Content area
[...]transfers are permissible only if the receiving country has been deemed to provide an adequate level of data protection, as determined by the European Commission or if appropriate safeguards, such as standard contractual clauses (SCCs), binding corporate rules (BCRs) or other mechanisms are implemented. [...]SCCs provide a widely utilised mechanism for ensuring data protection compliance in the absence of an adequacy decision. [...]businesses transferring personal data to the US faced heightened regulatory scrutiny and compliance uncertainties. In the absence of a unified federal law, businesses operating in the US must navigate complex and often overlapping regulatory requirements, ensuring compliance with state-specific and sectoral privacy laws while addressing international data transfer obligations.
Introduction
The digitalisation of the global economy has necessitated the free flow of data across international borders. In an increasingly interconnected world, businesses, governments and individuals rely on seamless cross-border data transfers for operational efficiency, innovation and economic growth. However, these transfers pose significant risks concerning data privacy, security and regulatory compliance. This approach increases complexity and reduces security rather than enhancing accessibility, efficiency and safety on a global scale.
For this very purpose, the European Union's General Data Protection Regulation (GDPR) serves as a benchmark for data protection laws worldwide, influencing global privacy regulations and shaping the future of cross-border data governance. The GDPR's comprehensive framework has set a high standard for data privacy, prompting jurisdictions around the globe to align their legislative approaches with GDPR principles to facilitate international data transfers and maintain regulatory compatibility.
Despite its comprehensive framework, the GDPR faces challenges in enforcement, adaptability to new technologies and its application in a geopolitically fragmented world. The increasing reliance on artificial intelligence (AI), cloud computing and blockchain technology has further complicated regulatory compliance. Additionally, global data flows are affected by national security concerns, trade policies and regional data sovereignty laws, leading to a complex and often conflicting regulatory landscape.
This article critically examines the challenges, developments and future trajectory of cross-border data transfers under the GDPR and beyond. It explores the evolving legal landscape, regulatory responses, compliance mechanisms and emerging trends in data governance. Furthermore, it assesses areas where existing frameworks fall short and proposes strategic steps forward to ensure a balanced approach to data protection, economic growth and technological innovation.
The importance of cross-border data transfers
Cross-border data transfers are fundamental to international trade, financial transactions, cloud computing and digital services, enabling businesses to operate efficiently across global markets. These transfers support customer relationship management, supply chain coordination and service delivery, reinforcing the digital economy's reliance on seamless data flows for technological advancement and economic integration. However, the movement of personal data across jurisdictions introduces complex challenges related to privacy rights, data security and regulatory compliance. Governments and regulatory bodies worldwide continue to refine data protection laws to ensure that international data transfers align with legal and ethical standards, balancing economic interests with the need for robust privacy safeguards.
Overview of the GDPR's regulatory framework
The GDPR, which came into effect in May 2016, establishes a robust legal framework for the protection of personal data within the EU and beyond. It imposes stringent obligations on organisations processing the personal data of EU citizens, regardless of the organisation's geographic location. The GDPR is underpinned by key principles, including lawfulness, fairness and transparency, which mandate that data processing activities must be conducted in a lawful and ethical manner, with clear communication to data subjects regarding the collection and use of their personal data. Furthermore, the principles of purpose limitation and data minimisation ensure that personal data is collected only for specified, explicit and legitimate purposes and that the processing of such data is restricted to what is strictly necessary.
A critical aspect of the GDPR is its regulation of cross-border data transfers, as codified in Articles 44-50. These provisions ensure that personal data remains adequately protected when transferred outside the EU. Such transfers are permissible only if the receiving country has been deemed to provide an adequate level of data protection, as determined by the European Commission or if appropriate safeguards, such as standard contractual clauses (SCCs), binding corporate rules (BCRs) or other mechanisms are implemented. Where these safeguards are not in place, derogations under Article 49 may apply in specific circumstances, such as where the data subject has provided explicit consent' or where the transfer is necessary for contractual performance."
Given the extraterritorial reach of the GDPR, multinational corporations must ensure compliance with these provisions to mitigate legal and financial risks. Non-compliance can result in substantial penalties, with fines reaching up to €20m or four per cent of global annual turnover, whichever is higher." As data protection and privacy concerns continue to evolve, organisations must adopt a proactive approach to GDPR compliance, ensuring that their data processing activities align with regulatory requirements and that adequate measures are in place to safeguard personal data, particularly in the context of international transfers.
