Data Governance Policy Pakistan

DATA GOVERNANCE POLICY PAKISTAN

1. Document Preamble & Recitals

THIS DATA GOVERNANCE POLICY (hereinafter the "Agreement" or "Policy") is entered into and made effective as of this _____ day of _________, 20 (the "Effective Date"), by and between:

[Company Name], a corporation/company duly organized and existing under the laws of [Jurisdiction/Islamic Republic of Pakistan], having its registered office at [Company Address] (hereinafter referred to as the "Data Controller" or "First Party", which expression shall unless repugnant to the context include its successors-in-interest, assigns, and legal representatives);

AND

[Vendor/Partner/Client Name], a corporation/company duly organized and existing under the laws of [Jurisdiction], having its registered office at [Address] (hereinafter referred to as the "Data Processor" or "Second Party", which expression shall unless repugnant to the context include its successors-in-interest, assigns, and legal representatives).

RECITALS:

WHEREAS, the First Party collects, processes, stores, and transfers Personal Data and Sensitive Personal Data in connection with its commercial operations and is subject to the evolving data privacy and cybersecurity legislative framework of the Islamic Republic of Pakistan, including the Prevention of Electronic Crimes Act, 2016 (PECA), the Personal Data Protection Bill (and any statutory enactments or regulations succeeding the same), and applicable sector-specific guidelines issued by the Securities and Exchange Commission of Pakistan (SECP), the State Bank of Pakistan (SBP), and the Pakistan Telecommunication Authority (PTA);

WHEREAS, the Second Party provides certain services to the First Party, which require the processing of, or access to, Data Assets belonging to or controlled by the First Party;

WHEREAS, the Parties intend to establish a comprehensive data governance framework to ensure the lawful, secure, and transparent processing, localization, protection, and management of all Data Assets in strict compliance with Pakistani laws and international data protection standards;

NOW, THEREFORE, in consideration of the mutual covenants, conditions, and undertakings contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

---

2. Operational Definitions

For the purposes of this Agreement, the following terms shall have the meanings ascribed to them below. Any capitalized term not expressly defined herein shall bear its standard meaning under applicable Pakistani law:

1. "Applicable Law" means all federal, provincial, and local laws, statutes, acts, ordinances, regulations, rules, bylaws, statutory instruments, and judicial or administrative orders of the Islamic Republic of Pakistan, including but not limited to the Prevention of Electronic Crimes Act, 2016, and any subsequent data protection legislation enacted by the Parliament of Pakistan.
2. "Data Asset" means any electronic or physical record, database, file, document, or compilation of information, including Personal Data, processed, stored, or transmitted by either Party in connection with the performance of this Agreement.
3. "Data Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.
4. "Data Processor" means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Data Controller.
5. "Data Subject" means an identified or identifiable living natural person to whom the Personal Data relates.
6. "Personal Data" means any information relating directly or indirectly to a Data Subject, who can be identified from such information, including but not limited to name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
7. "Processing" means any operation or set of operations which is performed on Data Assets, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
8. "Sensitive Personal Data" means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation, as well as criminal conviction data and national identity numbers (e.g., Computerized National Identity Card - CNIC numbers).
9. "Security Incident" means any accidental, unauthorized, or unlawful acquisition, destruction, loss, alteration, disclosure of, or access to Data Assets processed under this Agreement.
10. "Cross-Border Transfer" means the transfer of Personal Data or Sensitive Personal Data from the territory of the Islamic Republic of Pakistan to any other country, jurisdiction, or international organization.

---

3. Substantive Terms & Obligations

3.1 Lawful Basis and Purpose Limitation

The Data Processor shall process Personal Data and Sensitive Personal Data strictly in accordance with the documented instructions of the Data Controller and Applicable Law in Pakistan. The Data Processor shall not process Data Assets for any purpose other than those explicitly authorized under this Agreement or subsequent written instructions executed by the authorized representatives of the Parties.

