Statement of Objects
The Constitution of the Islamic Republic of Pakistan guarantees...
MISCELLANEOUS: Removal of difficulties
Article 44: If any difficulty arises in giving effect to the provisions of this Act...
eBOOK ● PPDP-C8 ● KNOWLEDGE BANK
MISCELLANEOUS: Relationship of the Act with other laws
Article 43: The provisions of this Act shall have effect notwithstanding anything to the contrary contained in any other law on the subject for the time being in force...
eBOOK ● PPDP-C8 ● KNOWLEDGE BANK
MISCELLANEOUS: Power to make rules
Article 42: The Commission may with the approval of the Federal Government, by notification in the official Gazette, make rules to carry out the purposes of this Act ...
eBOOK ● PPDP-C8 ● KNOWLEDGE BANK
MISCELLANEOUS: Temporary provisions
Article 41: All data controllers and data processors shall adopt necessary security measures within [six months] from the day on which this Act comes into force....
eBOOK ● PPDP-C8 ● KNOWLEDGE BANK
COMPLAINT AND OFFENCES: Judicial Recourse
Article 40: Any person dissatisfied with the processing of his compliant at the Commission, may seek directions from the High Court...
eBOOK ● PPDP-C7 ● KNOWLEDGE BANK
COMPLAINT AND OFFENCES: Complaint
Article 39: Any aggrieved person may file a complaint before the Commission against any violation of personal data protection rights as granted under this Act...
eBOOK ● PPDP-C7 ● KNOWLEDGE BANK
COMPLAINT AND OFFENCES: Corporate liability
Article 38: A person shall be held liable for a non-compliance committed on his instructions or for his benefit or lack of required supervision by any individual...
eBOOK ● PPDP-C7 ● KNOWLEDGE BANK
COMPLAINT AND OFFENCES: Failure to comply with orders
Article 37: Anyone who fails to comply with the orders of the commission or the court when he is required to do so, shall be punished with fine upto five hundred thousand rupees...
eBOOK ● PPDP-C7 ● KNOWLEDGE BANK
COMPLAINT AND OFFENCES: Failure to adopt appropriate data security measures
Article 36: Anyone who fails to adopt the security measures that are necessary to ensure data security...
eBOOK ● PPDP-C7 ● KNOWLEDGE BANK
COMPLAINT AND OFFENCES: Unlawful processing of personal data
Article 35: Anyone who processes or cause to be processed, disseminates or discloses personal data in violation of any of the provisions of this Act...
eBOOK ● PPDP-C7 ● KNOWLEDGE BANK
THE COMMISSION: Funds
Article 34: The Federal Government shall make such a budgetary allocation to the Commission as may be required by the Commission for effective exercise of its powers and functions...
eBOOK ● PPDP-C6 ● KNOWLEDGE BANK
THE COMMISSION: Meetings of the Commission
Article 33: A meeting of the Commission shall be convened and chaired by the Chairman/Chief Data Protection Commissioner...
eBOOK ● PPDP-C6 ● KNOWLEDGE BANK
THE COMMISSION: Powers of the Commission
Article 32: The Commission shall have all powers, direct or incidental, as are necessary to undertake its functions as provided for in this Act, and the power to acquire, hold and dispose of property including the powers to...
eBOOK ● PPDP-C6 ● KNOWLEDGE BANK
THE COMMISSION: Functions of the Commission
Article 31: The Commission shall be responsible to enforce protection of personal data and shall entertain complaints under this Act...
eBOOK ● PPDP-C6 ● KNOWLEDGE BANK
THE COMMISSION: Commission for Personal Data Protection
Article 30: Within six months of coming into force of this Act, the Federal Government shall establish the National Commission for Personal Data Protection (NCPDP)...
eBOOK ● PPDP-C6 ● KNOWLEDGE BANK
EXEMPTIONS: Power to make further exemptions
Article 29: The Federal Government may, upon the recommendation of the Commission, by order published in the official Gazette exempt the application of any provision of this Act...