Mechanisms for cross-border data transfers under the GDPR
To ensure lawful data transfers beyond the European Economic Area (EEA), the GDPR establishes a structured framework comprising several mechanisms that facilitate compliance with its stringent data protection requirements.
First, adequacy decisions" serve as a primary mechanism, whereby the European Commission evaluates whether a third country offers a level of data protection equivalent to that of the EU. If deemed adequate, data transfers to such jurisdictions may proceed without additional safeguards. Notable examples of countries that have received adequacy status include Japan, Switzerland and the United Kingdom.
Second, SCCs provide a widely utilised mechanism for ensuring data protection compliance in the absence of an adequacy decision. These clauses, pre-approved by the European Commission, impose contractual obligations on both data exporters and importers, thereby ensuring that personal data transferred outside the EEA remains subject to GDPR-equivalent protection standards. The European Commission issued modernised SCCs in 2021, which remain a prevalent tool for businesses engaging in cross-border data transfers, particularly in jurisdictions lacking adequacy status.
For multinational corporations, BCRs offer an alternative framework, facilitating intra-group data transfers while maintaining robust data protection measures. BCRs, which require approval from the relevant data protection authorities, establish legally enforceable internal policies that align with GDPR principles, ensuring consistency in data handling practices across corporate entities operating in multiple jurisdictions.
Given the evolving landscape of international data transfers, businesses must adopta risk-based approach to compliance, ensuring that appropriate safeguards are in place to uphold data subjects' rights and maintain regulatory adherence. Furthermore, increased scrutiny by supervisory authorities underscores the necessity for organisations to implement robust data governance frameworks when engaging in cross-border data transfers.
The impact of Schrems II and data transfer challenges
The 2020 Schrems II ruling by the Court of Justice of the EU (CJEU) significantly impacted transatlantic data transfers by invalidating the EUUS Privacy Shield framework. The ruling was primarily based on concerns regarding US surveillance laws, which the Court found to be incompatible with EU data protection standards, particularly the lack of adequate safeguards for EU data subjects' rights.
As a result, businesses transferring personal data to the US faced heightened regulatory scrutiny and compliance uncertainties. While the ruling upheld the validity of SCCs as a mechanism for international data transfers, it underscored the need for organisations to assess whether the recipient country offers an equivalent level of data protection. This led to a more rigorous evaluation of SCCs, necessitating supplementary measures to mitigate risks.
Organisations were required to implement additional safeguards, such as encryption, pseudonymisation and risk assessments, to ensure continued compliance. Furthermore, BCRs, though still viable, came under greater regulatory scrutiny, compelling multinational corporations to enhance their internal governance mechanisms.
In response to the challenges posed by Schrems IT, businesses had to reassess their data transfer mechanisms, adopt enhanced due diligence procedures and incorporate contractual safeguards to uphold GDPR compliance. The ruling reinforced the importance of a risk-based approach to data protection, ensuring that cross-border data transfers align with EU legal requirements.
Global data protection regimes and their interplay with the GDPR
US: the evolving regulatory landscape
Unlike the EU's GDPR, which provides a uniform and comprehensive data protection framework, the US adopts a fragmented, sector-specific approach to privacy regulation. Currently, there is no federal data protection law equivalent to the GDPR. Instead, data privacy is governed by a patchwork of regulations tailored to specific industries and jurisdictions.
Notable examples include the California Consumer Privacy Act (CCPA) enacted in 2018, which grants California residents enhanced rights over their personal data, including the right to access, delete and opt out of data sales. Similarly, the Health Insurance Portability and Accountability Act (HIPAA) regulates the privacy and security of health-related data, imposing strict compliance obligations on healthcare providers and insurers. Additionally, the Federal Trade Commission (FTC) enforces consumer protection laws against unfair and deceptive practices, playing a key role in addressing privacy violations at a national level.
Recognising the need for a more consistent regulatory framework, US lawmakers have introduced the American Data Privacy Protection Act (ADPPA). If enacted, the ADPPA would establish baseline privacy rights applicable across all states, seeking to harmonise existing laws and enhance consumer protection. Furthermore, it aims to facilitate crossborder data transfers by aligning certain provisions with international standards, thereby improving interoperability with the GDPR and other global privacy frameworks.