3.2 Data Localization and Cross-Border Transfer Restrictions

1. Localization Mandate: The Data Processor acknowledges and agrees that all critical Personal Data, Sensitive Personal Data, and governmental, financial, or telecommunication Data Assets generated or processed within the territorial jurisdiction of the Islamic Republic of Pakistan shall be stored, hosted, and processed on physical servers and infrastructure located exclusively within the territorial boundaries of Pakistan, unless explicit written exemption is granted by the competent regulatory authority of Pakistan and the Data Controller.
2. Transfer Restrictions: No Cross-Border Transfer of Data Assets shall occur unless the Data Processor ensures an adequate level of data protection equivalent to that guaranteed under Pakistani law, and obtains prior written authorization from the Data Controller and, where mandated by Applicable Law, the relevant Pakistani regulatory authority.

3.3 Security Measures and Performance Metrics

1. Technical and Organizational Safeguards: The Data Processor shall implement and maintain appropriate technical, physical, and organizational security measures to protect Data Assets against unauthorized or unlawful processing, accidental loss, destruction, damage, alteration, or disclosure. Such measures shall include, at a minimum, industry-standard encryption (AES-256 for data at rest, TLS 1.3 for data in transit), robust access controls, multi-factor authentication, and regular vulnerability assessments.
2. Performance Metrics: The Data Processor shall maintain a system uptime of not less than 99.9% for all data storage and processing infrastructure and shall ensure that Security Incident detection mechanisms operate on a continuous 24/7/365 basis.

3.4 Data Subject Rights

The Data Processor shall promptly assist the Data Controller—at no additional cost—by appropriate technical and organizational measures, in fulfilling the Data Controller’s obligation to respond to requests by Data Subjects exercising their rights under Applicable Law (including rights of access, rectification, erasure, restriction of processing, data portability, and objection). The Data Processor shall forward any request received directly from a Data Subject to the Data Controller within forty-eight (48) hours of receipt.

3.5 Mandatory Breach Notification

In the event of an actual or suspected Security Incident affecting Data Assets, the Data Processor shall notify the Data Controller in writing via email and telephone within twenty-four (24) hours of becoming aware of the incident. The notification shall contain, at a minimum:

1. A description of the nature of the Security Incident, including categories and approximate number of Data Subjects concerned;
2. The name and contact details of the Data Processor’s Data Protection Officer or other contact point;
3. The likely consequences of the Security Incident; and
4. The measures taken or proposed to be taken by the Data Processor to address the Security Incident, including measures to mitigate its possible adverse effects.

3.6 Audit Rights and Compliance Verification

The Data Controller (or an independent external auditor mandated by the Data Controller) shall have the right, upon providing ten (10) business days' prior written notice, to audit, inspect, and review the Data Processor’s data governance practices, facilities, systems, books, and records to verify compliance with the terms of this Agreement and Applicable Law. The Data Processor shall fully cooperate with such audits and promptly remediate any non-compliance findings at its sole expense.

---

4. Default, Termination, and Remedies

4.1 Classification of Breaches

The occurrence of any of the following events shall constitute a material breach of this Agreement:

1. Failure of the Data Processor to implement or maintain the security measures stipulated in Section 3.3;
2. Unauthorized Cross-Border Transfer or violation of the data localization mandates set forth in Section 3.2;
3. Failure to notify the Data Controller of a Security Incident within the timeframe specified in Section 3.5; or
4. Any intentional, reckless, or grossly negligent misuse, disclosure, or commercialization of Data Assets by the Data Processor, its employees, subcontractors, or agents.

4.2 Notice and Cure Period

Upon the occurrence of a material breach, the non-defaulting Party shall provide written notice of default to the defaulting Party, detailing the specific grounds of the breach. The defaulting Party shall have a cure period of thirty (30) business days from the receipt of such notice to remedy the breach to the reasonable satisfaction of the non-defaulting Party, provided that Security Incidents or data breaches involving unlawful disclosure of Sensitive Personal Data shall be remedied immediately, and where remediation is impossible, notice shall trigger immediate termination rights.