eBOOK ● PPDP-C5 ● KNOWLEDGE BANK
EXEMPTIONS: Exemption
Article 28: There shall be exempted from the provisions of this Act personal data processed by an individual only for the purposes of that individual’s personal...
eBOOK ● PPDP-C5 ● KNOWLEDGE BANK
EXEMPTIONS: Repeated collection of personal data in same circumstances
Article 27: Where a data controller has complied with the requirements of this Act...
eBOOK ● PPDP-C5 ● KNOWLEDGE BANK
PROCESSING OF SENSITIVE PERSONAL DATA: Processing of sensitive personal data
Article 26: Subject to subsection (2) of section 5, a data controller shall not process any sensitive personal data of a data subject except in accordance with the following conditions...
eBOOK ● PPDP-C4 ● KNOWLEDGE BANK
RIGHTS OF DATA SUBJECTS: Right to erasure
Article 25: The data subject shall have the right to obtain from the data controller the erasure of personal data...
eBOOK ● PPDP-C3 ● KNOWLEDGE BANK
RIGHTS OF DATA SUBJECTS: Rights of foreign data subjects.
Article 24: Foreign data subject shall have all his rights...
eBOOK ● PPDP-C3 ● KNOWLEDGE BANK
RIGHTS OF DATA SUBJECTS: Right to prevent processing likely to cause damage or distress
Article 23: a data subject may, at any time by notice in writing to a data controller...
eBOOK ● PPDP-C3 ● KNOWLEDGE BANK
RIGHTS OF DATA SUBJECTS: Extent of disclosure of personal data
Article 22: Notwithstanding section 7, personal data of a data subject may be disclosed by a data controller for any purpose...
eBOOK ● PPDP-C3 ● KNOWLEDGE BANK
RIGHTS OF DATA SUBJECTS: Withdrawal of consent to process personal data
Article 21: A data subject may by notice in writing withdraw his consent to the processing of personal data in respect of which he is the data subject...
eBOOK ● PPDP-C3 ● KNOWLEDGE BANK
RIGHTS OF DATA SUBJECTS: Notification of refusal to comply with data correction request
Article 20: Where a data controller who pursuant to section 19 refuses to comply with a data correction...
eBOOK ● PPDP-C3 ● KNOWLEDGE BANK
RIGHTS OF DATA SUBJECTS: Circumstances where data controller may refuse to comply with data correction request
Article 19: A data controller may refuse to comply with a data correction request under section 17 if...
eBOOK ● PPDP-C3 ● KNOWLEDGE BANK
RIGHTS OF DATA SUBJECTS: Compliance with data correction request
Article 18: Subject to subsections (2), (3) and (5) and section 19, where a data controller is satisfied that the personal data...
eBOOK ● PPDP-C3 ● KNOWLEDGE BANK
RIGHTS OF DATA SUBJECTS: Right to correct personal data.
Article 17: a copy of the personal data has been supplied by the data controller in compliance with the data access request...
eBOOK ● PPDP-C3 ● KNOWLEDGE BANK
RIGHTS OF DATA SUBJECTS: Circumstances where data controller may refuse to comply with data access request
Article 16: A data controller may refuse to comply with a data access request under section 12 if...
eBOOK ● PPDP-C3 ● KNOWLEDGE BANK
RIGHTS OF DATA SUBJECTS: Compliance with data access request
Article 15: Subject to sub-section (2) and section 14, a data controller shall comply with a data access request under section 12 not later than [thirt] days from the date of receipt of the data access request...
eBOOK ● PPDP-C3 ● KNOWLEDGE BANK
RIGHTS OF DATA SUBJECTS: Right of access to personal data
Article 14: An individual is entitled to be informed by a data controller whether personal data of which that individual is the data subject is being processed by or on behalf of the data controller...
