Pakistan - Digital Nation Act (I/2025)
Digital Nation Pakistan Act, 2025
Pakistan
RAI-PK-NA-DNP2XXX-2025Pakistan - Digital Nation Act (I/2025) is In Force in Pakistan as of 8 Sep 2026, according to pid.gov.pk.
ActGovernance and OversightData Protection and PrivacyThe Digital Nation Pakistan Act, 2025 (Act No. I of 2025) establishes a national framework for Pakistan’s digital transformation by creating the Pakistan Digital Authority, the National Digital Commission, and related oversight bodies to implement a National Digital Masterplan. The Act provides institutional powers to coordinate digital public infrastructure, promote interoperable digital services, and govern data sharing while requiring reporting and oversight mechanisms to monitor implementation.
Summary
The Digital Nation Pakistan Act, 2025 (Act No. I of 2025) is currently in force. The Act was assented to by the President of Pakistan on 29 January 2025 and published in the Gazette of Pakistan on the same date, taking effect immediately upon enactment. Throughout 2025 and 2026, the legislation serves as the foundational statutory framework governing Pakistan's national digital transformation agenda and digital public infrastructure.
The Act establishes a three-tier governance framework comprising the National Digital Commission chaired by the Prime Minister for strategic alignment, the Pakistan Digital Authority as an autonomous statutory body responsible for executing the National Digital Masterplan, and an Oversight Committee led by the IT Minister to supervise operational execution. It mandates the development of key digital public infrastructure components, including digital identity systems managed alongside NADRA, a central data exchange layer known as WASL, and standardized digital public service platforms.
Under the statutory framework, federal and provincial government entities, state-owned enterprises, and private-sector partners are required to conform to technical standards, interoperability protocols, and data governance policies issued by the Pakistan Digital Authority. The law also establishes the Digital Nation Fund to finance strategic projects and introduces monitoring, reporting, and administrative compliance mechanisms.
Implementation continues across federal and provincial sectors, with the Pakistan Digital Authority overseeing data governance, artificial intelligence frameworks, and sectoral digital roadmaps. While the Act establishes administrative powers and indemnities for good-faith regulatory actions, policy stakeholders continue to highlight the need for complementary instruments, such as personal data protection legislation and updated cybersecurity regulations, to reinforce safeguards alongside public-sector digitization.
Full article
Overview
The Digital Nation Pakistan Act, 2025 (Act No. I of 2025) is federal enabling legislation enacted on 29 January 2025 to create an institutional framework for national digital transformation. The Act establishes the Pakistan Digital Authority (PDA), a National Digital Commission (NDC) and an Oversight Committee, together intended to design and implement a National Digital Masterplan, build interoperable Digital Public Infrastructure, and coordinate public-sector and private-sector digital initiatives. Official announcements and ministry summaries describe the Act as a vehicle to implement a Pakistan Stack/data exchange layers and to accelerate online delivery of government services. See the Ministry of Information Technology & Telecommunication announcement: Ministry of IT & Telecom and the Press Information Department notice: Press Release (PID). The Act was recorded in parliamentary acts listings as Act No. I of 2025 published in the Gazette on 29 January 2025. Senate records.
Definitions
The Act provides statutory definitions for core constructs: "Digital Public Infrastructure" (DPI), "Pakistan Stack", "data exchange layer", "digital identity", "digital public service", "Authority" (the Pakistan Digital Authority), "Commission" (the National Digital Commission), "Oversight Committee" and other administrative terms. Definitions frame the Authority’s mandate to issue standards, interoperability rules and guidelines for data sharing between public bodies and eligible private actors. The Act distinguishes between policy direction (NDC) and operational execution (PDA), and defines registers, reporting duties, and the notion of sectoral transformation plans to be coordinated by the PDA.
Governance and Institutional Framework
The governance architecture created by the Act includes three central institutions: the National Digital Commission (NDC) chaired by the Prime Minister, the Pakistan Digital Authority (a statutory corporate body), and an Oversight Committee led by the Minister of IT & Telecom to supervise day-to-day execution. The NDC provides strategic direction, intergovernmental coordination and sectoral alignment across federal and provincial governments; it includes Federal Ministers, Chief Ministers and heads of key regulatory agencies. The PDA is empowered to draft and implement the National Digital Masterplan, develop technical standards for DPI components (identity, payments/connectivity, data-exchange), evaluate major digital projects, issue subordinate regulations, and manage a Digital Nation Fund. The Oversight Committee acts as an executive board overseeing PDA performance and reporting to the NDC. For official descriptions see the Ministry briefing: MoITT announcement and parliamentary listings: Senate records.
