ISLAMABAD: The Pakistan Software Houses Association (P@SHA) has identified key gaps in the draft National Data Governance Policy 2026, warning that unclear rules on data ownership, localisation and enforcement could create challenges for Pakistan’s technology sector.

In a policy briefing titled “Analysis of Pakistan’s Data Governance Policy,” P@SHA said the proposed framework could play an important role in preparing Pakistan for artificial intelligence and strengthening its broader digital ecosystem.

The Ministry of IT and Telecommunication released the draft National Data Governance Policy in July 2026. The proposed framework seeks to establish a unified system for the collection, protection and sharing of government data among public institutions.

Under the draft, government data would be treated as a key national asset, while state institutions would act as custodians and protectors rather than owners of citizens’ data.

P@SHA, however, highlighted the absence of a clear distinction between public and private data as a significant gap in the draft.

The association also warned that data-localisation requirements and restrictions on accessing data from abroad could create operational difficulties for IT exporters whose businesses depend on international data flows.

The draft proposes that government agencies rely on core data registries instead of repeatedly collecting the same information from citizens. It also calls for a central platform to facilitate data exchange among government institutions.

Another major proposal is to designate the Pakistan Digital Authority as the central data regulator, with powers to oversee and enforce the policy.

P@SHA cautioned that allowing the government to license and price non-personal public data could conflict with its proposed role as a custodian of data.

The association also raised concerns over the lack of effective financial penalties for non-compliance, saying reliance solely on audits and monitoring could weaken enforcement.

P@SHA said stronger safeguards, clearer definitions and effective enforcement mechanisms would be needed if the proposed policy is to support innovation while protecting citizens’ data and maintaining Pakistan’s competitiveness in the global digital economy.