Pakistan’s long-drafted Data Governance Policy will be unveiled within the next couple of weeks, Information Technology Minister Shaza Fatima Khawaja said at the Margalla Dialogue in Islamabad on Wednesday. The policy sets rules for how government institutions share, classify and protect the data they hold, and it has been in consultation since at least August. If it lands on the timeline the minister gave, it will be the most consequential piece of digital regulation Pakistan has issued since the national AI policy.
What the Minister Announced
Khawaja said a comprehensive policy has been drafted and will be released shortly, without naming a date. Its stated aims are secure and responsible data sharing between institutions under defined governance principles, interoperability across government systems, and public access to properly sanitised datasets so that students and developers can build on them.
She framed the work within a wider push on what she called sovereign technological capability and cyber defence, which she said Pakistan intends to make second to none. The remarks were delivered at a security-policy conference rather than a technology event, which tells you something about how the government is positioning data policy: as national infrastructure with a defence dimension, not as a regulatory housekeeping exercise.
A Figure Worth Checking
Coverage of the speech has led in several places on a $1 billion government investment in artificial intelligence, presented as though it were announced this week. It was not. That commitment was made by Prime Minister Shehbaz Sharif in February 2026 at the launch of Indus AI Week, with a target horizon of 2030, and it has been restated at intervals since.
The original announcement came with specifics that are worth recalling, because they are the measure against which progress should be judged: a nationwide AI curriculum extending to Azad Kashmir and Gilgit-Baltistan, 1,000 funded PhD scholarships in AI over four years, and a programme to train one million non-IT professionals in AI skills. Nine months on, what has not been published is a breakdown of how the $1 billion is allocated or how much of it has been committed. Repeating the headline number is not the same as reporting progress against it.
Related: NCCIA Raids on IT Firms Put Record Exports at Risk, Says P@SHA
What Is Actually in the Draft
More is known about the policy’s contents than the speech suggested, because the Ministry of IT and Telecommunication ran a high-level consultation on the draft in August with the Pakistan Digital Authority. Federal ministries, provincial governments and public sector bodies submitted recommendations on interoperability, legal alignment, data classification and implementation.
The operative mechanism is a framework called WASL, which is to enable secure data exchange between institutions on the basis of data classification rather than open access. The policy is described as supporting the National Digital Master Plan and Pakistan’s Digital Public Infrastructure work, with phased implementation and capacity building rather than a single switch-on date.
The Centralisation Question
The most important assurance given during consultation came from Pakistan Digital Authority chairman Dr Sohail Munir, who said the policy does not propose unrestricted data sharing or the centralisation of all government data on a single platform, and that ownership and protection of data would remain with the institution that holds it.
That distinction carries most of the civil liberties weight in this policy. A classification-based exchange layer, where each department keeps custody and releases specified categories under defined rules, is a materially different proposition from a central government data lake. The first is plumbing. The second would be the single largest concentration of personal information in the country’s history. The assurance has been given verbally. Whether the published text holds to it is the thing to read for.
The Gap the Policy Does Not Fill
A data governance policy regulates how the state handles its own data. It is not a personal data protection law, which would govern how anyone, including private companies, handles information about citizens and would give individuals enforceable rights over it. Pakistan has been drafting such legislation for years without enacting it.
The sequencing matters. Building an interoperability layer that moves citizen records between departments, before passing a law that tells citizens what rights they have when those records move, puts the machinery ahead of the safeguards. That is not an argument against the policy, which addresses a real problem of departments unable to exchange data they all separately collect. It is an argument that the policy should not be mistaken for the thing it is not.
What to Watch When It Lands
Three things will determine whether this is substantive. The first is whether the published text carries the no-centralisation commitment as binding language or as preamble. The second is the classification schedule, because whichever categories are marked shareable define the policy’s real reach regardless of what the principles say. The third is enforcement: whether a department that mishandles or over-shares data faces any consequence, and who adjudicates that.
A fourth is simply arrival. A policy drafted by August and promised within a fortnight in November has already taken longer than the consultation implied, and Pakistan has an established pattern of digital frameworks that are announced repeatedly and published slowly. On this one the minister has now attached a timeline, which at least makes the commitment checkable.