eBOOK ● PPDP-C3 ● KNOWLEDGE BANK
PROCESSING OF PERSONAL DATA AND OBLIGATIOINS OF THE DATA CONTROLLER AND DATA PROCESSORS: Personal data breach notification
Article 13: In the event of a personal data breach, data controller shall without undue delay and where reasonably possible...
eBOOK ● PPDP-C2 ● KNOWLEDGE BANK
PROCESSING OF PERSONAL DATA AND OBLIGATIOINS OF THE DATA CONTROLLER AND DATA PROCESSORS: Prohibition on transfer of personal data
Article 12: Personal data shall not be transferred to any unauthorized person or system...
eBOOK ● PPDP-C2 ● KNOWLEDGE BANK
PROCESSING OF PERSONAL DATA AND OBLIGATIOINS OF THE DATA CONTROLLER AND DATA PROCESSORS: Record to be kept by data controller
Article 11: A data controller shall keep and maintain a record of any application, notice, request or any other information relating to personal data that has been or is being processed by him...
eBOOK ● PPDP-C2 ● KNOWLEDGE BANK
PROCESSING OF PERSONAL DATA AND OBLIGATIOINS OF THE DATA CONTROLLER AND DATA PROCESSORS: Data integrity and access to data
Article 10: A data controller shall take reasonable steps to ensure that the personal data is accurate, complete, not misleading and kept up-to-date by having regard to the purpose...
eBOOK ● PPDP-C2 ● KNOWLEDGE BANK
PROCESSING OF PERSONAL DATA AND OBLIGATIOINS OF THE DATA CONTROLLER AND DATA PROCESSORS: Data Retention requirements
Article 9: The personal data processed for any purpose shall not be kept longer than is necessary for the fulfilment of that purpose...
eBOOK ● PPDP-C2 ● KNOWLEDGE BANK
PROCESSING OF PERSONAL DATA AND OBLIGATIOINS OF THE DATA CONTROLLER AND DATA PROCESSORS: Security requirement
Article 8: The Commission shall prescribe standards to protect personal data from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction...
eBOOK ● PPDP-C2 ● KNOWLEDGE BANK
PROCESSING OF PERSONAL DATA AND OBLIGATIOINS OF THE DATA CONTROLLER AND DATA PROCESSORS: Non-disclosure of personal data
Article 7: Subject to section 20, no personal data shall, without the consent of the data subject, be disclosed...
eBOOK ● PPDP-C2 ● KNOWLEDGE BANK
PROCESSING OF PERSONAL DATA AND OBLIGATIOINS OF THE DATA CONTROLLER AND DATA PROCESSORS: Notice to the data subject
Article 6: A data controller shall by written notice inform a data subject...
eBOOK ● PPDP-C2 ● KNOWLEDGE BANK
PROCESSING OF PERSONAL DATA AND OBLIGATIOINS OF THE DATA CONTROLLER AND DATA PROCESSORS: General requirements for personal data processing
Article 5: A data controller shall not process personal data including sensitive personal dataof a data subject unless the data subject has given his consent to the processing of the personal data...
eBOOK ● PPDP-C2 ● KNOWLEDGE BANK
PROCESSING OF PERSONAL DATA AND OBLIGATIOINS OF THE DATA CONTROLLER AND DATA PROCESSORS: Protection of personal data
Article 4: The processing of personal data shall only be done in compliance with the provisions of this Act....
eBOOK ● PPDP-C2 ● KNOWLEDGE BANK
PRELIMINARY: Short title, extent and commencement
Article 1: This Act may be called the Personal Data Protection Act, 2017...
eBOOK ● PPDP-C1 ● KNOWLEDGE BANK
PRELIMINARY: Scope and applicability
Article 3: This Act applies to...
eBOOK ● PPDP-C1 ● KNOWLEDGE BANK
PRELIMINARY: Definitions
Article 2: In this Act, unless there is anything repugnant in the subject or context,...
