PakistanPrevention of Electronic Crimes Act, Directives to Owners of Designated Information Systems and Service Providers
Prevention of Electronic Crimes Act 2016 (Act No. XL of 2016), ss. 48 and 49
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds the owners of designated information systems and service providers to whom the Federal Government or the Authority addresses a directive; the Government may designate private or Government infrastructure as critical infrastructure (reached by declaring that you operate an essential service) (sections 2(1)(x) and 48(1)).
- Follow the directives the Federal Government or the Authority issues in the interest of preventing any offence under the Act (section 48(1)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 48(2): imprisonment of up to six months, a fine or both on a subsequent conviction of a non-licensee owner who violates a directive.
Penalty structure
Section 48(2): for an owner who is not a licensee of the Authority, a fine of up to ten million rupees on a first violation; on a subsequent conviction imprisonment of up to six months, a fine, or both. A licensee's violation is treated as a breach of its licence terms.
- Rule
- Fixed only
- As of
- Currency
- PKR
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
The Federal Government or the Authority, which issue the directives, and the courts, which try the offence in section 48(2).
Settledness
- As of
- Open questions
- Has the Federal Government or the Authority issued a directive under section 48(1), and to which owners of designated information systems or service providers, since the duty to act arises only once a directive is issued?
- Which information systems count as designated information systems under section 48(1), since the Act uses the term without a definition?
What this law does
Section 48(1) of the Prevention of Electronic Crimes Act 2016 lets the Federal Government or the Authority issue directives to be followed by the owners of designated information systems or service providers in the interest of preventing any offence under the Act.
Section 48(2) makes an owner of an information system who is not a licensee of the Authority and who violates a directive guilty of an offence punishable, for a first offence, with a fine of up to ten million rupees and, on a subsequent conviction, with imprisonment of up to six months, a fine, or both. A violation of a directive by a licensee of the Authority is deemed a violation of the licence terms and is treated as such under the Pakistan Telecommunication (Re-organization) Act, 1996.
The Act defines the Authority as the Social Media Protection and Regulatory Authority established under section 2A, as substituted by the Prevention of Electronic Crimes (Amendment) Act, 2025. The Act lets the Government designate any private or Government infrastructure as critical infrastructure as may be prescribed.
Section 49 lets the Federal Government constitute one or more computer emergency response teams to respond to any threat against or attack on critical infrastructure information systems or data, or a widespread attack on information systems in Pakistan.
When LexLint raises it
When your app profile says your app runs an essential service.