Pakistan National Data Governance Policy 2026 (draft) and AI

What it is

The National Data Governance Policy 2026 is a draft policy prepared by Pakistan’s Ministry of Information Technology and Telecommunication (MoITT) to govern public-sector data from collection to disposal. It declares government data a strategic national asset held in trust for the people, and treats public bodies as custodians rather than owners of it.

The Pakistan Digital Authority (PDA), established under the Digital Nation Pakistan Act 2025, would issue the policy, oversee it and publish the supporting instruments that carry the detail. One of those is an AI, ADM, Emerging Technology and Spatial Governance Profile, which the policy names as the place for detailed AI controls.

The draft is not in force. MoITT released it for public comment on 26 June 2026, and consultation closed on 10 July 2026. Under Annex III it takes effect when the PDA formally issues it, after cabinet approval and Gazette notification.

Who it applies to

Clause 7 applies the policy to all federal ministries, divisions, departments, regulators, authorities, commissions, autonomous bodies and public-sector companies. It also reaches every contractor, processor, concessionaire, grantee and partner that processes government data or performs public functions.

That second group is where private companies come in. Clause 7.3 requires every agreement involving government data to include enforceable obligations binding the counterparty to the policy, and says a contractor’s failure does not relieve the public body of its own responsibility. Clause 7.5 says the obligations follow the data when it is processed, stored or accessed outside Pakistan. Annex III gives public bodies twelve months from the effective date to amend existing processing contracts.

Provincial governments are encouraged to adopt the policy or an equivalent. The policy does not govern personal data held outside the public sector, which is left to a future personal data protection law.

What it requires

For AI and automated decision-making, clause 14 is the core.

• Risk tiers. AI and automated decision-making uses are governed by risk. High-risk uses, including those with legal or similarly significant effects on individuals, carry higher-rigour controls. Those are pre-production registration, model accountability, explainability proportionate to the use, drift monitoring and post-deployment review.
• Data for AI. Using government data to train, fine-tune, validate or run an AI system is subject to the policy’s rules on lawful basis, classification, provenance, quality and residency, and to privacy-enhancing technologies.
• Human oversight. Automated decisions with legal or similarly significant effects must provide meaningful human review on request, transparent contestability and accessible redress. The policy says oversight must be substantive and not merely formal. Clause 12.9 gives citizens the matching right.
• Algorithmic transparency. Public bodies running automated decision systems with legal or similarly significant effects must publish each one in a public registry kept by the PDA, describing its purpose, the categories of data it uses and its decision logic at a suitable level of abstraction.
• Procurement. Public bodies buying AI must include data governance, security and ethics requirements in the procurement.
• Generative AI. Generative AI used for content, decisions or analyses that materially affect citizens is subject to controls on provenance disclosure, factual accuracy, intellectual property and data leakage.

Other clauses reach AI systems too. Clause 11.4 requires a Privacy Impact Assessment for high-impact processing, which includes profiling and automated decision-making with legal or similarly significant effects and the deployment of new technologies. Clause 11.8 requires personal data breaches to be notified to the PDA, and to affected people where the risk to them is high. Clause 12.3 gives citizens the right to know who in government accessed their personal data, when and why.

Clause 8 sets residency tiers. Restricted, confidential and personal data, including all sensitive personal data, would be hosted and processed in Pakistan, with cross-border processing or remote access only on specific PDA approval. Internal data outside that tier may be processed offshore with prior PDA approval, contractual safeguards and audit rights. Open data has no residency restriction. For a supplier, the tier of the data a system touches decides where it may run.

Each public body would designate an Agency Chief Data Officer, submit an annual self-assessment signed by that officer, and be open to third-party audit commissioned by the PDA.

Key dates

• 29 January 2025. The Digital Nation Pakistan Act 2025 receives presidential assent. It establishes the Pakistan Digital Authority.
• 26 June 2026. MoITT releases the draft National Data Governance Policy 2026 for public comment.
• 10 July 2026. Public consultation closes.
• August 2026. MoITT and the Pakistan Digital Authority move to finalise the policy ahead of cabinet approval and Gazette notification.

The effective date will be the date of formal issuance by the PDA after cabinet approval and Gazette notification. Detailed implementation timelines are left to a National Data Strategy the PDA is to publish.

How it relates to other frameworks

The draft is the operational counterpart to the National AI Policy 2025, which committed the government to human oversight, a public register of public sector AI systems and impact assessments for high-impact systems. It places those commitments inside a data governance regime with an authority to enforce them.

Its approach is familiar from other public sectors. The public registry resembles the UK Algorithmic Transparency Recording Standard, and the risk-tiered controls echo Canada’s Directive on Automated Decision-Making. The human review right for decisions with legal or similarly significant effects borrows the language of GDPR Article 22, which the policy lists in its bibliography.

A supplier that keeps a current AI system register, runs impact assessments, monitors for drift and records who reviews automated decisions will have most of the material a federal customer would need to meet clause 14. ISO/IEC 42001 gives that work a recognised structure.

A note on this page

This is Aicura’s reading of the draft National Data Governance Policy 2026 as published by MoITT in June 2026. It is not legal advice and it is not the policy itself, and the final text may differ. Read the primary source on the MoITT website, and take advice on how Pakistani policy and law apply to your organisation.