A002 · PK/POLICY/Data-Protection/PDP-vs-DGP/Gareeb-Business
The PDP vs DGP vs Gareeb Business
She didn't give him the PIN. But he already knew everything else. Pakistan is writing two rulebooks for your data. Let's make sure they work for the person behind it, and for the small business in the middle.
· 6 min read · Originally published on LinkedIn ↗
About four years ago, my wife's phone rang around 11 in the morning. She was in the kitchen, cooking, one hand stirring the pot, the phone squeezed between her ear and shoulder. Distracted, busy, the perfect time for a scammer to call.
"Assalam o Alaikum, main Easypaisa se baat kar raha hoon."
Now, my wife knows these gimmicks. Every Pakistani does. We have all received the famous "aap ka inaam nikla hai" call at least once.
But this caller was well prepared. He didn't ask for her details. He read them out to her. Her name. Her number. Every detail he mentioned was correct. I know because I listened to the recording later, and honestly, he knew her better than some of our relatives do.
Luckily, she still didn't believe him, and the PIN stayed where it belonged. 💪
But one question stayed with me:
"Bhai, yeh data aap tak pohancha kaise?"
🎁 Part one: let's start with ourselves
Before we point at anyone else, a small confession on behalf of all of us.
We love a freebie.
A free SIM? "CNIC ki copy le lo." A lucky draw at the mall? Full name, number, address, done. A discount on a WhatsApp form? Sure, here's my date of birth too.
We hand over our real details for a free keychain, then act surprised when a stranger knows them. 😄
So the first fix is free: pause and ask why before you hand anything over.
🏢 Part two: now let's be fair to the other side too
Citizens can be careless. But a citizen can't control what happens to that photocopy after the counter.
It goes in a file. The file goes into a spreadsheet. The spreadsheet goes to a vendor. The vendor's laptop goes home with someone's nephew who "knows computers".
And if you try to find out who was responsible, you meet the most famous phrase in Pakistani administration:
"Yeh mera area nahi hai." 🙂
The telco suggests the bank. The bank suggests the regulator. The regulator suggests the other regulator. Everyone is polite, and everyone is right that it isn't only theirs. That is exactly the gap.
🐔🥚 Chicken or egg?
The good news: help is on the way, and from two directions.
The slightly awkward news: our data has been travelling for years, and the rules are still catching up. So which comes first, protection or leakage? We can't undo the past, but we can make sure the two new rulebooks close the gap instead of creating a new "mera area nahi hai" between them.
📘 Rulebook 1: Data Governance Policy (DGP)
This one is about how government handles the data it holds: how it's managed, protected and shared.
Done well, it could mean institutions share information securely, so we stop carrying the same photocopy to five offices. (Our photocopy shops may protest, but the rest of us will celebrate.)
The Pakistan Digital Authority describes a federated approach: each institution keeps its own data, and authorised information is shared under common rules. That's sensible, and it's not one giant database of everyone.
The IT Minister has said the policy will be unveiled in the coming weeks. The ministry currently lists the 2026 version as a draft.
What it does well: it brings order to government data. What it can't do alone: my wife's caller didn't need the government's cupboard. He only needed one leaky spreadsheet somewhere in the private sector.
📕 Rulebook 2: Personal Data Protection (PDP)
This is the bigger promise: rules for every organisation that collects your data, from the SIM stall to the bank to the courier, plus a commission to oversee them.
The May 2023 PDP Bill sets this out, but it remains a draft. It has been "coming soon" for a while now, a bit like that cousin who has been "almost reaching" the wedding since the mehndi. 😅
What it does well: it covers the whole economy and gives citizens rights and remedies. What it needs: to actually arrive, and to fit neatly with Rulebook 1.
⚔️ So is there a battle?
Not a fight in a room. More like two good players who haven't yet agreed who passes the ball.
If a government department holds your information, a private company processes it, and a cloud provider hosts it, the citizen deserves one simple answer to "Data ghayab ho jaye, to zimmedar kaun?"
The two tracks can complement each other beautifully, as long as the roles of the Digital Authority, any future data-protection commission and existing sector regulators are spelled out clearly.
🏪 For the business owner
Picture a small retailer. Customer numbers in a spreadsheet. Orders on WhatsApp. Invoices in an accounting app. Delivery details with a courier. Another copy on an employee's laptop.
Ask: "Aap ka data kahan hai?" Honest answer: "Thora mere paas, thora staff ke paas, aur baaki software wale ke paas."
