Pakistan - Digital Nation Act (I/2025)
Digital Nation Pakistan Act, 2025
Pakistan
RAI-PK-NA-DNP2XXX-2025The Digital Nation Pakistan Act, 2025 (Act No. I of 2025) establishes a national framework for Pakistan’s digital transformation by creating the Pakistan Digital Authority, the National Digital Commission, and related oversight bodies to implement a National Digital Masterplan. The Act provides institutional powers to coordinate digital public infrastructure, promote interoperable digital services, and govern data sharing while requiring reporting and oversight mechanisms to monitor implementation.
Summary
The Digital Nation Pakistan Act, 2025 (Act No. I of 2025) is primary federal legislation enacted on 29 January 2025 to accelerate and govern Pakistan’s transition to a ‘digital nation’. The Act creates a three-tier governance architecture: (1) the National Digital Commission (NDC), chaired by the Prime Minister and intended to provide strategic direction and intergovernmental alignment; (2) the Pakistan Digital Authority (PDA), a statutory corporate body tasked with operationalising the National Digital Masterplan, setting standards, enabling digital public infrastructure (including identity, data exchange and platform layers), and coordinating public-private engagement; and (3) an Oversight Committee and a Digital Nation Fund to provide management oversight and financing mechanisms for priority projects. The law is designed to institutionalise and scale initiatives such as digital IDs, interoperability layers (a Pakistan Stack and data exchange), and digital government services to improve service delivery and the business environment.
The Act assigns the PDA powers to develop policies, technical standards, interoperability rules, guidelines for data sharing across government and eligible private actors, and to review major public-sector digital projects. It contemplates creation of sectoral transformation plans, monitoring and evaluation frameworks, and routine reporting to the NDC. The Act also vests the Authority with administrative powers—entering contracts, holding property, and issuing subordinate regulations—so it can act as an operational centre for digital transformation.
Although the Act emphasises digital inclusion, ease of doing business, and economic growth, it has generated debate on privacy, civil liberties and cybersecurity: stakeholders and commentators have highlighted that the Act itself sets a governance and operational framework but that separate, more detailed legislation or subordinate instruments (for example, a dedicated data protection law, cybersecurity rules, and transparent safeguards for fundamental rights) will be required to protect individual rights, set consent rules, define data subject rights, and prescribe security obligations. The Act therefore should be read alongside concurrent measures and proposals (including draft data protection legislation and amendments to electronic crimes laws) that will define operational safeguards, incident reporting, and enforcement.
The Act came into force rapidly after parliamentary approval (Senate and National Assembly considerations during January 2025) and is recorded in official legislative listings as Act No. I of 2025 (Gazette publication dated 29 January 2025). The primary official materials announcing and describing the law include the Press Information Department (PID) of Pakistan and the Ministry of Information Technology & Telecommunication (MoITT), while the Senate and National Assembly record the Act in parliamentary acts lists. Secondary commentary from Pakistani media and policy outlets highlights the Act’s potential to modernise government services and the outstanding need for complementary privacy and cybersecurity frameworks.
Practical implications for regulated entities: federal and provincial public bodies, state-owned enterprises, and private-sector suppliers of digital public goods or services will need to coordinate with the PDA and comply with future regulations issued under the Act. Organizations participating in government data exchange, digital identity, payments, or sectoral transformation plans should track PDA standards, registration and conformity processes, and reporting obligations. The Act also mandates monitoring, evaluation and public reporting channels through the NDC and Oversight Committee, establishing a central accountability architecture for Pakistan’s digital programme.
Full article
Overview
The Digital Nation Pakistan Act, 2025 (Act No. I of 2025) is federal enabling legislation enacted on 29 January 2025 to create an institutional framework for national digital transformation. The Act establishes the Pakistan Digital Authority (PDA), a National Digital Commission (NDC) and an Oversight Committee, together intended to design and implement a National Digital Masterplan, build interoperable Digital Public Infrastructure, and coordinate public-sector and private-sector digital initiatives. Official announcements and ministry summaries describe the Act as a vehicle to implement a Pakistan Stack/data exchange layers and to accelerate online delivery of government services. See the Ministry of Information Technology & Telecommunication announcement: Ministry of IT & Telecom and the Press Information Department notice: Press Release (PID). The Act was recorded in parliamentary acts listings as Act No. I of 2025 published in the Gazette on 29 January 2025. Senate records.
Definitions
The Act provides statutory definitions for core constructs: "Digital Public Infrastructure" (DPI), "Pakistan Stack", "data exchange layer", "digital identity", "digital public service", "Authority" (the Pakistan Digital Authority), "Commission" (the National Digital Commission), "Oversight Committee" and other administrative terms. Definitions frame the Authority’s mandate to issue standards, interoperability rules and guidelines for data sharing between public bodies and eligible private actors. The Act distinguishes between policy direction (NDC) and operational execution (PDA), and defines registers, reporting duties, and the notion of sectoral transformation plans to be coordinated by the PDA.