Key Focus Areas
The Act focuses on seven interlocking priorities: (1) Digital Public Infrastructure (DPI) design and standards — including a Pakistan Stack and data exchange layers to enable secure inter-agency data flows and public services; (2) Digital identity and verification systems to simplify citizen access to services; (3) Service digitisation across government to improve access, efficiency and ease of doing business; (4) Data governance arrangements for responsible data sharing between public bodies, subject to future sectoral rules and complementary laws; (5) Institutional capacity building and a Digital Nation Fund to finance priority programmes; (6) Monitoring, evaluation and reporting frameworks to track project outcomes and interoperability; and (7) cross-cutting cybersecurity and resilience provisions to be coordinated with existing cyber institutions. Commentary from policy analysts highlights that while the Act is comprehensive in establishing governance architecture, it anticipates additional subordinate instruments and new laws (for example an express data protection law and cybersecurity regulations) to provide detailed safeguards for fundamental rights and operational security. See analysis and critique: policy analysis.
Implementation Framework
Implementation is built around the National Digital Masterplan, which the PDA will draft, publish and update. The Act empowers the PDA to prepare sectoral transformation plans in consultation with federal and provincial stakeholders and to issue technical standards and interoperability rules for DPI components. The PDA may register or accredit service providers, review public projects with digital components and recommend approvals to the NDC. The Digital Nation Fund will offer capital for strategic projects and pilot programmes; procurement and contracting authority rests with the PDA for projects under its mandate. Implementation emphasizes public-private partnership models while requiring oversight via the Oversight Committee and formal reporting channels to the NDC. For government guidance and announcements see Press Release (PID).
Monitoring and Evaluation
The Act requires establishing monitoring and evaluation mechanisms, key performance indicators (KPIs) for digital services, and routine progress reports to the NDC. The PDA is charged with publishing progress metrics, conducting independent project reviews, and maintaining an online dashboard for transparency and public accountability. Evaluation responsibilities include reviewing conformance to interoperability standards, citizen uptake metrics, digital inclusion indicators and security incidents. The PDA must submit periodic reports on the Masterplan, financial statements of the Digital Nation Fund, and independent audit findings to the Oversight Committee and the NDC.
Penalties, Liability, and Appeals
The Act grants the PDA regulatory and enforcement powers including issuing subordinate regulations, compliance notices and administrative penalties for violations of rules issued under the Act. It also contemplates procedures for administrative appeals and judicial review where affected parties may challenge PDA decisions. While the Act establishes enforcement architecture, it refers to sectoral laws (for example telecommunications and cybersecurity instruments) for criminal sanctions and specific liability rules. Observers note that the Act’s enforcement provisions are administrative in nature and that stronger statutory protections (for data subjects or explicit civil remedies) will depend on follow-on legislation and regulations.
Relationship to Other Instruments
The Act was designed to operate alongside existing laws and ongoing legislative initiatives, including the Pakistan Telecommunication (Re-Organization) Act, the Prevention of Electronic Crimes (Amendment) Act 2025 and draft/parallel initiatives for data protection and cybersecurity. The PDA is expected to coordinate with sectoral regulators such as the Pakistan Telecommunication Authority (PTA), the State Bank of Pakistan (for digital payments and fintech), National Database & Registration Authority (NADRA) for identity matters, and the national CERT for incident response. Parliamentary and media records show the Act passed contemporaneously with other digital-related legislative changes in January 2025. See parliamentary listing: National Assembly acts list.
International Alignment
The Act references objectives consistent with international practices for digital governance (interoperability, DPI, standards-based approaches and multi-stakeholder coordination) and anticipates cooperation with international partners for capacity building and standards adoption. Pakistani commentators and policy briefs recommend alignment with global frameworks for data protection (e.g., elements comparable to GDPR-like protections), the EU’s interoperability and digital services approaches, and internationally recognised cybersecurity norms. The PDA’s mandate to set technical standards and pursue cross-border data arrangements will require harmonisation with incoming data-protection and cybersecurity rules to meet international trade and cross-border data flow expectations. See reporting on international cooperation and digital services rollout: Digital Policy Alert.