That's not a crime. It's just reality, and it's fixable with simple guidance:
- ✅ What should I collect, and why?
- ✅ Who can see it, and how long should I keep it?
- ✅ What should I ask my software vendor or cloud provider?
- ✅ What do I do if a phone, laptop or customer list goes missing?
Give small businesses templates, realistic timelines and affordable training, and most will happily comply.
👔 For the CEO
A CEO can't forward this one to IT with "please handle". 😉
Who decided to collect the data? Who approved the vendor? Who owns the risk?
Start with one question: What personal data do we hold, why, and who is accountable for it?
🛡️ For the CISO
The CISO already juggles access, logs, backups, suppliers, incidents, laptops and now AI tools.
What the CISO needs most isn't another product. It's authority: a seat when vendors are chosen and a say in why data is collected at all.
🌍 Does all data have to stay in Pakistan?
Local hosting and domestic cloud capacity matter, for sovereignty and resilience. But requirements depend on the data and the sector. One size won't fit all.
And a local server with a weak password is still a weak password, just closer to home. Location helps. Access, encryption, contracts and recovery matter just as much.
💸 And the penalties?
The 2023 PDP draft proposes fines of up to $125,000, rising to $2 million for ignoring a regulator's formal warning. Those are draft figures, not fines anyone is paying today.
Honestly, fines aren't the main point. A business wants to know how to comply, and a citizen wants to know where to complain and that someone will act.
🇵🇰 Five questions to get us unstuck
- 1️⃣ How will the two rulebooks and their authorities work together?
- 2️⃣ Where does an ordinary citizen report misuse and get a remedy?
- 3️⃣ How will government bodies themselves be held accountable?
- 4️⃣ How can small businesses comply without a full-time legal team?
- 5️⃣ Which rules apply today, and which are still proposals?
Both tracks are genuinely good news. Pakistan needs better data sharing to improve services, and clear protection for the person behind the data. We just need both, talking to each other.
Lock the government's cupboard, yes. But also make sure the free SIM stall isn't leaving the back door open. 🔐
My wife said no. Not everyone will, and nobody should have to be that sharp while the handi is on the stove.
So here's a small deal. Citizens: before you hand over your CNIC for a freebie, ask three questions:
🔹 Why do you need it? 🔹 Who will have access? 🔹 Who will answer if something goes wrong?
And institutions: please make sure you always have a good answer to all three.
Has a caller ever known a little too much about you? And where do you see the biggest gap? I'd love to hear from business owners, CEOs, CISOs, policymakers, lawyers and privacy professionals. 👇
#DataProtection #DataGovernance #CyberSecurity #DigitalPakistan #Pakistan #Privacy #CISO
Quick answers
Frequently asked questions
What is the difference between Pakistan's DGP and PDP?
The Data Governance Policy is about how government handles the data it holds: how it is managed, protected and shared. The Personal Data Protection Bill would set rules for every organisation that collects personal data, from the SIM stall to the bank to the courier, plus a commission to oversee them.
Is the Personal Data Protection Bill law yet?
No. The May 2023 PDP Bill remains a draft. The ministry also lists the 2026 version of the Data Governance Policy as a draft.
What fines does the PDP draft propose?
The 2023 draft proposes fines of up to $125,000, rising to $2 million for ignoring a regulator's formal warning. Those are draft figures, not fines anyone is paying today.
Does all data have to stay in Pakistan?
Requirements depend on the data and the sector; one size won't fit all. Local hosting matters for sovereignty and resilience, but access, encryption, contracts and recovery matter just as much.
What should citizens ask before handing over a CNIC?
Three questions: Why do you need it? Who will have access? Who will answer if something goes wrong?
From LinkedIn
What people are saying
“Well framed, Mohammad Munaf Majeed Bhai. The vishing example shows the real gap: the caller already had her name, number and context, and only the PIN was missing. That data came from somewhere, and today nobody is clearly accountable for it. A government data policy can tighten…”
“Mohammad Munaf Majeed bhai data is already out there the real important decision to be made is to create strict cyber laws so that the perpetrators think twice before calling also another layer of identity needs to be created under NADRA which acts like a digital certificate +…”
“Also, in my opinion, the government and the citizens partner with each other to fight against data leaks, effective use of data and establish a golden record via Data Governance.”
Selected comments from the LinkedIn post, shown as excerpts. Dates are approximate.
Read all 5 comments on LinkedIn ↗