Pakistan - Electronic Crimes Amendment (II/2025)

Overview

The Prevention of Electronic Crimes (Amendment) Act, 2025 (Act No. II of 2025) is an express amendment to the Prevention of Electronic Crimes Act, 2016 intended to expand Pakistan’s legal and institutional framework for addressing online harms. It inserts new substantive offences (notably Section 26A on false or "fake" information), creates a specialised regulatory body called the Social Media Protection and Regulatory Authority and a new National Cyber Crime Investigation Agency (NCCIA), and authorises expedited removal and blocking orders and platform registration. The Act was assented to by the President and published in the Official Gazette on 29 January 2025 (see the published Act text and Gazette notice in the official record: Prevention of Electronic Crimes (Amendment) Act, 2025 (Gazette PDF)). The amendments entered into force immediately on publication. The law has since generated major public debate and legal challenges concerning its impact on freedom of expression and procedural safeguards, as reported by major national and international media outlets (see Dawn, AP).

Definitions

The Amendment inserts and revises multiple definitions in section 2 of PECA 2016. Notable definitions introduced or clarified include: "aspersion" (defined as spreading false and harmful information damaging the reputation of a person), "Authority" (defined as the Social Media Protection and Regulatory Authority established under section 2A), "complainant" (expanded to include victims or individuals with reasonable grounds to believe an offence has been committed), and an expanded concept of "inquiry" for investigatory procedures. These definitional changes broaden the statutory reach of the Act, extend cross-references into multiple offence and procedural sections, and are a primary means by which the amendment captures a wider array of online conduct for regulation or potential prosecution.

Governance and Institutional Framework

The Act establishes and/or formalises an institutional architecture for digital content oversight and cybercrime investigation. The three primary institutions created or referenced are: (1) the Social Media Protection and Regulatory Authority (the Authority) — a statutory body with a Chairperson and specified membership which will exercise powers to receive complaints, order removal/blocking, set procedures, register platforms and make regulations; (2) the National Cyber Crime Investigation Agency (NCCIA) — a specialist investigative agency to replace or absorb certain functions of the existing cybercrime wings and equipped to conduct digital forensics and investigations; and (3) the Social Media Protection Tribunal (SMPT) — a specialist forum for adjudication related to Authority orders and certain offences. The Amendment sets high-level composition and appointment principles, grants the Authority regulation-making power under a new section 51A, and provides transitory arrangements (section 50A) ensuring continuity by allowing the PTA and the incumbent investigation agency to perform functions until the new bodies are operational. The statutory text provides the federal government with powers to make rules for appointments, service matters and training, and contemplates the Authority establishing offices in Islamabad and provincial capitals (Gazette notice).

Key Focus Areas

The Amendment focuses on three major policy areas: (1) content regulation and misinformation — by creating an offence for intentionally disseminating false or fake information likely to create fear, panic or unrest and enabling rapid takedowns and blocking; (2) institutional capacity building — by creating a dedicated regulator and an investigation agency with powers, resources and training mandates for digital forensics; and (3) platform governance and compliance — by enabling the Authority to require registration of social media platforms, impose fees, request information, require local representation and instruct platforms to remove or block access to content within expedited timeframes (for instance, the Act mandates orders on complaints "forthwith but not later than twenty-four hours" in the drafting and legislative records). The Amendment also strengthens provisions on admissibility of forensic reports and harmonises existing rules, regulations and prior instruments through transitional and saving clauses.

Implementation Framework

Implementation depends on the Federal Government and the freshly established Authority creating detailed rules and regulations pursuant to the Act’s new section 51A. The Act provides for (a) notification-based regulation-making; (b) formation of the Authority’s board and appointment procedures; (c) establishment of the NCCIA and its staffing and training under the Civil Servants Act until dedicated rules are issued; (d) procedures for filing complaints and timelines for Authority orders; and (e) provision for appeals to the Social Media Protection Tribunal. The Act also allows the Authority to prescribe fees for platform registration and imposes a requirement that pre-existing rules and instruments remain in force to the extent they are not inconsistent with the Amendment. Because the Act leaves much operational detail to subordinate legislation and Authority regulations, the next implementation steps require prompt rulemaking, staffing, budget allocations and inter-agency coordination (including with the PTA and FIA) to avoid gaps or overlaps in enforcement. The published Act text and Gazette entry set the legal baseline for these powers (see the Gazetted text: official Act text).

Monitoring and Evaluation

The Act implicitly provides monitoring pathways through the Authority’s remit to collect complaints, issue takedown/blocking orders and maintain registries of platforms and actions taken. The Authority will be expected to publish periodic reports, maintain logs of orders and provide case-level justifications as part of administrative recordkeeping and accountability. The Act’s rule-making clause also anticipates procedural safeguards and grievance mechanisms (appeals to the Tribunal). Effective monitoring will require data collection standards, transparency reporting obligations for platforms, defined disclosure protocols, and independent oversight mechanisms — elements that the Act mandates in part but leaves to regulation. Civil society and media monitoring groups have indicated they will track implementation metrics, including takedown frequency, blocking incidents, prosecutions, and Tribunal decisions, to evaluate impact on rights and public order.

Penalties, Liability, and Appeals

The Amendment introduces or confirms a set of criminal and administrative penalties. Section 26A criminalises intentional dissemination of false or fake information that is likely to cause public unrest, with imprisonment up to three years and fines up to two million rupees. The Authority can order removal or blocking of content and, where necessary, platforms may be subject to fines, registration sanctions or blocking orders for non-compliance. The Act also provides for investigatory and evidentiary procedures (including admissibility of forensic reports) and establishes an adjudicatory path via the Social Media Protection Tribunal for appeals against Authority orders and for enforcement-related disputes. Legal challenges to the Act’s constitutional validity have already been filed in Pakistani courts by journalists’ organisations and others contesting aspects of criminalisation and administrative powers.

Relationship to Other Instruments

The Amendment explicitly amends PECA 2016 and interacts with a range of existing laws and instruments, including the Pakistan Telecommunication (Re-Organization) Act, 1996 (PTA-related matters), the Civil Servants Act, 1973 (service matters for NCCIA pending rules), the Pakistan Penal Code for overlapping offences, and prior rules, regulations and directions made under PECA which the Amendment deems to remain effective until superseded. The Act also references existing investigative agencies and provides transitional clauses to ensure continuity. It will likely prompt subsequent subordinate legislation (Authority regulations, Tribunal rules and NCCIA rules) and possibly interagency memoranda of understanding to define jurisdictional boundaries between PTA, FIA and the NCCIA.

International Alignment

The Amendment’s stated aims — combating disinformation, strengthening cybercrime investigation and regulating global platforms — reflect global policy trends where states seek greater control over online harms. However, international observers and rights bodies (including Amnesty International and the International Federation of Journalists) have expressed concern about proportionality, due process and freedom of expression. The Act’s approach to platform registration, rapid takedowns and criminal sanctions differs from data-protection-focused instruments (e.g., EU law) and aligns more closely with regulatory frameworks adopted in several jurisdictions that emphasise content regulation and platform responsibility. International compliance and interoperability issues (for example, cross-border data access requests, MLATs, platform takedown coordination) will require bilateral and multilateral engagement. See comparative commentary in major press reports and NGO statements (e.g., Amnesty International, news coverage: Dawn).

Implementation Timeline

Sources and References