In a paradigm-shifting development that fundamentally transmutes the digital governance landscape, the Ministry of Information Technology and Telecommunication has promulgated the National Data Governance Policy 2026. This unprecedented framework designates government data as a "strategic national asset" and introducessweeping regulations concerning data sovereignty, privacy, artificial intelligence, cross-border data transfers, and citizens' digital rights.

The epicenter of the transformation

Prepared under the framework of the Digital Nation Pakistan initiative, the policy establishes for the first time a comprehensive governance regime for public-sector data. It mandates that all federal ministries, departments, regulators, public-sector companies, and their contractors comply with uniform standards governing the collection, storage, sharing, and disposal of government data.

The policy positions Pakistan among a growing cohort of countries adopting stringent digital sovereignty measures, asserting that government data must remain under the country's "lawful authority and effective control." Sensitive government and personal data will generally be required to remain physically hosted and processed within Pakistan, while any offshore processing will necessitate prior approval and additional safeguards.

The "Once-Only Principle"

One of the most significant provisions bars public bodies from creating multiple copies of citizens' personal data. Instead, agencies will be required to rely on designated "Primary Data Registers" as the single authoritative source of information, with data exchanged through a governed National Data Exchange platform known as WASL.

The policy also embraces the "once-only principle," under which citizens should not be asked repeatedly to provide the same information to different government agencies, paving the way for seamless digital public services.

Citizen Digital Rights

In a major shift toward citizen-centric governance, the framework recognizes extensive digital rights. These include the right to know which government officials have accessed personal data, the right to correct inaccurate records, data portability, erasure where legally permissible, and meaningful human review of automated government decisions.

Artificial Intelligence Regulations

Artificial intelligence features prominently in the policy. Government agencies deploying AI systems that make legally significant decisions will be required to ensure explainability, continuous monitoring, meaningful human oversight, and public transparency.

Public bodies will also have to publish details of automated decision-making systems in a public registry maintained by the Pakistan Digital Authority (PDA). The policy further introduces controls over the government's use of generative AI, including safeguards against factual inaccuracies, intellectual property violations, and data leakage.