4.3 Legal Recourse and Remedies

If the defaulting Party fails to cure the material breach within the stipulated thirty (30) business day cure period, the non-defaulting Party may, by written notice, terminate this Agreement with immediate effect, without prejudice to any other rights or remedies available at law or in equity, including:

1. Injunctive Relief: Seeking immediate injunctive relief from a court of competent jurisdiction to restrain any ongoing or threatened breach of this Policy;
2. Damages: Claiming full compensation for direct, indirect, consequential, and punitive damages, including statutory fines, regulatory penalties imposed by Pakistani authorities, and legal fees resulting from the breach; and
3. Data Return and Destruction: Demanding the immediate return of all Data Assets to the Data Controller in a structured, commonly used, and machine-readable format, followed by the secure cryptographic erasure and destruction of all residual copies residing on the Data Processor's systems, backed by a sworn certificate of destruction executed by an authorized corporate officer within five (5) business days.

---

5. Boilerplate Legal Provisions

5.1 Severability

If any provision of this Agreement is held to be invalid, illegal, or unenforceable by a court or regulatory authority of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid and enforceable. If modification is not possible, the provision shall be deemed severed from this Agreement, and the remaining provisions shall continue in full force and effect.

5.2 Entire Agreement

This Agreement, together with any referenced schedules and annexes, constitutes the entire understanding and agreement between the Parties with respect to the subject matter hereof and supersedes all prior negotiations, representations, proposals, understandings, or agreements, whether written or oral, between the Parties.

5.3 Force Majeure

Neither Party shall be held liable for any failure or delay in performing its obligations under this Agreement if such failure or delay arises from causes beyond its reasonable control, including acts of God, flood, fire, earthquake, explosion, war, terrorism, invasion, riot, or nationwide telecommunication or electrical grid failure (each a "Force Majeure Event"). Economic hardship, labor strikes internal to the defaulting Party, or software bugs shall not constitute a Force Majeure Event. The affected Party shall notify the other Party in writing within forty-eight (48) hours of the onset of the Force Majeure Event. If a Force Majeure Event continues for more than thirty (30) consecutive days, either Party may terminate this Agreement immediately upon written notice.

5.4 Governing Law

This Agreement shall be governed by, construed, and enforced in accordance with the substantive laws of the Islamic Republic of Pakistan, without regard to its conflict of laws principles.

5.5 Dispute Resolution and Jurisdiction

1. Amicable Negotiation: In the event of any dispute, controversy, or claim arising out of or relating to this Agreement, including its formation, breach, termination, or validity, the authorized senior management representatives of the Parties shall first attempt to resolve the dispute amicably through good-faith negotiations within fifteen (15) business days of written notice of the dispute by one Party to the other.
2. Arbitration: If the dispute cannot be resolved through amicable negotiation, it shall be referred to and finally resolved by binding arbitration in accordance with the Arbitration Act, 1940 (or any statutory modification or re-enactment thereof for the time being in force). The arbitral tribunal shall consist of a sole arbitrator appointed by mutual agreement of the Parties, or in the absence of agreement, by the High Court of [Province, e.g., Sindh/Punjab], Pakistan. The seat and place of arbitration shall be [City, e.g., Karachi / Lahore], Pakistan, and the proceedings shall be conducted in the English language.
3. Court Jurisdiction: Subject to the arbitration clause above, the Parties irrevocably submit to the exclusive jurisdiction of the courts of [City, e.g., Islamabad / Lahore / Karachi], Pakistan, for any legal action, application, or enforcement of an arbitral award arising out of this Agreement.

---

6. Formal Execution Block

IN WITNESS WHEREOF, the Parties hereto have caused this Data Governance Policy to be duly executed by their respective duly authorized officers, representatives, or agents as of the Effective Date first written above.

FOR AND ON BEHALF OF THE DATA CONTROLLER:

[Company Name]

---

Signature of Authorized Signatory

Name: ____________________________
Title: _____________________________
Date: _____________________________

Witness 1:
Signature: _________________________
Name: ____________________________
CNIC / Passport: ___________________

---

FOR AND ON BEHALF OF THE DATA PROCESSOR:

[Vendor/Partner/Client Name]

---

Signature of Authorized Signatory

Name: ____________________________
Title: _____________________________
Date: _____________________________

Witness 2:
Signature: _________________________
Name: ____________________________
CNIC / Passport: ___________________