In the absence of a unified federal law, businesses operating in the US must navigate complex and often overlapping regulatory requirements, ensuring compliance with state-specific and sectoral privacy laws while addressing international data transfer obligations.
UK: post-Brexit data protection
Following Brexit, the UK adopted the UK GDPR, which largely mirrors the EU GDPR, with certain modifications to reflect the UK'sindependent legal framework. The Data Protection Act 2018 continues to supplement the UK GDPR, ensuring a comprehensive data protection regime.
To facilitate seamless data transfers between the UK and EFA, the European Commission granted the UK an adequacy decision in June 2021. This decision allows personal data to flow freely from the EU to the UK without the need for additional safeguards,' such as SCCs. However, the adequacy status is subject to periodic review and can be withdrawn if the UK's data protection framework diverges significantly from EU standards.
Recent policy developments, particularly the Data (Use and Access) Act 2025, which has now received Royal Assent and become law, signal reform of the UK's data protection landscape. The UK is currently awaiting a new adequacy decision from the European Commission due to the enactment of this legislation, which may affect future data flows between the EU and UK.
Organisations operating across both jurisdictions must therefore monitor legislative changes closely and ensure continued compliance with both UK and EU data protection laws to mitigate potential risks arising from regulatory divergence.
China's data sovereignty approach
China's Personal Information Protection Law (PIPL) established a stringent regulatory framework in 2021 for personal data processing and cross-border transfers, closely aligning with global data protection standards while reinforcing China's data sovereignty policy. A key feature of the PIPL is its data localisation requirement, which mandates that certain categories of personal information, particularly critical data and large-scale personal data, must be stored within China, with government approval required for any cross-border transfers.'
Complementing the PIPL, the Cybersecurity Law (CSL) and Data Security Law (DSL) impose additional compliance obligations on businesses operating in China. The CSL focuses on network security and critical information infrastructure (CII) protection, requiring operators to implement stringent cybersecurity measures. Meanwhile, the DSL classifies data based on its importance to national security and economic interests, imposing tiered regulatory controls on its storage and transfer.
These regulatory measures present significant challenges for multinational corporations, particularly those that rely on global data flows for business operations. Companies must conduct security assessments, implement government-approved contractual safeguards or, in certain cases, undergo strict regulatory reviews before transferring data out of China.
Given the evolving regulatory landscape, businesses operating in China must adopt a robust data governance strategy, ensuring compliance with PIPL, CSL and DSL while navigating complex cross-border data transfer restrictions. Proactive risk assessments, localisation strategies and engagement with regulatory authorities are essential to mitigate legal and operational risks in this highly regulated environment.
Pakistan 's view on data protection
Pakistan is actively working towards the development of a robust data protection regime to address growing concerns around personal data privacy and security. While a comprehensive data protection law has yet to be enacted, the existing legal framework provides certain safeguards through sector-specific regulations. The Pakistan Electronic Crimes Act 2016 (the 'РЕСА'), particularly sections 3'and 4° criminalises unauthorised access to information systems and data breaches, ensuring a degree of data security. Additionally, the Prevention of Electronic Crimes Rules 2018, under Rule 6,° outlines specific obligations for data controllers and processors regarding data security and confidentiality.
Recognising the increasing significance of data privacy, the Government of Pakistan has introduced the Personal Data Protection Bill 2023 (the 'PDPB'), which aims to establish a structured regulatory framework for the processing, storage and transfer of personal data. The proposed bill includes provisions for consent-based data processing, as outlined in section 6," and data localisation requirements under Section 31,1 which may mandate storing certain categories of data within Pakistan to enhance national security and regulatory oversight. Further, section 32 of the PDPB, personal data, excluding critical personal data (as defined in the bill), can be transferred outside Pakistan after meeting explicit consent requirements from the data subject. Furthermore, there is a requirement under the PDPB to have an adequate data protection regime in the country where such personal data will be stored. Nevertheless, please note that under section 31(2) of the bill," a restriction has been placed for the processing of critical personal data in a server or digital infrastructure located outside the territorial jurisdiction of Pakistan. Therefore, there is a strict requirement to process critical personal data within Pakistan's boundaries. The bill also includes penalties for non-compliance under section 50,14 reinforcing its commitment to enforcement. However, the bill is still under review and may be subject to further refinements before enactment.
