Pakistan's Prevention of Electronic Crimes Act 2016 (PECA) is the law that decides whether misuse of a credential is a crime, how long service providers must keep traffic data, and what investigators can compel a company to hand over, and its 2025 amendment created a new investigation agency and a social media regulator. Security teams in Pakistan, and multinationals with operations or users there, meet PECA in three ways: as victims reporting intrusions and fraud, as service providers with retention and assistance duties, and as platforms subject to content rules. This guide covers the offences most relevant to security practitioners with their maximum penalties, the critical infrastructure tier, data retention and investigative powers, the Prevention of Electronic Crimes (Amendment) Act 2025 (Act No. II of 2025), and what the law means for service accounts, API keys and automated systems. It is for CISOs, legal and compliance teams and incident responders. For how PECA compares with other countries' anti-hacking laws, see the Computer Misuse and Anti-Hacking Laws Guide; this page goes deeper on Pakistan only. Status: offences, penalties and retention duties checked against the 2016 Gazette text, and the 2025 changes against the Gazette text of Act No. II of 2025 published by the National Assembly; the Sindh Judicial Academy consolidation is used only as a reading aid, checked 8 November 2026. Confirm every obligation, deadline and penalty against the official text before relying on it.
Key takeaways
- Two tiers of hacking offence: unauthorised access, copying and interference carry up to 3 months, 6 months and 2 years (Sections 3 to 5); the same acts against critical infrastructure carry up to 3, 5 and 7 years and fines up to Rs 10 million (Sections 6 to 8).
- Identity information is protected directly: obtaining, selling, possessing or using another person's identity information without authorisation carries up to 3 years and Rs 5 million (Section 16).
- Traffic data must be kept a year: service providers retain specified traffic data for at least one year or any period notified, and disclose it only on a court warrant (Section 32).
- The 2025 amendment changed the institutions: Act No. II of 2025, assented on 29 January 2025, created the Social Media Protection and Regulatory Authority, a Complaint Council and Tribunals, and put the National Cyber Crime Investigation Agency (NCCIA) in place of the FIA Cyber Crime Wing.
- A new false information offence: Section 26A punishes intentionally spreading information known or believed to be false that is likely to cause fear, panic, disorder or unrest, with up to 3 years and Rs 2 million.
Scope: who and what is covered
PECA (Act XL of 2016) applies to offences committed through information systems and sets procedural powers for investigating them. Three definitions matter most to security teams:
- Critical infrastructure: assets, facilities, systems, networks or processes whose loss or compromise could seriously affect essential services, including those whose failure could cause major loss of life, or significantly affect national security, defence or the functioning of the state; the Government may designate further infrastructure.
- Service provider: a person who operates services for sending, receiving, storing or processing electronic communications, who owns or runs a public switched network or provides telecom services, or who processes or stores data for such services or their users. Cloud and hosting businesses can fall in the last limb.
- Social media platform (2025): broadly defined to cover account-based services and user content sharing, excluding licensees of the Pakistan Telecommunication Authority (PTA).
| Who | How PECA reaches them |
|---|---|
| Any organisation | Victim of offences; may be required to assist investigators (Section 35) and to produce data under court orders (Section 34) |
| Critical infrastructure operators | Aggravated offences protect their systems (Sections 6 to 8, 13(2)); CERTs may respond to attacks on them (Section 49) |
| Service providers | Traffic data retention (Section 32), confidentiality on notice (Section 38), limited liability without actual knowledge and intent |
| Social media platforms | Enlistment, content removal and blocking directions, complaints procedures (Chapter 1A, from 2025) |
| Individuals | All offences, including identity information and false information offences |
Key obligations
Offences security teams should know
| Section | Offence | Maximum imprisonment | Maximum fine |
|---|---|---|---|
| 3 | Unauthorised access to an information system or data with dishonest intent | 3 months | Rs 50,000 |
| 4 | Unauthorised copying or transmission of data | 6 months | Rs 100,000 |
| 5 | Interference with or damage to an information system or data | 2 years | Rs 500,000 |
| 6 | Unauthorised access to critical infrastructure systems or data | 3 years | Rs 1 million |
| 7 | Unauthorised copying or transmission of critical infrastructure data | 5 years | Rs 5 million |
| 8 | Interference with or damage to critical infrastructure systems or data | 7 years | Rs 10 million |
| 10 | Cyber terrorism (Sections 6 to 9 offences with specified intent) | 14 years | Rs 50 million |
| 13 | Electronic forgery (critical infrastructure in brackets) | 3 years (7) | Rs 250,000 (Rs 5 million) |
| 14 | Electronic fraud for wrongful gain | 2 years | Rs 10 million |
| 15 | Making or supplying a device or data mainly intended for an offence | 6 months | Rs 50,000 |
| 16 | Unauthorised use of identity information | 3 years | Rs 5 million |
| 41 | Unauthorised disclosure of personal data with intent to harm or for wrongful gain | 3 years | Rs 1 million |
Each penalty is imprisonment, fine or both. Under Section 43 most offences are non-cognisable, bailable and compoundable; offences under Sections 10, 13, 14, 20, 21, 22 and 26A are cognisable, and some, including Section 10, are non-bailable and non-compoundable. For a victim organisation this matters: fraud (Section 14) and forgery (Section 13) complaints follow the cognisable route, while a plain unauthorised access complaint under Section 3 follows the non-cognisable route; take legal advice on how each is registered.
