held in sovereign trust for the citizens of Pakistan.
Under this framework, public bodies and state agencies will no longer act as owners of the data they gather. Instead, they are designated strictly as custodians bound by a duty of stewardship to protect, maintain, and share information lawfully.
Key Highlights of the 2026 Policy
The proposed policy introduces comprehensive regulations aimed at streamlining bureaucracy, ensuring digital rights, and managing cutting-edge technology:
- Empowering Citizens’ Rights: For the first time, citizens will gain the right to know exactly which government officials have accessed their personal data, when, and for what purpose. It also introduces data portability, allowing individuals to request their records in structured, machine-readable formats.
- The “Once-Only” Principle: To cut through traditional red tape, the state aims to build a digital public infrastructure ensuring citizens are not repeatedly asked to provide identical information to different government agencies.
- Unified Data Exchange (WASL): To prevent duplicate record-keeping, agencies will securely share information via a centralized National Data Exchange platform called WASL, relying on single authoritative registers for critical files like identity, land, and vehicles.
- AI and Generative AI Guardrails: The framework establishes rules for the government’s deployment of Artificial Intelligence, mandating continuous human oversight, transparency, and safeguards against factual inaccuracies or data leakage in generative models.
- Strict Digital Sovereignty: Sensitive personal and government data must remain physically hosted and processed within Pakistan, with strict offshore transfers allowed only under highly specific, regulated exceptions.
Centralized Enforcement by the PDA
Sitting at the heart of this digital overhaul is the Pakistan Digital Authority (PDA). As the primary enforcement body, the PDA will be responsible for issuing binding standards, launching a National Data Maturity Index to audit public institutions, and establishing a National Data Governance Council to coordinate efforts seamlessly across federal ministries, provincial governments, and industry regulators.
“As the digital age advances, robust data protection and usage regulations have become essential,” Minister Shaza Fatima emphasized, noting that the policy will undergo final revisions based on public feedback before being presented to the federal cabinet for formal approval.
