Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Pakistan PECA

Amended Pakistan · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Takes effectJan 29, 2025 · 21 months ago · Source
PECA amendment takes effectAct No. II of 2025 got presidential assent and took effect on 29 Jan 2025, per the Gazette of Pakistan.

Summaries for reference, not legal advice. Check the official text.

What it does

Pakistan's main cybercrime law, covering unauthorised access, data interference, cyber stalking and related offences, plus investigation powers. The 2025 amendment creates a Social Media Protection and Regulatory Authority that enlists social media platforms, orders removal or blocking of unlawful content, and can block non-compliant platforms. It also adds a Social Media Protection Tribunal, a new National Cyber Crime Investigation Agency, and an offence of spreading false information.

Who it applies to
Everyone in Pakistan, Pakistani citizens anywhere, acts abroad that affect people or systems in Pakistan, and social media platforms accessible from Pakistan.
Penalties
The new false information offence (s. 26A) carries up to 3 years in prison, a fine of up to PKR 2 million, or both. The Authority can partly or fully block platforms that do not comply.
Enforced by
Social Media Protection and Regulatory Authority; National Cyber Crime Investigation Agency (NCCIA); Pakistan Telecommunication Authority
Official name
Prevention of Electronic Crimes Act, 2016 (as amended by the Prevention of Electronic Crimes (Amendment) Act, 2025)
Citation
Act No. XL of 2016; amended by Act No. II of 2025
Topics
Cybersecurity, Online safety
Verified 2026-09-25 na.gov.pk
Research notes

The 2016 Act took effect at once on enactment, but the official NA copy checked does not show the assent date, so enacted_date and effective_date are left blank. Pakistan's draft personal data protection bill has not been enacted.

Related

In forceAustralia
Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024
AmendedAustralia
Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022
AmendedAustralia
Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018
In forceAustralia
Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025
In forceChina
China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025
In forceChina
China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
In forceChina
China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025
Questions about Pakistan PECA
What are the Pakistan PECA compliance deadlines?
Jan 29, 2025: PECA amendment takes effect.
Who does Pakistan PECA apply to?
Everyone in Pakistan, Pakistani citizens anywhere, acts abroad that affect people or systems in Pakistan, and social media platforms accessible from Pakistan.
What are the penalties under Pakistan PECA?
The new false information offence (s. 26A) carries up to 3 years in prison, a fine of up to PKR 2 million, or both. The Authority can partly or fully block platforms that do not comply.