Key Data & Rates

Pakistan Data Center & Cloud Infrastructure Overview

Major data centers and cloud infrastructure providers operating in Pakistan Verified May 3, 2026

Provider/Facility	Location	Type	Tier	Key Details	Reference
PM Cloud Startups	National (Ignite)	Government Cloud	N/A	Cloud startup program launched 2026	IGNITE PM Cloud Startups Program
NADRA Data Centers	Islamabad + Regional	Government	Tier-III+	Serves 220M+ citizens biometric data	NADRA Data Centers
Supernet Data Center	Karachi	Commercial	Tier-III	Major carrier-neutral facility	PTA Data Center Guidelines
Cyber Internet Services	Karachi	Commercial	Tier-II+	Largest ISP data center	PTA Data Center Guidelines
PTA Critical Telecom Data	Nationwide	Regulatory	N/A	Critical Telecom Data Regulations (Nov 2020)	PTA Critical Telecom Data Regula...
SBP Banking Infrastructure	Karachi/Islamabad	Financial	Tier-III+	SBP Cyber Shield launched Mar 2026	SBP Cyber Shield & Banking Infra...
Government Cloud (Federal)	Islamabad	Government	Tier-II+	Digital Nation Pakistan initiative	MoIT&T Government Cloud Initiative
NLC Data Center	Islamabad	Government	N/A	National Logistics Corporation	NTC National Data Center

Source: PTA, Ignite/NITB, industry reports. Pakistan has 3+ major data centers with 1,000+ servers.

Source: PTA Cloud & Data Center Infrastructure Guidelines

Data Localization & Cloud Regulations

Data residency and localization requirements applicable in Pakistan Verified May 3, 2026

Regulation/Standard	Authority	Data Type	Requirement	Status	Reference
PECA 2016	MoITT	Electronic evidence	Data preservation orders	Active	PECA 2016 – Electronic Evidence
Critical Telecom Data Regulations	PTA	Telecom subscriber data	Must be stored in Pakistan	Active (Nov 2020)	PTA Critical Telecom Data Regula...
Cyber Security Strategy 2023-2028	PTA/MoITT	Critical infrastructure	Security framework compliance	Active	MoIT&T Cyber Security Strategy 2...
SBP Cyber Shield	SBP	Banking/financial data	Banking data protection	Active (Mar 2026)	SBP Cyber Shield Banking Data Pr...
5G Security Guidelines	PTA	Telecom network data	Security compliance	Active (Feb 2026)	PTA 5G Security Guidelines 2026
Aiming for: DPA Pakistan	MoITT	Personal data	Data localization (pending)	Draft stage - Digital Nation Bill	Digital Nation Pakistan Bill 202...
NADRA Act/Regulations	NADRA	Biometric/citizen data	Must remain in Pakistan	Active	NADRA Act – Biometric Data Prote...
National Cyber Security Framework	NCERT	All critical data	Framework compliance	Published	NCERT National Cyber Security Fr...

Source: PTA, SBP, MoITT, NCERT. No comprehensive data localization law yet - Digital Nation Pakistan Bill expected to address this.

Source: PECA 2016 & PTA Data Localization/Cloud Regulations

Details & Regulations

AUDIT CERTIFIED — MAY 2026

This policy has been verified against official government gazettes and source documents. View Audit Log

100% Verified

Cloud & Data Center Regulations — Complete IT Company Guide

Pakistan's cloud and data center sector is growing but regulatory frameworks are still evolving. Key considerations: sector-specific data localization, SBP cloud outsourcing framework, and recommended certifications.

