In a seismic shift aimed at recalibrating Pakistan’s digital governance landscape, the Ministry of Information Technology and Telecommunication (MoITT) has officially promulgated the National Data Governance Policy 2026.

This trailblazing legislative instrument designates government data as a "strategic national asset," thereby instituting sweeping regulations concerning data sovereignty, individual privacy, artificial intelligence oversight, and cross-border data transference.

The edifice of Digital Nation Pakistan

Crafted under the aegis of the Digital Nation Pakistan initiative, the policy establishes, for the inaugural time, a comprehensive governance regime for public-sector data. It compels all federal ministries, departments, regulators, and public-sector entities to adhere to uniform standards governing the collection, storage, sharing, and expungement of government data.

"The policy places Pakistan among a growing number of countries adopting strict digital sovereignty measures, asserting that government data must remain under the country’s lawful authority and effective control."— Ministry of Information Technology and Telecommunication (MoITT)

In a move to fortify national security, sensitive government and personal data will generally be mandated to remain physically hosted and processed within Pakistan's geographical boundaries. Any offshore processing will necessitate prior sanction and additional safeguards.

The "Once-Only" tenet and WASL

One of the most salient provisions of the framework precludes public bodies from creating redundant copies of citizens’ personal data. Instead, agencies will be required to rely on designated "Primary Data Registers" as the single authoritative source of information. This data will be exchanged through a governed National Data Exchange platform known as WASL.

Furthermore, the policy embraces the "once-only principle," under which citizens should not be repeatedly asked to provide the same information to different government agencies, thereby paving the way for seamless digital public services.

AI oversight and Citizen Rights

Artificial intelligence features prominently in the policy. Government agencies deploying AI systems that make legally significant decisions will be required to ensure explainability, continuous monitoring, meaningful human oversight, and public transparency. Public bodies will also have to publish details of automated decision-making systems in a public registry maintained by the Pakistan Digital Authority (PDA).

In a major shift toward citizen-centric governance, the framework recognizes extensive digital rights, including the right to know which government officials have accessed personal data, the right to rectify inaccurate records, data portability, erasure where legally permissible, and meaningful human review of automated government decisions. The policy also requires granular consent wherever consent is the legal basis for data processing.