Implementation Timeline
| Event | Date |
|---|---|
| Passage in Parliament (Senate/NA) | 2025-01-23 to 2025-01-28 |
| Assent and Gazette publication (Act No. I of 2025) | 2025-01-29 |
| PDA established (statutory incorporation and initial appointments) | 2025 (implementation steps throughout 2025) |
| Publication of first National Digital Masterplan (target) | 2025–2026 (PDA schedule) |
Sources and References
| Source | Type |
|---|---|
| The Digital Nation Pakistan Act, 2025 (Gazette text, PDF copy) | Primary Source |
Requirements for a company
What an organisation has to do under Pakistan - Digital Nation Act (I/2025), at a glance. Not legal advice — the table below gives the provision and deadline for each item.
Must do
6- Conform to technical standards and interoperability rules issued by the Pakistan Digital Authority.Government agencies, private partners, and service providers implementing digital services or infrastructure, including those using AI.
- Comply with cross-cutting cybersecurity and resilience provisions and incident reporting requirements.All entities operating digital systems or processing data under the Act, including those using AI.
- Register or liaise with the Pakistan Digital Authority as a service provider.Providers of Digital Public Infrastructure services, including those using AI.
- Submit major digital project proposals for evaluation and approval to the Pakistan Digital Authority.Public-sector project owners developing major digital projects, including those using AI.
- Provide routine progress reports and performance metrics for digital services to the Pakistan Digital Authority.Entities responsible for digital services or projects under the National Digital Masterplan, including those using AI.
- Adhere to data governance arrangements for responsible data sharing between public bodies.Public bodies sharing data through digital infrastructure, including those using AI.
Must not do
0Nothing in this category.
Should do
1- Consult with the Pakistan Digital Authority on sectoral digital transformation plans.Federal and provincial stakeholders involved in sectoral digital transformation.
Should not do
0Nothing in this category.
Who must do what
The obligations under Pakistan - Digital Nation Act (I/2025), most serious first. Not legal advice — verify against the official text before relying on it.
| # | Who | Requirement | By when | Where | Severity |
|---|---|---|---|---|---|
| 1 | Government agencies, private partners, and service providers implementing digital services or infrastructure, including those using AI. | Conform to technical standards and interoperability rules issued by the Pakistan Digital Authority. “The PDA is empowered to... develop technical standards for DPI components... and issue subordinate regulations.” | Upon PDA publication of standards | — | Critical |
| 2 | All entities operating digital systems or processing data under the Act, including those using AI. | Comply with cross-cutting cybersecurity and resilience provisions and incident reporting requirements. “cross-cutting cybersecurity and resilience provisions to be coordinated with existing cyber institutions.” | Upon publication of relevant rules | — | Critical |
| 3 | Providers of Digital Public Infrastructure services, including those using AI. | Register or liaise with the Pakistan Digital Authority as a service provider. “The PDA may register or accredit service providers.” | As required by PDA regulations | — | Important |
| 4 | Public-sector project owners developing major digital projects, including those using AI. | Submit major digital project proposals for evaluation and approval to the Pakistan Digital Authority. “The PDA is empowered to... evaluate major digital projects, issue subordinate regulations, and manage a Digital Nation Fund.” | Before project implementation | — | Important |
| 5 | Entities responsible for digital services or projects under the National Digital Masterplan, including those using AI. | Provide routine progress reports and performance metrics for digital services to the Pakistan Digital Authority. “The Act requires establishing monitoring and evaluation mechanisms, key performance indicators (KPIs) for digital services, and routine progress reports to the NDC.” | As per PDA reporting schedules | — | Important |
| 6 | Public bodies sharing data through digital infrastructure, including those using AI. | Adhere to data governance arrangements for responsible data sharing between public bodies. “Data governance arrangements for responsible data sharing between public bodies, subject to future sectoral rules and complementary laws.” | Upon publication of sectoral rules and complementary laws | — | Important |
| 7 | Federal and provincial stakeholders involved in sectoral digital transformation. | Consult with the Pakistan Digital Authority on sectoral digital transformation plans. “The Act empowers the PDA to prepare sectoral transformation plans in consultation with federal and provincial stakeholders.” | As requested by PDA | — | Recommended |
Related Regulations
More AI regulation in Pakistan
© Regulations.AI · updated on 20 Sep 2026 · reviewed against official sources on 8 Sep 2026 using Gemini 3.6 Flash