Data Privacy in Pakistan

STANDARD OPERATING PROCEDURE: Enterprise Data Privacy Compliance Framework (Islamic Republic of Pakistan)

Document ID: TR-SOP-OPS-PK-042
Effective Date: October 24, 2023
Version: 3.4
Review Cadence: Semi-Annual
Target Audience: Chief Information Security Officers (CISOs), Data Protection Officers (DPOs), Operations Architects, Legal Counsel, Cloud Infrastructure Engineers

---

1. Executive Summary & Scope

1.1 Purpose

This Standard Operating Procedure (SOP) defines the institutional mandates, operational workflows, and technical controls required to ensure absolute compliance with data privacy regulations within the Islamic Republic of Pakistan. This includes adherence to the Personal Data Protection Bill (PDPB), the Prevention of Electronic Crimes Act (PECA 2016), and sectoral guidelines issued by the Pakistan Telecommunication Authority (PTA) and the Securities and Exchange Commission of Pakistan (SECP).

1.2 Scope

This procedure applies to all operational units, cloud deployments, on-premise infrastructure, third-party vendor integrations, and data processing lifecycles managed by Template Registry and its subsidiaries operating within or handling the personal data of citizens of Pakistan. Failure to execute these protocols introduces severe operational, financial, and legal liabilities under Pakistani federal jurisdiction.

---

2. Prerequisites & Tool Requirements

2.1 Hardware & Software Access

• Enterprise Vault Systems: Air-gapped or regionally segregated AWS/Azure/GCP instances residing within Pakistani geographic boundaries (Local Cloud Region / National Data Centers).
• Data Discovery & Classification Tooling: BigID, IBM Security Guardium, or Microsoft Purview configured for Urdu and English script parsing.
• Identity and Access Management (IAM): Multi-Factor Authentication (MFA) enforcement via Azure Active Directory or Okta with conditional access restricted to approved IP ranges.
• Encryption Standards: Advanced Encryption Standard (AES) 256-bit for data-at-rest; Transport Layer Security (TLS) 1.3 for data-in-transit.

2.2 Certifications & Clearances

• Personnel executing administrative database access must hold active Certified Information Privacy Professional (CIPP/E or CIPP/A) or Certified Information Systems Auditor (CISA) certifications.
• Mandatory completion of Template Registry’s annual internal training module on Pakistani Cyber Security and Data Privacy jurisprudence.

---

3. Roles & Responsibilities (RACI Matrix Table)

---

4. Step-by-Step Operational Procedure

Phase 1: Data Discovery, Mapping, and Classification

• Initialize automated data discovery scans across all local and cloud repositories to identify Personally Identifiable Information (PII) and Sensitive Personal Data (SPD) as defined by Pakistani jurisdiction (CNIC numbers, biometric data, religious affiliations, financial records).
• Map data flow architectures, documenting ingestion points, processing nodes, third-party API sharing, and storage endpoints within a centralized Data Flow Diagram (DFD).
• Apply classification tags (Public, Internal, Confidential, Restricted-SPD) to all identified data assets using the automated metadata governance platform.
• Verify that no unmasked or unprotected National Tax Number (NTN) or Computerized National Identity Card (CNIC) numbers reside in non-production environments.

Phase 2: Lawful Basis and Consent Acquisition Architecture

• Audit all digital and physical data collection forms to ensure explicit, affirmative, and granular consent mechanisms are deployed.
• Ensure privacy notices are made available to data subjects in both English and Urdu prior to or at the exact point of data collection.
• Implement a centralized Consent Management Platform (CMP) capable of capturing, storing, and timestamping user opt-in/opt-out preferences in compliance with evidentiary standards under the Qanoon-e-Shahadat Order, 1984.
• Establish automated workflows to instantly revoke processing privileges upon a verified data subject withdrawal of consent.

