Pakistan Personal Data Protection Bill 2023

Per Pakistan PDPB 2023 Clauses 13-15: cross-border transfer + localisation. Requirements include (a) restrict cross-border transfer of personal data except where conditions are met including adequacy determination + appropriate safeguards + explicit consent + necessity for contract/legal obligation/vital interests + (b) maintain localisation of Critical Personal Data within Pakistan per the Bill + (c) implement adequacy assessment for cross-border transfer destinations per NCPDP determination + (d) implement appropriate safeguards including binding corporate rules + standard contractual clauses + certification + (e) document cross-border transfer flows + safeguards + (f) maintain records for regulator inspection.

• Pakistan PDPB 2023 evidence for PAKPDPB-6

• DPO appointment + DPIA + records of processing partial

Per Pakistan PDPB 2023 Clauses 9-12: data subject rights. Requirements include (a) implement Right of Access enabling data subjects to obtain confirmation + categories + purposes + recipients + retention + (b) implement Right to Rectification of inaccurate or incomplete personal data + (c) implement Right to Erasure where lawful basis no longer applies + (d) implement Right to Restriction of Processing + Object to Processing per the Bill + (e) implement Right to Data Portability for data provided by the subject in structured machine-readable format + (f) protect data subjects against automated decision-making with significant effect + protect against direct marketing + profiling without consent + (g) maintain mechanism for requests + verification + response within statutory timelines.

• Pakistan PDPB 2023 evidence for PAKPDPB-3

• DPO appointment + DPIA + records of processing partial

Per Pakistan PDPB 2023 Clauses 20-22 + lifecycle: enforcement + penalties + lifecycle management. Requirements include (a) understand offences + penalties per the Bill including significant penalties for breach of obligations + (b) implement Complaints and Appeals mechanism enabling data subjects to lodge complaints with NCPDP + (c) implement Retention and Disposal including retention schedules + secure deletion + anonymisation where retention is no longer justified + (d) maintain Direct Marketing safeguards including consent + opt-out + suppression lists + (e) deliver training and awareness across the organisation including role-based content + onboarding + refresher + (f) maintain governance + lifecycle management + with continuous improvement.

• Pakistan PDPB 2023 evidence for PAKPDPB-8

• DPO appointment + DPIA + records of processing partial

Per Pakistan PDPB 2023 Clauses 16-18 + accountability: governance + accountability obligations. Requirements include (a) register with the National Commission for Personal Data Protection (NCPDP) where required + (b) appoint Data Protection Officer (DPO) where required + with defined responsibilities + independence + reporting to highest management + (c) maintain Records of Processing Activities including purposes + categories + recipients + retention + safeguards + (d) implement Processor Obligations + Contracts ensuring processors process only on instructions + maintain security + assist with rights + breach notification + (e) cooperate with NCPDP including providing information + facilitating audits + (f) maintain training + awareness programme for personnel handling personal data.

• Pakistan PDPB 2023 evidence for PAKPDPB-7

• DPO appointment + DPIA + records of processing partial

Per Pakistan PDPB 2023 (multiple clauses + Schedule): high-risk processing safeguards. Requirements include (a) apply higher protection for Sensitive Personal Data including health + biometric + genetic + financial + religious + sexual orientation + criminal records per the Bill + (b) apply higher protection for Critical Personal Data subject to localisation + (c) implement Child Data protections requiring verifiable parental consent for processing of children's personal data + (d) conduct Data Protection Impact Assessment (DPIA) for high-risk processing including large-scale processing + sensitive data + systematic monitoring + new technologies + (e) implement safeguards for Automated Decision-Making including human review + explanation + objection rights + (f) maintain documented DPIA + safeguards + risk mitigation.

• Pakistan PDPB 2023 evidence for PAKPDPB-4

• DPO appointment + DPIA + records of processing partial

Per Pakistan PDPB 2023 Clauses 4-7: lawful processing + principles + consent + notice. Requirements include (a) establish lawful basis per the Bill (consent + contract + legal obligation + vital interests + public interest + legitimate interests) + (b) apply data processing principles including lawfulness + fairness + transparency + purpose limitation + data minimisation + accuracy + storage limitation + integrity + confidentiality + accountability + (c) obtain valid consent including free + specific + informed + unambiguous + with mechanism for withdrawal + (d) provide notice to data subjects covering identity + purpose + categories + recipients + retention + rights + (e) implement special consent for sensitive personal data + (f) maintain records of consent and notices.

• Pakistan PDPB 2023 evidence for PAKPDPB-2

• DPO appointment + DPIA + records of processing partial

Per Pakistan Personal Data Protection Bill 2023 Clauses 2-3: define scope + applicability + key definitions. Requirements include (a) determine applicability based on processing of personal data in Pakistan or related to data subjects in Pakistan + extraterritorial reach per the Bill + (b) apply definitions of personal data + sensitive personal data + critical personal data + data controller + data processor + data subject per the Bill + (c) document applicability assessment + maintain through change + (d) classify data accordingly + (e) align internal definitions with the Bill + (f) maintain records demonstrating scope determination + applicability.

• Pakistan PDPB 2023 evidence for PAKPDPB-1

• DPO appointment + DPIA + records of processing partial

Per Pakistan PDPB 2023 Clauses 8 + 19: security and breach notification. Requirements include (a) implement appropriate technical + organisational security measures considering state of the art + costs + nature + scope + context + purposes of processing + risk to data subjects + (b) maintain measures including pseudonymisation + encryption + ongoing confidentiality + integrity + availability + resilience + restoration capability + regular testing + (c) maintain Personal Data Breach Notification to the National Commission for Personal Data Protection (NCPDP) within statutory timeline + (d) notify affected data subjects where high risk + (e) maintain breach log + incident response capability + (f) implement security testing + monitoring + and improvement.

• Pakistan PDPB 2023 evidence for PAKPDPB-5

• DPO appointment + DPIA + records of processing partial