A notable consideration for multinational corporations operating in Pakistan is the proposed data localisation requirement, which aligns with global trends where nations seek greater control over domestic data flows. As cybersecurity and data privacy concerns continue to evolve, Pakistan is poised to strengthen its legal and regulatory framework to meet international standards. Until the PDPB is enacted, businesses operating in Pakistan should ensure compliance with existing and proposed legal provisions while staying prepared for forthcoming regulatory developments. The anticipated enactment of the PDPB will mark a significant step towards a structured and secure data governance framework, further enhancing Pakistan's digital economy and international trade prospects.
Emerging data protection frameworks
Several countries have introduced GDPR-inspired data protection frameworks, reflecting a global shift towards enhanced privacy rights and regulatory compliance. While these laws adopt fundamental principles from the EU's GDPR, they incorporate region-specific requirements, creating distinct compliance obligations for businesses operating across jurisdictions.
Brazil's Lei Geral de Protecao de Dados (Lei Geral de Protecao de Dados (LGPD)), enacted in 2020, establishes comprehensive data protection requirements, closely mirroring the GDPR. It introduces principles of lawfulness, transparency and accountability, granting individuals rights over their personal data, including access, correction and deletion. Unlike the GDPR, the LGPD applies to both public and private entities, with enforcement overseen by the National Data Protection Authority (Autoridade Nacional de Proteção de Dados or ANPD).
Moreover, India's Digital Personal Data Protection Act 2023 (DPDP Act), represents the country's first comprehensive data protection law, replacing previous fragmented regulations. The law mandates data processing transparency, user consent requirements and obligations for data fiduciaries (controllers). It introduces data localisation measures, requiring certain categories of data to be stored within India while allowing cross-border transfers to government-approved jurisdictions. Enforcement is managed by the Data Protection Board of India.
Similarly, in Canada the Consumer Privacy Protection Act (CPPA) outlines the process of reforming federal privacy laws that will replace the existing Personal Information Protection and Electronic Documents Act (PIPEDA). The CPPA strengthens consumer rights; enhances corporate obligations related to data security, accountability and automated decision-making transparency; and introduces heavier penalties for noncompliance. The law aligns with GDPR principles while maintaining flexibility for businesses operating in Canada's digital economy.
These emerging frameworks reflect global convergence towards stricter data protection standards, requiring businesses to adopt region-specific compliance measures. While they share common principles with the GDPR, the inclusion of localised enforcement mechanisms, data residency rules and regulatory oversight bodies creates unique challenges for multinational organisations managing cross-border data flows.
Navigating cross-border data transfers: a strategic compliance approach
In an increasingly complex regulatory landscape, organisations must adopt a proactive and structured compliance strategy to manage cross-border data transfers effectively. A comprehensive risk assessment and data mapping exercise is essential to identify international data flows, assess potential legal and security risks, and ensure compliance with key regulations such as the GDPR, PIPL and the DPDP Act. Additionally, conducting Data Protection Impact Assessments (DPIAs) will enable organisations to evaluate vulnerabilities and align their data governance practices with regulatory requirements.
To mitigate compliance risks, organisations must implement robust safeguards, including encryption and anonymisation to secure data transmission and minimise the risk of unauthorised access. Adopting updated SCCs and enforcing comprehensive data transfer agreements are essential for ensuring regulatory compliance. Additionally, maintaining active engagement with data protection authorities allows organisations to stay informed about evolving regulatory standards and adhere to adequacy and transfer requirements.
Given the increasing reliance on external data processors, it is critical to conduct due diligence on third-party vendors handling personal data, execute DPIAs to establish clear data protection obligations, and implement continuous monitoring mechanisms to assess vendor compliance with contractual and regulatory requirements. Equally important is fostering a well-informed workforce through regular training programmes that cover key data protection laws, best practices for handling personal data securely, and incident response protocols to effectively manage data breaches and regulatory investigations. By integrating these measures, organisations can enhance their data protection frameworks, strengthen regulatory compliance, and mitigate legal and operational risks associated with cross-border data transfers.
By integrating these best practices, organisations can enhance their data governance frameworks, strengthen compliance with global data protection laws, and mitigate legal and operational risks associated with cross-border data transfers.