Phase 3: Data Localization and Cross-Border Transfer Controls

• Verify that all core databases containing citizen PII and critical infrastructure data are provisioned strictly within data centers physically located inside the territory of Pakistan.
• Evaluate any proposed cross-border data transfers against the stringent localization mandates of the PTA and the upcoming National Commission for Personal Data Protection (NCPDP).
• Execute Standard Contractual Clauses (SCCs) and conduct a Transfer Impact Assessment (TIA) prior to routing any metadata or operational telemetry outside of Pakistan's borders.
• Confirm that cloud service providers maintain explicit data residency guarantees prohibiting unauthorized offshore replication.

Phase 4: Data Subject Rights (DSR) Fulfillment Workflow

• Establish a secure, dedicated portal for Pakistani citizens to submit Access, Correction, Deletion, and Portability requests.
• Validate the identity of the data subject requesting access by cross-referencing provided credentials securely without retaining excessive copies of physical identity documents (e.g., matching CNIC hash values).
• Process verified deletion requests ("Right to be Forgotten") across all primary, secondary, and backup storage tiers within statutory timeframes (not exceeding 30 calendar days).
• Issue an official, digitally signed compliance certificate to the data subject confirming the execution of their requested DSR action.

Phase 5: Incident Response and Regulatory Breach Notification

• Detect and isolate potential data breaches utilizing Security Information and Event Management (SIEM) behavioral anomaly alerts.
• Convene the Incident Response Team (IRT) within 1 hour of breach confirmation to assess the scope of compromised Pakistani citizen records.
• Draft a mandatory incident report containing root-cause analysis, impact metrics, and mitigation steps.
• Notify the relevant federal authorities (including the National Response Centre for Cyber Crime [NR3C] of the FIA and the PTA) within the statutory window of 72 hours post-discovery.

---

5. Quality Assurance & Verification Criteria

5.1 Audit Checklist

• Localization Verification: Quarterly network trace checks confirming zero unencrypted packets transmitting PII across international gateways.
• Consent Completeness Check: 100% audit trail validation of opt-in logs for active user profiles.
• Access Control Review: Bi-weekly validation of IAM privilege levels; immediate termination of dangling administrative credentials.

5.2 Tolerance Thresholds & Acceptance Benchmarks

• DSR Resolution SLA: $\le 30$ calendar days from initial submission. Maximum allowable operational breach: 0%.
• Encryption Compliance: 100% of PII at rest must utilize AES-256; zero tolerance for plaintext storage of sensitive credentials or biometric vectors.
• Audit Logging Retention: All system access and data modification logs must be immutable and retained for a minimum of 3 years to satisfy local evidentiary mandates.

---

6. Practical Troubleshooting Scenarios

Scenario A: Unauthorized Cross-Border Data Replication Event

• Symptom: SIEM alert indicates automated database snapshot replication streaming to an unapproved overseas cloud region (e.g., AWS us-east-1 instead of a local or compliant zone).
• Immediate Corrective Action Protocol:
  1. Execute the emergency network isolation script (./scripts/isolate_replication_node.sh) to sever the egress pipeline.
  2. Revoke the specific IAM role token responsible for initiating the cross-border snapshot.
  3. Notify the Chief Operations Architect (Julian Vance) and Legal Counsel within 30 minutes of containment.
  4. Purge the replicated data from the unauthorized overseas bucket using cryptographically secure deletion commands and pull audit logs for forensics.

Scenario B: Data Subject Requests Erasure of Data Subject to Statutory Retention Laws

• Symptom: A user submits a formal deletion request under the PDPB, but the targeted records are legally bound by the Companies Act, 2017 or tax laws of Pakistan to be retained for a 6-year minimum.
• Immediate Corrective Action Protocol:
  1. Freeze the standard deletion workflow for the specific dataset via the DSR management portal.
  2. Generate a formal Legal Exception Notice citing the conflicting statutory requirement (e.g., Section 251 of the Companies Act, 2017).
  3. Apply an isolated, cryptographic pseudonymous lock (Restricted-Legal-Hold) to the data record, rendering it inaccessible for general operations while satisfying regulatory archiving rules.
  4. Issue an official explanatory response to the data subject detailing the legal basis for the partial fulfillment delay/denial in compliance with regulatory mandates.