Data Center RequirementsSOURCE VERIFIED

Requirement	Details	Authority
PTA Registration	Required if providing ISP/hosting services to end-users	PTA
SECP Registration	Company incorporation required for data center business	SECP — Companies Act 2017
No Standalone License	No explicit "data center license" exists currently — company registration suffices	✓
Building Codes	Fire safety, electrical, structural compliance per local building authority	Local authorities
Environmental	UPS, generators, cooling systems required for Tier II+ classification	Best practice
Physical Security	Access control, CCTV, security personnel, 24/7 monitoring	Best practice
PSEB Registration	Recommended for 0.25% WHT on export remittances	PSEB

SBP Cloud Outsourcing FrameworkSOURCE VERIFIED

Per BPRD C1/2025 (Consolidated Customer Onboarding Framework) and PSD C4/2025 (Tech Risk Framework), SBP has specific requirements for cloud outsourcing by regulated entities:

Requirement	Details	Impact on IT Companies
Data Localization	All banking/financial data MUST remain in Pakistan	IT companies serving banks must host locally — no AWS/GCP for bank data
Cloud Outsourcing Approval	7-day advance written notice to SBP for material outsourcing; SBP approval for offshore	Must notify SBP before moving bank services to cloud
Third-Party Risk Assessment	Banks must conduct risk assessments of IT vendors annually	IT vendors need SOC 2 / ISO 27001 certifications
Disaster Recovery	Defined RTO/RPO; annual BCP testing required	IT vendors must demonstrate DR capabilities
Encryption	AES-256 minimum for data at rest and in transit	Must implement encryption for all bank client data
Audit Rights	SBP and bank auditors have right to inspect cloud infrastructure	Must provide audit access and compliance reports

Critical: IT companies providing cloud services to banks/EMIs must comply with SBP cloud outsourcing framework. Offshore cloud hosting of banking data is prohibited.

Cloud Service Options for IT CompaniesSOURCE VERIFIED

Cloud Provider	Region	Pakistan Data Center?	SBP Compliant?	Notes
AWS	Multiple	No (Bahrain/Mumbai closest)	No — for bank data	OK for non-banking IT exports
Google Cloud	Multiple	No (Mumbai closest)	No — for bank data	OK for non-banking IT exports
Azure	Multiple	No (UAE closest)	No — for bank data	OK for non-banking IT exports
Storich (Local)	Pakistan	Yes — Islamabad	Potentially yes	Pakistan-based data center
RapidCompute (Local)	Pakistan	Yes — Karachi	Potentially yes	Local IaaS provider
NTC Data Center	Pakistan	Yes — Islamabad	Yes — government cloud	For government projects
On-Premises	Own facility	Yes	Yes — if compliant	Full control, full responsibility

Pro tip: For IT exports (non-banking), AWS/GCP/Azure are fine. For banking/fintech clients, you MUST host in Pakistan. Hybrid architectures (local for bank data, cloud for non-bank data) are becoming common.

Government Cloud (G-Cloud)SOURCE VERIFIED

Status: Draft Policy Under Development by MoITT/NITB

Proposed government-wide cloud infrastructure under NTC
Data sovereignty requirements for government workloads — all data must stay in Pakistan
Multi-cloud strategy being considered (NTC primary, approved private clouds secondary)
Security tiers for different data classifications (public, internal, confidential, restricted)

Current Practice

Government departments use NTC data centers (primary) — ntc.net.pk
Approved private cloud solutions for specific use cases
Limited commercial cloud with strict security requirements
NTISB security guidelines mandatory for government cloud

Source: NTC | MoITT

Data Localization Requirements by SectorSOURCE VERIFIED

Sector	Requirement	Authority	Source
Banking/Financial	Mandatory — all financial data in Pakistan	SBP	BPRD Cloud Guidelines
Telecom	Mandatory — CDRs, subscriber data in Pakistan	PTA	PTA Registration Rules 2000
Government	Mandatory — all government data in Pakistan	MoITT/NITB	G-Cloud Policy
Healthcare	Recommended — patient records in Pakistan	Provincial Depts	Draft Digital Health Policy
E-commerce	Partial — payment data in Pakistan	SBP/FBR	E-Payment Guidelines
General IT/SaaS	No strict requirement (may change with PDPB)	—	—
After PDPB Enactment	Data Transfer Impact Assessments (DTIAs) required for cross-border	PDPB (draft)	Pending

Recommended CertificationsSOURCE VERIFIED

ISO 27001
Information Security
PKR 500K-2M (estimated range — verify with provider)

ISO 22301
Business Continuity
PKR 300K-1M (estimated range — verify with provider)

SOC 2 Type II
International clients
USD 15K-50K (estimated range — verify with provider)