Governance and Institutional Framework
The governance architecture created by the Act includes three central institutions: the National Digital Commission (NDC) chaired by the Prime Minister, the Pakistan Digital Authority (a statutory corporate body), and an Oversight Committee led by the Minister of IT & Telecom to supervise day-to-day execution. The NDC provides strategic direction, intergovernmental coordination and sectoral alignment across federal and provincial governments; it includes Federal Ministers, Chief Ministers and heads of key regulatory agencies. The PDA is empowered to draft and implement the National Digital Masterplan, develop technical standards for DPI components (identity, payments/connectivity, data-exchange), evaluate major digital projects, issue subordinate regulations, and manage a Digital Nation Fund. The Oversight Committee acts as an executive board overseeing PDA performance and reporting to the NDC. For official descriptions see the Ministry briefing: MoITT announcement and parliamentary listings: Senate records.
Key Focus Areas
The Act focuses on seven interlocking priorities: (1) Digital Public Infrastructure (DPI) design and standards — including a Pakistan Stack and data exchange layers to enable secure inter-agency data flows and public services; (2) Digital identity and verification systems to simplify citizen access to services; (3) Service digitisation across government to improve access, efficiency and ease of doing business; (4) Data governance arrangements for responsible data sharing between public bodies, subject to future sectoral rules and complementary laws; (5) Institutional capacity building and a Digital Nation Fund to finance priority programmes; (6) Monitoring, evaluation and reporting frameworks to track project outcomes and interoperability; and (7) cross-cutting cybersecurity and resilience provisions to be coordinated with existing cyber institutions. Commentary from policy analysts highlights that while the Act is comprehensive in establishing governance architecture, it anticipates additional subordinate instruments and new laws (for example an express data protection law and cybersecurity regulations) to provide detailed safeguards for fundamental rights and operational security. See analysis and critique: policy analysis.
Implementation Framework
Implementation is built around the National Digital Masterplan, which the PDA will draft, publish and update. The Act empowers the PDA to prepare sectoral transformation plans in consultation with federal and provincial stakeholders and to issue technical standards and interoperability rules for DPI components. The PDA may register or accredit service providers, review public projects with digital components and recommend approvals to the NDC. The Digital Nation Fund will offer capital for strategic projects and pilot programmes; procurement and contracting authority rests with the PDA for projects under its mandate. Implementation emphasizes public-private partnership models while requiring oversight via the Oversight Committee and formal reporting channels to the NDC. For government guidance and announcements see Press Release (PID).
Monitoring and Evaluation
The Act requires establishing monitoring and evaluation mechanisms, key performance indicators (KPIs) for digital services, and routine progress reports to the NDC. The PDA is charged with publishing progress metrics, conducting independent project reviews, and maintaining an online dashboard for transparency and public accountability. Evaluation responsibilities include reviewing conformance to interoperability standards, citizen uptake metrics, digital inclusion indicators and security incidents. The PDA must submit periodic reports on the Masterplan, financial statements of the Digital Nation Fund, and independent audit findings to the Oversight Committee and the NDC.
Penalties, Liability, and Appeals
The Act grants the PDA regulatory and enforcement powers including issuing subordinate regulations, compliance notices and administrative penalties for violations of rules issued under the Act. It also contemplates procedures for administrative appeals and judicial review where affected parties may challenge PDA decisions. While the Act establishes enforcement architecture, it refers to sectoral laws (for example telecommunications and cybersecurity instruments) for criminal sanctions and specific liability rules. Observers note that the Act’s enforcement provisions are administrative in nature and that stronger statutory protections (for data subjects or explicit civil remedies) will depend on follow-on legislation and regulations.
Relationship to Other Instruments
The Act was designed to operate alongside existing laws and ongoing legislative initiatives, including the Pakistan Telecommunication (Re-Organization) Act, the Prevention of Electronic Crimes (Amendment) Act 2025 and draft/parallel initiatives for data protection and cybersecurity. The PDA is expected to coordinate with sectoral regulators such as the Pakistan Telecommunication Authority (PTA), the State Bank of Pakistan (for digital payments and fintech), National Database & Registration Authority (NADRA) for identity matters, and the national CERT for incident response. Parliamentary and media records show the Act passed contemporaneously with other digital-related legislative changes in January 2025. See parliamentary listing: National Assembly acts list.
