Digital Nation Pakistan Act: What It Builds

While PECA’s amendment was making headlines in January 2025, a second, quieter law was moving through parliament in the same window, one that will eventually touch more of daily life than PECA does. The Digital Nation Pakistan Act sets out to unify Pakistan’s digital identity and government services under one system. It passed without a data protection law in place to govern the data it collects. That gap is still open today.

What the Act actually creates

The Digital Nation Pakistan Bill was tabled in the National Assembly in December 2024 by Minister of State for IT and Telecom Shaza Fatima Khawaja, after cabinet approval in mid-2024. It passed the National Assembly on January 23, 2025, the same day PECA’s amendment passed, and was enacted on January 29, 2025 as the Digital Nation Pakistan Act (Act No. I of 2025).

The Act establishes three bodies:

The Pakistan Digital Authority (PDA), a statutory body with the power to issue regulations, enforce compliance, and administer penalties, led by a five-year, non-renewable term appointee.
The National Digital Commission (NDC), chaired by the Prime Minister, which sets overall strategy.
A Strategic Oversight Committee (SOC), which monitors delivery against the Act’s goals.

Together, these bodies are meant to build what officials describe as a “National Digital Masterplan,” consolidating citizens’ social, economic, and governance data into a unified digital identity. In practice, this means linking birth certificates, education records, health records, and digital wallets under one system, with a mobile credential app (Pak ID) already adding facial verification and document storage.

The government’s case

Officials have framed the Act as a modernization effort, explicitly modeled on digital transformation programs in the UAE, India, Estonia, and Singapore. The goal is paperless, faster government service delivery instead of Pakistan’s currently fragmented mix of separate agency databases, NADRA records, provincial portals, and e-service systems that don’t talk to each other. The government has stressed a commitment to data privacy and says digital rights organizations will be involved in addressing concerns as the system rolls out.

The critics’ case

Digital rights groups raised concerns before the Act passed, and most of those concerns remain unresolved. The Digital Rights Foundation flagged vague statutory language, terms like “spoofing” and “glorification of crime” that are broad enough to be applied well beyond their apparent intent, and called for judicial oversight before any content or account is taken down under the Act, plus a genuine stakeholder consultation process before further changes. In a joint statement, the Digital Rights Foundation, Bytes for All, and FORUM-Asia warned the Act’s centralization of citizens’ digital identity data creates real risk of surveillance and privacy violations without corresponding safeguards. Separately, IFEX highlighted that the Act also restricts publication of parliamentary proceedings and statements from proscribed organizations, a transparency concern distinct from its data provisions.

A more technical critique came from a legal analysis published in Business Recorder, which compared the Act against the EU’s GDPR and found real gaps: no clear consent requirement for biometric data collection (something the U.S.’s Illinois Biometric Information Privacy Act does require), no defined rules for transferring Pakistani citizens’ data across borders, and no data localization requirement.

Amnesty International went further in a formal set of recommendations published in April 2025, cautioning against treating digitalization as a goal in itself, and calling on Pakistan to revisit the Act with binding human rights protections against privacy violations, surveillance, and discrimination built in.

One structural detail worth knowing: Section 28 of the Act gives it overriding power over other laws. Digital rights groups have flagged this as a specific risk, since it means the Digital Nation Act could take precedence over future privacy or data protection legislation rather than being constrained by it.

The gap underneath all of this

Pakistan does not yet have an enacted data protection law. A Personal Data Protection Bill has been pending for years and still hadn’t passed as of mid-2026. That means the Digital Nation Act is actively centralizing sensitive citizen data, biometric records, health data, financial information, before the law that would normally govern how that data can be used, shared, or protected even exists. The Act currently operates alongside PECA and sector-specific rules (like State Bank frameworks for financial data), but nothing yet fills the general data protection role GDPR plays in the EU.

Where it stands now

The Pakistan Digital Authority has been formally established and is active. As of mid-2026, Prime Minister Shehbaz Sharif has directed officials to accelerate rollout, particularly in health and financial services, with the unified digital ID intended to let citizens verify documents and access banking and healthcare through a single platform. NADRA’s identity card rules were separately updated in mid-2025 to mandate biometric registration through Union Councils, a related but distinct process feeding into the broader system.

Why this matters if you’re not a policy specialist

If you use NADRA services, online banking, or any government e-service in Pakistan going forward, your data will increasingly sit inside this system, whether or not you’ve read a word about the Act itself. Understanding what data is being centralized, which body is responsible for it, and what legal protections do and don’t yet exist around it is relevant to essentially every adult with a CNIC, not just to lawyers and technologists.

We covered PECA’s amendment in a separate piece; the two laws passed through parliament in the same short window in January 2025 and are worth understanding together; one governs what you can say online, the other governs what the state knows about you.

Full source list:

The Digital Nation Pakistan Act: A National Digital ID, Built Before a Privacy Law Exists