Domestic law and policy
The legal frameworks for development of Pakistan’s DPI development, including the country’s digital ID system were established in January 2025, two months before the launch of the new digital ID system.[38] The Digital Nation Pakistan Act (2025), enacted in January 2025, is the main legal framework “to provide for the transformation of Pakistan into a digital nation, enabling a digital society, digital economy, and digital governance”.[39] The Act covers Pakistan’s broader establishment of DPI, including establishment of a digital ID system for all citizens, and assigns entities responsible for planning and implementing different aspects.[40]
Pakistan’s DPI is regulated by three government bodies, the Pakistan Digital Authority (PDA), the National Digital Commission (NDC), and the Strategic Oversight Committee (SOC), as stipulated by the Digital Nation Pakistan Act (2025).[41] The Pakistan Digital Authority (PDA) is the government entity responsible for developing, implementing and monitoring the National Digital Masterplan, which is described as a “cohesive framework for digital transformation”.[42] The National Digital Commission (NDC) is assigned as the entity responsible for approving the National Digital Masterplan, providing strategic direction, and coordinating different government bodies “to ensure a unified and collaborative approach to digital transformation across all levels of government”.[43] Finally, the Strategic Oversight Committee (SOC) is responsible for monitoring and evaluating the performance of the PDA, including through independent performance and financial management reviews, review of reports and information, and an annual performance report. [44]
The Act defines digital identity as “legal, secure, verifiable credentials issued to an eligible individual, enabling access to digital services, transactions, and interactions which shall be developed, issued and managed by National Database and Registration Authority under the National Database and Registration Authority Ordinance, 2000. For legal entities, it shall be based on data maintained by the Securities and Exchange Commission of Pakistan or other relevant Federal or Provincial Government entities”.[45] Several new rules have been implemented in 2025 with relation to the ID Card, which involve collection of biometric data of all applicants between the age of 10 and 18 as well as compulsory birth registration of children to gain access to the Child Registration Certificate.[46] NADRA provides a formal grievance redressal mechanism, allowing individuals to file appeals in case of blocked, rejected, or misused ID data. Citizens can lodge complaints via the NADRA website or physically at registration centers.[47]
Data Protection
Pakistan does not currently have a comprehensive data protection law and the bill is still pending legislative approval as of July 2025.[48] The Digital Nation Pakistan Act notably does not establish data protection principles.[49] There is also no independent oversight established through the Act. Under Article 23 of the Act,[50] it is stated that officials of the regulating bodies (PDA, NDC, and SOC) cannot be sued or taken to court for anything they have done as a part of their job as long as they acted in good faith.[51] Article 29 also states that “no decision or action taken under this Act or rule or regulations made thereunder shall be questioned by any agency or challenged in any court or tribunal, nor shall any injunction be granted against such decisions or actions”.[52] These provisions are concerning, considering that they remove any means of public accountability over the authorities responsible for Pakistan’s DPI.[53] International organisations like Amnesty International have recommended that Pakistan “establish a public accountability and transparency mechanism” to ensure vetting and regulation of the three governing bodies.[54]
While there are no privacy safeguards in regards to digital ID in particular, the Constitution of Pakistan, through Article 14, guarantees and recognises the right to privacy as a fundamental right.[55] However, due to a lack of data protection legislation or privacy law, the security of the data of citizens stored and processed is questionable.[56] There are also concerns identified with data breaches that are stored with NADRA, where 2.7 million individuals’ data was found to be compromised between 2019 to 2023.[57] This centralised system for governance purposes raises concerns of surveillance without adequate privacy safeguards and sources caution on the new bill that gives the judiciary limited powers with unfettered powers to the executive.[58] Another striking example of how gaps in legal protections and lack of accountability have enabled problematic digital ID developments in Pakistan is described in the report ‘Paving a Digital Road to Hell?’, which shows that leaked documents indicated that surveillance technology provided by the United States was exchanged in return for expanded access to Pakistani identity data through re‑registration initiatives in the national ID system.[59]
International Commitments
Pakistan is not a signatory to any binding international treaty solely focused on digital ID, but it participates in forums like the ID4D Initiative by the World Bank and the Digital Cooperation Organization (DCO).[60] By excluding undocumented and stateless persons from ID cards and public services, Pakistan risks violating obligations under Articles 2, 9, and 12 of ICESCR, Articles 17 and 26 of ICCPR, and non-discrimination clauses in CEDAW and CERD.
