Pakistan

Pakistan has no AI-transparency, AI-risk-obligations, AI-training-data, AI-governance, or AI-sector-specific statute in force.

Section 22 of the Prevention of Electronic Crimes Act 2016 (PECA) criminalises producing, distributing, or possessing material that visually depicts a minor engaged in sexually explicit conduct, a person appearing to be a minor engaged in such conduct, or a realistic image representing a minor engaged in such conduct, a formulation broad enough on its own terms to reach a realistic synthetic or AI-generated depiction of a minor and not only a photograph of a real child.

The Digital Nation Pakistan Act 2025 establishes a framework for government digital services and a national digital identity, binding government bodies rather than private developers, and is not catalogued here as an AI-specific instrument for that reason. The National Artificial Intelligence Policy 2025, approved by the Federal Cabinet, is a non-binding strategic framework rather than law and creates no enforceable duty.

A private-member Regulation of Artificial Intelligence Bill was introduced in the Senate in 2024 and, according to secondary reporting, remained before a Senate standing committee without having passed either chamber as of the most recent reporting found; the bill's own text has not been located in an official copy, so it is not catalogued as an instrument and its provisions are not described here.

Pakistan has no scraping-specific statute, so general law governs each dimension separately.

The Prevention of Electronic Crimes Act 2016 (PECA) criminalises unauthorized access, defined so that information available for access by the general public falls outside the offence, so a plain reading of section 3 does not reach the reading of a public, unauthenticated page; accessing an information system or data behind a login or other control, without authorization or in violation of the terms and conditions of the authorization, is unauthorized access and can also be unauthorized interference (s. 5) or, for a critical infrastructure system, a more heavily punished offence (s. 6).

No Pakistani court decision on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper was located.

The Copyright Ordinance 1962 permits fair dealing only for a closed, enumerated list of purposes (research or private study, criticism or review, reporting current events in specified media, judicial proceedings, and a small number of others); it contains no text-and-data-mining exception, so training a model on scraped copyrighted text has no dedicated statutory ground and rests, at most, on whether it can be characterised as one of the enumerated purposes.

Copyright in a compilation of data extends only to the selection and arrangement, never to the underlying data or material itself, so Pakistan confers no sui generis database right over a scraped dataset. Pakistan has no comprehensive personal-data protection statute (see the privacy topic's finding for this jurisdiction), so scraping public personal data from a Pakistani website is not independently restricted by a data-protection law.

No Pakistani unfair-competition or misappropriation doctrine addressing scraping, and no statute or reported decision giving robots.txt legal weight or imposing an AI-training-specific duty, has been located.

Pakistan has no product-security-requirements statute, no dedicated vulnerability-or-incident-reporting duty running to a software or platform provider, and no general "reasonable security" baseline statute binding any business that holds covered data.

The Prevention of Electronic Crimes Act 2016 (PECA, Act No. XL of 2016) is a computer-misuse statute at its core, already the scraping topic's finding for this jurisdiction, but its Chapter VI, "Preventive Measures," adds a narrower security-adjacent mechanism.

Section 48 lets the Federal Government or the Authority the Act names (since its 2025 amendment, the Social Media Protection and Regulatory Authority) issue directives to be followed by the owners of information systems the Government has designated as critical infrastructure under section 2(k) and 2(r), or by "service providers," a term section 2(zb) defines to include anyone who sends, receives, stores, processes or distributes electronic communication through an information system, or who processes or stores data on behalf of the users of such a service; an owner who is not a licensee of the Authority and who violates a directive issued under the section commits an offence, punishable on a first violation with a fine that can reach ten million rupees and, on a later conviction, with imprisonment up to six months, a fine, or both, while a licensee's violation is instead treated as a breach of its own licence terms under the Pakistan Telecommunication (Re-organization) Act 1996.

Section 49 separately lets the Federal Government constitute one or more computer emergency response teams to answer a threat against, or an attack on, a critical-infrastructure information system or data, or a widespread attack on information systems in Pakistan, staffed by technical experts or intelligence-agency officers. Section 48's directive duty is filed as a row of its own.

No directive actually issued under section 48, and no designation of a private information system as critical infrastructure, is confirmed in the primary text.

The Prevention of Electronic Crimes (Amendment) Act 2025 (Act No. II of 2025, Gazette of Pakistan, January 29, 2025), as published in the National Assembly's own text, does not touch Chapter VI or add a security duty of any kind: it creates a Social Media Protection and Regulatory Authority with content-registration, blocking and takedown powers over social media platforms, a content-regulation regime outside this topic.

The State Bank of Pakistan is reported in secondary commentary to maintain cybersecurity and IT-risk guidance for banks and payment-system operators; sbp.org.pk refuses ordinary access to its circular pages, and its own home page names only a passing "Cyber Security week" event, so no binding circular or prudential regulation is confirmed against primary text.

Even a confirmed one would be recorded rather than flagged, since a licensed bank is a bound party the LexLint activity vocabulary cannot express, the same treatment this profile gives DORA's financial entities and New York's Department of Financial Services Part 500 covered entities.

Pakistan has no comprehensive personal-data-protection statute in force, already the privacy topic's finding for this jurisdiction, so there is no breach-notification statute here to point to as this jurisdiction's privacy row. No enforcement record for section 48's directive-compliance offence is confirmed in the primary text, and PECA creates no private right of action.

Section 48 of the Prevention of Electronic Crimes Act 2016 lets the Federal Government or the Authority issue directives to the owners of designated information systems or service providers in the interest of preventing any offence under the Act.

Pakistan has no press-publisher neighbouring right, no compelled platform-to-publisher bargaining code, and no dedicated text-and-data-mining opt-out mechanism; the Copyright Ordinance 1962 contains none of these regimes.

The Ordinance's only exception reaching news content is section 57(1)(b), fair dealing for reporting current events in a newspaper, magazine or similar periodical, by broadcast, in a cinematographic work, or by means of photographs, a closed list that does not in terms name a website or online publication, so whether it extends to an internet news aggregator's reproduction of headlines and snippets is an open question the text does not resolve.

No Pakistani hot-news or misappropriation doctrine, and no reported decision on whether hyperlinking to or framing a Pakistani news publisher's content is a communication to the public, has been located.