Tier Rating
Uptime Institute
USD 50K-150K (estimated range — verify with provider)

Cloud Deployment ChecklistSOURCE VERIFIED

Before Deploying to Cloud:

Check if your data needs to stay in Pakistan (banking, government, telecom = YES)
If serving banks/EMIs: ensure cloud provider has Pakistan data center OR use on-premises
If serving government: use NTC data center or approved government cloud
Obtain PSEB registration for 0.25% WHT rate on exports
Implement SBP Tech Risk Framework if serving fintech
Get ISO 27001 or SOC 2 for competitive advantage with banking clients
Set up VPN registration with PTA if using international cloud services
Implement data classification (public, internal, confidential, restricted)

Key Legal ReferencesSOURCE VERIFIED

Reference	Description	Source
BPRD C1/2025	Consolidated Customer Onboarding — includes cloud outsourcing provisions	SBP
PSD C4/2025	Tech Risk Framework — 7-day outsourcing notice, data localization	SBP
BPRD Cloud Guidelines	Cloud computing framework for banks (BPRD Circular 03/2020)	SBP
CRMD CL01/2026	Cyber Shield — cyber resilience for all SBP-regulated entities	SBP
NTC Standards	Government IT security and cloud standards	NTC
NTISB Guidelines	Telco/ISP cybersecurity mandatory standards	NTISB
PTA Regulations	ISP licensing, type approval for data center connectivity	PTA
PDPB (Draft)	Personal Data Protection Bill — data localization, DTIAs when enacted	MoITT

Related PoliciesSOURCE VERIFIED

Pakistan Cloud First Policy 2022 — Key Provisions NEW

The Pakistan Cloud First Policy 2022 (approved February 25, 2022) mandates a cloud-first approach for government IT and establishes the regulatory framework for cloud adoption in Pakistan:

Provision	Details	IT Company Impact
Cloud-First Mandate	All federal government entities must prioritize cloud-based solutions for new IT projects	Massive cloud procurement opportunities for IT companies serving government
Data Classification	Government data classified into categories determining cloud deployment eligibility	Compliance with data classification requirements when hosting government data
G-Cloud Marketplace	Government cloud marketplace for standardized procurement of cloud services	IT companies can list cloud services on G-Cloud for streamlined government procurement
Cloud Service Provider Framework	Licensing and compliance requirements for cloud service providers serving government	CSP registration, security certifications, and data sovereignty requirements
Data Sovereignty	Critical/sensitive government data must remain within Pakistan's borders	On-premise and Pakistan-based data center requirements for government cloud
Migration Strategy	Phased migration of existing government systems to cloud	Legacy modernization and cloud migration projects for government

Source: Pakistan Cloud First Policy 2022 (PDF) (Federal)

Cloud & Data Center Compliance Checklist

Obtain PTA data center licensing for hosting services PTA Data Center Licensing Regulations 2020

Comply with Government Cloud First Policy for public sector data hosting MoITT Cloud First Policy 2022

Complete NTISB security audit for cloud infrastructure NTISB Security Framework 2020

Ensure data localization compliance for critical data PECA 2016 / PTA Data Retention Rules

Maintain SBP data residency for financial sector client data SBP BPRD Circular on Data Localization

Implement PECA 2016 cybersecurity compliance measures PECA 2016 Sections 3-11

Obtain NADRA verification integration approval for identity services NADRA Verification Rules 2016

Checkboxes are saved in your browser

Source Citations (6)

National Cyber Security Strategy 2023-2028

https://www.pta.gov.pk/en/telecom-licensing

verified 2023 report

National IT Policy 2018

https://103.171.122.217/docs/National_AI_Policy_2025.pdf

pk_only 2018 law

SBP Cloud Computing Guidelines (BPRD 03/2020)

https://www.sbp.org.pk/bprd/2020/CL3.htm

verified circular

NITB Official

https://nitb.gov.pk/

verified website

Ignite PM Cloud Startups

https://ignite.org.pk/

restricted website

Pakistan Cloud First Policy 2022

https://103.171.122.217/docs/Pakistan_Cloud_First_Policy_2022.pdf

pk_only 2022 law

Cloud & Data Center Regulations