The future of cross-border data transfers and the GDPR
Emerging trends in data governance
Emerging trends in data governance reflect the growing complexity of global data protection frameworks and the need for organisations to adapt to evolving regulatory landscapes. Data localisation policies are becoming increasingly prevalent, with governments imposing stricter requirements on storing and processing data within national borders to enhance regulatory oversight and national security. Countries such as China, India and Russia have implemented stringent localisation mandates, requiring businesses to establish a local storage infrastructure and seek regulatory approvals for cross-border data transfers.
Simultaneously, the rise of AI and machine learning has raised significant data privacy concerns, prompting the development of ethical АТ governance frameworks to address issues of algorithmic bias, transparency and accountability. Regulations such as the EU's AI Act impose risk-based obligations on АТ systems handling personal data, ensuring compliance with data protection principles. To facilitate cross-border data flows while maintaining robust privacy standards, governments and regulatory bodies are also working towards interoperable data transfer frameworks.
Initiatives such as the EU-US Data Privacy Framework (DPF) aim to establish harmonised mechanisms for secure international data exchanges, reducing legal uncertainty for businesses operating across multiple jurisdictions. As these trends continue to shape the future of data governance, organisations must develop resilient compliance strategies, integrating localisation measures, Al-specific safeguards and cross-border data transfer mechanisms to navigate the evolving regulatory environment effectively.
Potential GDPR reforms
The European Commission is evaluating updates to GDPR enforcement mechanisms to address inconsistencies in interpretation and application across EU Member States. One of the primary challenges under the current framework is the variation of enforcement approaches adopted by national DPIAs, leading to legal uncertainty for businesses operating across multiple jurisdictions. To enhance regulatory coherence, the European Commission aims to harmonise interpretations of key GDPR provisions, ensuring consistent enforcement across the EU. Additionally, efforts are being made to strengthen cooperation between DPIAs, particularly in cross-border cases, by improving decision-making procedures and dispute resolution mechanisms under the one-stop-shop system. These proposed reforms seek to streamline enforcement, reduce compliance burdens and provide greater legal clarity for businesses navigating GDPR obligations. As regulatory discussions progress, organisations should monitor potential changes to enforcement procedures and prepare for a more unified and coordinated GDPR compliance landscape.
The role of international cooperation
Multilateral initiatives play a crucial role in shaping global data governance frameworks, ensuring a balance between data sovereignty and economic integration. Organisations such as the Organisation for Economic Cooperation and Development (OECD) and the G7 are leading efforts to establish cohesive international standards for cross-border data flows. The OECD's Guidelines on Cross-Border Data Flows promote interoperability between national privacy laws, facilitating secure and seamless data transfers while upholding fundamental data protection principles. Similarly, the G7 Digital Trade Principles emphasise the importance of open digital markets, encouraging nations to adopt harmonised regulatory frameworks that enable responsible data sharing without compromising privacy and security. Strengthening international agreements in this domain is essential to mitigate regulatory fragmentation, foster trust in global digital transactions and create a predictable legal environment for businesses operating across multiple jurisdictions. As governments and regulatory bodies continue to engage in multilateral cooperation, businesses must stay informed of emerging global data protection standards to ensure compliance and competitiveness in an increasingly interconnected digital economy.
Pakistan's data protection framework: a balanced approach to privacy and economic growth
While the GDPR has set a global benchmark for data protection, its strict cross-border data transfer rules have introduced significant compliance challenges for businesses, particularly after the Schrems II ruling, which invalidated the EU-US Privacy Shield and heightened regulatory scrutiny. By contrast, Pakistan's evolving data protection framework under the proposed PDPB aims to strike a balance between privacy protections and economic growth. Unlike jurisdictions enforcing rigid data localisation mandates, Pakistan's approach is designed to facilitate secure crossborder data transfers while fostering foreign investment and digital trade. Moreover, its focus on sector-specific compliance under the PECA, along with proposed oversight through an independent data protection authority, reflects a progressive yet pragmatic regulatory stance. This makes Pakistan's framework a business-friendly alternative in the global data governance landscape, offering a more flexible and investmentdriven approach to data protection while ensuring consumer privacy and regulatory oversight.
Conclusion
However, cross-border data transfers remain a cornerstone of the digital economy, yet they present complex legal and regulatory challenges. The GDPR has set a global precedent for data protection, but evolving privacy laws, geopolitical considerations and technological advancements continue to reshape the landscape. Businesses must navigate these changes by adopting robust compliance strategies, leveraging technological safeguards and fostering international collaboration. The future of cross-border data governance lies in achieving a balance between data privacy, security and economic innovation, ensuring a harmonised approach to global data protection.
