PECA 2016 Compliance Guide

What is PECA 2016?

The Prevention of Electronic Crimes Act, 2016 (PECA) is Pakistan's primary cybercrime legislation. It defines offenses related to electronic systems, data, and online content, and establishes investigation and prosecution mechanisms.

Key Facts

Key Sections & Penalties

Online Content (§20)

PECA §20 allows authorities to issue removal or blocking orders for online content. Platforms and service providers must comply within specified timeframes.

• Removal notice: Content must be removed within 24 hours (2025 amendment)
• Blocking order: PTA can direct ISPs to block access
• Non-compliance: Fine up to PKR 500,000 per day
• Appeal: Available within 30 days to PTA

PECA Compliance for IT Companies

As a Software Developer

• Don't build tools that facilitate unauthorized access (§3)
• Don't include data exfiltration in software (§4)
• Implement proper authentication — don't create backdoor access
• Don't build applications for harassment/stalking (§9-11)
• Include privacy-by-design principles

As a Service Provider

• Comply with content removal/blocking orders within timeframes (§20)
• Maintain traffic data and logs as required
• Report suspected criminal activity to FIA
• Don't facilitate electronic fraud (§7)
• Implement AML/KYC for payment services

As a Hosting Provider

• Know your customer (KYC) requirements
• Respond to abuse complaints within 48 hours
• Maintain server access logs (minimum 90 days)
• Cooperate with FIA investigations (§42 — investigation powers)
• Implement data retention as per PTA regulations

As an Employer

• Employees must sign IT usage policies covering PECA
• Monitor employee use of company systems (with disclosure)
• Don't access employee personal data without authorization (§4)
• Implement whistleblower mechanisms
• Train staff on PECA obligations

FIA Investigation Process

FIA Cyber Crime Wing Powers (§41-43)

• Arrest without warrant for cognizable offenses
• Search & seizure of devices, data, records
• Interception of electronic communications (with court order)
• Data preservation orders to service providers
• Access to systems for forensic investigation

If You Receive an FIA Notice

1. Don't panic — many notices are routine inquiries
2. Engage a lawyer specializing in cybercrime (contact P@SHA for referrals)
3. Preserve evidence — don't delete logs, emails, or data
4. Document everything — keep records of all communications
5. Cooperate within legal bounds — provide requested information
6. Know your rights — you have rights under PECA and the Constitution

FIA Cyber Crime Reporting

2025 Amendments

PECA was significantly amended in 2025. Key changes:

Personal Data Protection Bill (PDPB)

Pakistan's PDPB has been in draft since 2023-2024. When enacted, it will significantly impact IT companies:

Expected Key Provisions

• Consent-based processing: Explicit consent for data collection
• Data minimization: Collect only what's necessary
• Purpose limitation: Use data only for stated purposes
• Cross-border transfer restrictions: Data localization requirements
• Data Protection Officer: Mandatory for companies above threshold
• Breach notification: 72-hour notification to authority and affected persons
• Right to erasure: Individuals can request data deletion
• Data portability: Right to transfer data between providers

What IT Companies Should Do NOW

1. Start implementing data protection policies (even before enactment)
2. Appoint a Data Protection Officer
3. Map all personal data flows in your systems
4. Implement consent management in your applications
5. Review cross-border data transfers
6. Train development teams on privacy-by-design

PECA Compliance Checklist

Legal & Policy

Technical

Operational

FAQ