🇵🇰 Pakistan

Citizens outside their jurisdiction are considered as data subjects :

Persons within their jurisdiction are considered as data subjects :

Legal entities are considered as data subjects :

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation :

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation :

Differentiation between how data controller and data processor are defined :

Definition of personal data that are "special" or "sensitive": biometric data :

Definition of personal data that are "special" or "sensitive": genetic data :

Definition of personal data that are "special" or "sensitive": financial data :

Definition of personal data that are "special" or "sensitive": medical/health data :

Definition of personal data that are "special" or "sensitive": criminal records data :

Definition of personal data that are "special" or "sensitive": racial/ethnic origin :

Definition of personal data that are "special" or "sensitive": political opinions :

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs :

Definition of personal data that are "special" or "sensitive": trade union membership :

Definition of personal data that are "special" or "sensitive": geo-location data :

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject :

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes :

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject :

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation :

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person :

Potential legal bases for processing personal data: the personal data is necessary for a public interest :

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party :

Provision of administrative penalties by laws : Yes

Max value of monetary penalties for violations (in euros) : 490000

Consideration of turnover rates for penalties? : Yes

Provision of criminal penalties - fines : Yes

Subject private remedies - presence of individual personal actions? :

Subject private remedies - representative actions? :

Subject private remedies - class actions? :

Subject private remedies - file complaints with Data Protection Authorities? : No

Provision of criminal penalties - imprisonment : Yes

Audit or supervise Data Processors :

Requirement of a DPIA : No

Ensuring encryption/pseudonymisation as a security control :

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : Yes

Requirement for Processor to notify controller of data breach : Yes

Requirement for Processor to notify DPA of data breach :

Requirement for Processor to notify subjects of data breach :

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls :

Right to object data use or/opt out :

Right to data portability : Yes

Right against automated decision making : Yes

Right to be informed : Yes

Consent required for processing children's data :

Right to access information : Yes

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent :

Right to restrict data processing :

Legal basis for international data transfer: approved jurisdictions : Yes

Legal basis for international data transfer: approved standard contractual clauses :

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims :

Legal basis for international data transfer: binding corporate rules :

Data localisation requirements: retention of personal data in local jurisdiction :

Data localisation requirements: tax or financial record laws : No

Legal basis for international data transfer: EU/EEA adequacy : No

Legal basis for international data transfer: Convention 108 : No

Data localisation requirements: national security laws :

Legal basis for international data transfer: APEC CBPRs : No

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction :

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation :

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) :

Consulting the supervisory authority (DPA) before data processing : No

Mandatory appointment of a DPO : No

Requirement of professional/legal qualification/expert knowledge for DPO : No

Clear DPO role specification : No

Group appointments: a group of undertakings to appoint a single DPO : No

To inform subjects via privacy notice: the existence of subject rights :

To inform subjects via privacy notice: Controller/controller's representative contact details : No

To inform subjects via privacy notice: the legal bases for processing :

To inform subjects via privacy notice: categories of personal data :

To inform subjects via privacy notice: source of data :

To inform subjects via privacy notice: recipients or category of recipients of personal data :

To inform subjects via privacy notice: information regarding data transfer to third countries and safety protocols :

To inform subjects via privacy notice: the period for which data will be stored/criteria for such timeframe :

Does the jurisdiction have an active regulation? :

Requirement to maintain records of data processing activities : Yes

Applicability: special requirements for "small" organisations : No

Cookies or other tracking technologies - consent :