Cross-Border Data Transfers and Privacy Regulations: The Future of the GDPR and Beyond
Sahar Igbal
The digitalisation of the global economy has necessitated the free flow of data across international borders. In an increasingly interconnected world, businesses, governments and individuals rely on seamless cross-border data transfers for operational efficiency, innovation and economic growth. However, these transfers pose significant risks concerning data privacy, security and regulatory compliance. This approach increases complexity and reduces security rather than enhancing accessibility, efficiency and safety on a global scale.
For this very purpose, the European Union's General Data Protection Regulation (GDPR) serves as a benchmark for data protection laws worldwide, influencing global privacy regulations and shaping the future of cross-border data governance. The GDPR's comprehensive framework has set a high standard for data privacy, prompting jurisdictions around the globe to align their legislative approaches with GDPR principles to facilitate international data transfers and maintain regulatory compatibility.
1 "[T]he data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards.'
2 '[T]ransfer is necessary for the performance of a contract between the data subject and the controller or for the implementation of pre-contractual measures taken at the data subject's request.'
3 Art 83 of the GDPR.
4 The European Commission has the power to determine, on the basis of Art 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection.
5 Art 45 of the GDPR: 'A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.'
6 Art 40 of the PIPL:
'Critical information infrastructure operators and personal information processors whose processing of personal information reaches the number prescribed by the State cyberspace administration shall store the personal information collected and generated within the territory of the People's Republic of China within the territory of China. If it is indeed necessary to provide such information and data to overseas parties, it shall be subject to the security assessment organized by the State cyberspace administration; if laws, administrative regulations, or the provisions of the State cyberspace administration provide that the security assessment is not required, such provisions shall prevail.'
7 Unauthorised access to information system or data: 'Whoever with dishonest intention gains unauthorised access to any information system or data shall be punished with imprisonment [for] a term which may extend to three months or with fine which may extend to fifty thousand rupees or with both.'
8 Unauthorised copying or transmission of data: 'Whoever with dishonest intention and without authorisation copies or otherwise transmits or causes to be transmitted any data shall be punished with imprisonment for a term which may extend to six months or with fine which may extend to one hundred thousand rupees or with both.'
9 Unauthorized access to critical infrastructure information system or data: 'Whoever with dishonest intention gains unauthorized access to any critical infrastructure information system or data shall be punished with imprisonment which may extend to three years or with fine which may extend to one million rupees or with both.'
10 "The personal data of any kind of a data subject shall not be processed unless the data controller seeks his consent before the commencement of the processing of the data or as prescribed under the provisions of this Act.'
11 "Where personal data excluding critical personal data is required to be transferred to an entity / entities or system located beyond the borders of Pakistan, which is not under the direct control of the Government of Pakistan, it shall be ensured that the country where the data is being transferred offers at least [an] adequate personal data protection legal regime which is consistent to the protection provided under this Act and the data which is transferred shall be processed as per the provisions of this Act and, where applicable, the data subject shall give explicit consent.'
12 Framework on conditions for cross-border transfer:
'(1) Personal data other than those categorised as critical personal data may be transferred outside the territory of Pakistan after fulfilling necessary explicit consent requirements under this Act. In the absence of an adequate data protection legal regime, the Commission may allow for the transfer of personal data outside Pakistan in the following cases: (a) Binding contract /agreement; (b) Explicit consent of the data subject that does not conflict with the public interest or national security of Pakistan; (с) International cooperation is required under relevant international obligations; and (d) any further conditions specified by the Commission.
(2) The Commission shall also devise a mechanism for sharing sensitive personal data with the government of Pakistan provided that the data relates to public order or national security and the same is required within the parameters of applicable law. The data controllers or 30 data processors are also required to share a copy of the requested data in the stipulated timeframe, as prescribed by the Commission.'
13 "Critical Personal Data shall only be processed in a server(s) or digital infrastructure located within the territory of Pakistan.'
14 "When an individual fails to comply with the orders of the Commission or the court when he is required to obey, [he] shall be punished with a fine of up to 50,000 USD or an equivalent amount in Pakistani Rupees.'
Copyright International Bar Association 2025