International Alignment
The Act references objectives consistent with international practices for digital governance (interoperability, DPI, standards-based approaches and multi-stakeholder coordination) and anticipates cooperation with international partners for capacity building and standards adoption. Pakistani commentators and policy briefs recommend alignment with global frameworks for data protection (e.g., elements comparable to GDPR-like protections), the EU’s interoperability and digital services approaches, and internationally recognised cybersecurity norms. The PDA’s mandate to set technical standards and pursue cross-border data arrangements will require harmonisation with incoming data-protection and cybersecurity rules to meet international trade and cross-border data flow expectations. See reporting on international cooperation and digital services rollout: Digital Policy Alert.
Implementation Timeline
| Event | Date |
|---|---|
| Passage in Parliament (Senate/NA) | 2025-01-23 to 2025-01-28 |
| Assent and Gazette publication (Act No. I of 2025) | 2025-01-29 |
| PDA established (statutory incorporation and initial appointments) | 2025 (implementation steps throughout 2025) |
| Publication of first National Digital Masterplan (target) | 2025–2026 (PDA schedule) |
Sources and References
| Source | Type |
|---|---|
| The Digital Nation Pakistan Act, 2025 (Gazette text, PDF copy) | Primary Source |
Requirements for a company
What an organisation has to do under Pakistan - Digital Nation Act (I/2025), at a glance. Not legal advice — the table below gives the provision and deadline for each item.
Must do
6- Conform to technical standards and interoperability rules issued by the Pakistan Digital Authority.Government agencies, private partners, and service providers implementing digital services or infrastructure, including those using AI.
- Comply with cross-cutting cybersecurity and resilience provisions and incident reporting requirements.All entities operating digital systems or processing data under the Act, including those using AI.
- Register or liaise with the Pakistan Digital Authority as a service provider.Providers of Digital Public Infrastructure services, including those using AI.
- Submit major digital project proposals for evaluation and approval to the Pakistan Digital Authority.Public-sector project owners developing major digital projects, including those using AI.
- Provide routine progress reports and performance metrics for digital services to the Pakistan Digital Authority.Entities responsible for digital services or projects under the National Digital Masterplan, including those using AI.
- Adhere to data governance arrangements for responsible data sharing between public bodies.Public bodies sharing data through digital infrastructure, including those using AI.
Must not do
0Nothing in this category.
Should do
1- Consult with the Pakistan Digital Authority on sectoral digital transformation plans.Federal and provincial stakeholders involved in sectoral digital transformation.
Should not do
0Nothing in this category.
Who must do what
The obligations under Pakistan - Digital Nation Act (I/2025), most serious first. Not legal advice — verify against the official text before relying on it.
| # | Who | Requirement | By when | Where | Severity |
|---|---|---|---|---|---|
| 1 | Government agencies, private partners, and service providers implementing digital services or infrastructure, including those using AI. | Conform to technical standards and interoperability rules issued by the Pakistan Digital Authority. “The PDA is empowered to... develop technical standards for DPI components... and issue subordinate regulations.” | Upon PDA publication of standards | — | Critical |
| 2 | All entities operating digital systems or processing data under the Act, including those using AI. | Comply with cross-cutting cybersecurity and resilience provisions and incident reporting requirements. “cross-cutting cybersecurity and resilience provisions to be coordinated with existing cyber institutions.” | Upon publication of relevant rules | — | Critical |
| 3 | Providers of Digital Public Infrastructure services, including those using AI. | Register or liaise with the Pakistan Digital Authority as a service provider. “The PDA may register or accredit service providers.” | As required by PDA regulations | — | Important |
| 4 | Public-sector project owners developing major digital projects, including those using AI. | Submit major digital project proposals for evaluation and approval to the Pakistan Digital Authority. “The PDA is empowered to... evaluate major digital projects, issue subordinate regulations, and manage a Digital Nation Fund.” | Before project implementation | — | Important |
| 5 | Entities responsible for digital services or projects under the National Digital Masterplan, including those using AI. | Provide routine progress reports and performance metrics for digital services to the Pakistan Digital Authority. “The Act requires establishing monitoring and evaluation mechanisms, key performance indicators (KPIs) for digital services, and routine progress reports to the NDC.” | As per PDA reporting schedules | — | Important |
| 6 | Public bodies sharing data through digital infrastructure, including those using AI. | Adhere to data governance arrangements for responsible data sharing between public bodies. “Data governance arrangements for responsible data sharing between public bodies, subject to future sectoral rules and complementary laws.” | Upon publication of sectoral rules and complementary laws | — | Important |
| 7 | Federal and provincial stakeholders involved in sectoral digital transformation. | Consult with the Pakistan Digital Authority on sectoral digital transformation plans. “The Act empowers the PDA to prepare sectoral transformation plans in consultation with federal and provincial stakeholders.” | As requested by PDA | — | Recommended |
Related Regulations
© Regulations.AI · updated on 13-Jun-2026