Pakistan PDPB

Pakistan Personal Data Protection Bill - data subject rights, consent, cross-border transfers, DPC.


Short name	PK PDPB
Region	Asia-Pacific
Country or scope	Pakistan
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers PK PDPB

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 6 controls from Safeguard's control catalog for PK PDPB.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for PK PDPB and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`PK-PDPB-SEC` Security Safeguards	Data controllers would be required to take practical technical and organisational steps to protect personal data from loss, misuse, or unauthorized alteration, implying integrity assurance for the software performing the processing (Pakistan PDPB draft, security-requirements clause)	Scan
`PK-PDPB-PROC` Processor Guarantees	A controller engaging a data processor would need to ensure the processor provides sufficient guarantees of security and compliance, requiring visibility into which suppliers stand behind the processing stack (Pakistan PDPB draft, processor obligations clause)	Scan
`PK-PDPB-BREACH` Breach Notification Readiness	Personal data breaches would have to be notified to the Commission within a short statutory window; assessing impact quickly requires deployed components to be individually identifiable with known versions (Pakistan PDPB draft, breach notification clause)	Scan
`PK-PDPB-ACC` Accountability Records	Controllers would be accountable for demonstrating compliance with the data protection principles, which requires an enumerated, documented record of the systems and software components that process personal data (Pakistan PDPB draft, accountability principle)	Scan
`PK-PDPB-XBDR` Cross-Border Transfer Documentation	Cross-border transfers of personal data (and localization of critical personal data) would be conditioned on adequate protection and Commission oversight, requiring identified, timestamped documentation of transferring systems (Pakistan PDPB draft, cross-border transfer clause)	Scan
`PK-PDPB-INTG` Data and Record Integrity	Personal data would have to be accurate, complete, and kept up to date; applied to processing-system records this means component entries carry both a name and a version (Pakistan PDPB draft, data quality principle)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`PK-PDPB-CONSENT`	Consent and Lawful Basis
`PK-PDPB-PRINCIPLES`	Core Data Protection Principles
`PK-PDPB-RIGHTS`	Data Subject Rights
`PK-PDPB-SENSITIVE`	Sensitive Personal Data Processing
`PK-PDPB-CROSSBORDER`	Cross-Border Transfer Controls
`PK-PDPB-DPC`	Data Protection Commission Compliance

Policy templates

Written for PK PDPB:

Pakistan PDPB Privacy Notice
Pakistan PDPB Cross-Border Transfer Policy
Pakistan PDPB Data Subject Rights Procedure

And 22 from the standard set, adapted to PK PDPB.