Data Protection Policy Pakistan

DATA PROTECTION POLICY PAKISTAN

THIS DATA PROTECTION POLICY (the "Agreement") is entered into as of this [Day] day of [Month], [Year] (the "Effective Date"), by and between:

[Company Name], a company incorporated under the laws of Pakistan, having its registered office at [Registered Address] (hereinafter referred to as the "Data Controller");

AND

[Counterparty Name/Service Provider], a company incorporated under the laws of [Jurisdiction], having its registered office at [Address] (hereinafter referred to as the "Data Processor").

RECITALS WHEREAS, the Data Controller possesses Personal Data of data subjects located within Pakistan; WHEREAS, the Data Processor has been engaged to provide services involving the processing of said Personal Data; WHEREAS, both Parties intend to comply with the applicable data protection framework, including but not limited to the Prevention of Electronic Crimes Act, 2016 (PECA) and the evolving standards set forth under the Personal Data Protection Bill of Pakistan; NOW, THEREFORE, the Parties agree as follows:

1. OPERATIONAL DEFINITIONS

1.1 "Personal Data" means any information relating to an identified or identifiable natural person, including identifiers such as name, identification number, location data, or factors specific to the physical, physiological, or social identity of that person. 1.2 "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, or destruction. 1.3 "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed. 1.4 "Applicable Law" means the laws of the Islamic Republic of Pakistan, including any regulations, guidelines, or directives issued by the Ministry of IT and Telecommunication or the relevant regulatory authority.

2. SUBSTANTIVE TERMS AND OBLIGATIONS

2.1 Lawful Processing: The Data Processor shall process Personal Data only on documented instructions from the Data Controller and for the specific purposes set out in the Service Agreement. 2.2 Security Measures: The Data Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, pseudonymization, and the ability to ensure ongoing confidentiality and integrity of processing systems. 2.3 Personnel Confidentiality: The Data Processor shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. 2.4 Sub-processing: The Data Processor shall not engage another processor without prior specific or general written authorization of the Data Controller. 2.5 Data Subject Rights: The Data Processor shall assist the Data Controller by appropriate technical and organizational measures for the fulfillment of the Data Controller’s obligation to respond to requests for exercising the data subject’s rights.

3. DEFAULT, TERMINATION, AND REMEDIES

3.1 Breach Classification: Any unauthorized disclosure, failure to implement requisite security measures, or processing outside the scope of instructions shall constitute a "Material Breach." 3.2 Cure Period: In the event of a Material Breach, the non-breaching party shall provide written notice specifying the breach. The breaching party shall have a period of 30 (thirty) business days to cure said breach. 3.3 Termination: If the breach remains uncured after the 30-day period, the Data Controller may terminate this Agreement immediately upon written notice. 3.4 Remedies: The breaching party shall be liable for all direct damages, regulatory fines, and legal costs incurred by the non-breaching party resulting from the breach, capped at [Dollar Amount] or as otherwise agreed in the underlying Service Agreement.

4. BOILERPLATE LEGAL PROVISIONS

4.1 Severability: If any provision of this Agreement is held to be invalid or unenforceable, such provision shall be struck and the remaining provisions shall be enforced. 4.2 Entire Agreement: This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements. 4.3 Force Majeure: Neither party shall be liable for failure to perform its obligations if such failure results from a cause beyond their reasonable control, including acts of God, war, or government regulation. 4.4 Governing Law: This Agreement shall be governed by and construed in accordance with the laws of the Islamic Republic of Pakistan. 4.5 Dispute Resolution: Any dispute arising out of or in connection with this Agreement shall be referred to and finally resolved by arbitration in [City, Pakistan] in accordance with the Arbitration Act, 1940.

5. FORMAL EXECUTION BLOCK

IN WITNESS WHEREOF, the parties have caused this Agreement to be executed by their duly authorized representatives as of the Effective Date.

FOR: [Company Name] (Data Controller)

Signature: __________________________ Name: [Signatory Name] Title: [Title] Date: __________________________

FOR: [Counterparty Name] (Data Processor)

Signature: __________________________ Name: [Signatory Name] Title: [Title] Date: __________________________