Data retention and assistance duties
- Traffic data (Section 32): service providers retain specified traffic data for at least one year or any period the Authority notifies, and provide it only to the investigation agency or an authorised officer on a court warrant. A non-licensee information system owner that breaches the duty faces a fine of up to Rs 10 million for a first violation, and up to 6 months, a fine or both on a later conviction.
- Warrants and production (Sections 33, 34): courts may issue search and seizure warrants and orders to produce or give access to data; production warrants last seven days, extendable. Where evidence is at high risk, a gazetted officer may search first and inform the court within 24 hours.
- Officer powers (Section 35): authorised officers may access and inspect systems, copy data, and require assistance from those running the system and decryption information or unencrypted access, while acting proportionately, protecting system integrity and keeping a log of actions.
- Seized data (Section 36): officers list what was seized in the presence of two witnesses; owners can request a forensic image for a prescribed fee.
- Real-time collection (Section 39): a court may order real-time collection of content for up to seven days, extendable.
- Confidentiality and liability (Section 38): service providers are not liable without specific actual knowledge and wilful intent, have no duty to monitor proactively, and must keep an investigation confidential for 14 days when served notice, extendable by court order.
Timeline and current status
| Date | Event |
|---|---|
| 2016 | PECA enacted as Act XL of 2016 |
| 20 July 2018 | Prevention of Electronic Crimes Investigation Rules 2018 (S.R.O. 979(I)/2018) |
| 2023 | Act XXXVII of 2023 adds child-protection complaints (Section 43A) and victim support (Section 45A) |
| 29 January 2025 | Prevention of Electronic Crimes (Amendment) Act 2025 (Act No. II of 2025) assented and published; in force at once |
| From 29 January 2025 | Amended Section 29 provides for the NCCIA; we could not confirm the date it began operating from an official source |
The 2025 amendment's key changes:
- Social Media Protection and Regulatory Authority (Sections 2A to 2Q): a chairperson and eight members, including the Interior Secretary and the chairs of PEMRA and the PTA ex officio; powers to require platform enlistment, direct removal or blocking of unlawful or offensive content (nine categories in Section 2R), and block non-compliant platforms. Complaints about fake or false information must be decided within 24 hours (Section 2C).
- Complaint Council and Tribunals (Sections 2T to 2X): Tribunals decide cases within 90 days; appeals go to the Supreme Court within 60 days.
- NCCIA (Sections 29, 30): replaces the FIA Cyber Crime Wing; the Director General holds Inspector General of Police powers for a non-extendable three-year term; officers have police powers; joint investigation teams are allowed.
- Transition (Section 50A): the PTA and the existing investigation agency keep functioning until the new bodies are established.
As of November 2026 we could not confirm from an official source whether the Social Media Protection and Regulatory Authority and the Tribunals have been constituted. Check the National Assembly, Ministry of Interior and PTA pages before relying on which body currently handles content directions.
Enforcement and penalties
Enforcement is criminal: the NCCIA investigates and prosecutes PECA offences, courts designated under Section 44 try them, and courts may order compensation to victims (Section 45). Appeals go to the High Court or sessions court within 30 days (Section 47). For organisations, the realistic exposure is less about being prosecuted than about being compelled: retention fines for non-licensee owners under Section 32, assistance and decryption demands under Section 35, and for platforms, Authority directions backed by blocking and Tribunal proceedings. International requests are handled through the designated agency under Section 42, which permits refusal on sovereignty, security, public order or political grounds. For the treaty context, see the Budapest Convention and UN Cybercrime Convention Guide.
What it means for AI agents and non-human identities
- Authorisation is the legal line: Sections 3 to 5 turn on "unauthorised". A contractor or former employee who reuses a service account password or an API key after their engagement ends acts without authorisation; an integration that exceeds its documented scope is harder to classify. Define in writing what each machine identity may do, and revoke credentials when the purpose ends, so the line is clear for both security and prosecution. See the NHI Offboarding and Decommissioning Guide.
- Critical infrastructure tier: intrusion via a stolen machine credential (ATT&CK T1078 Valid Accounts) into a designated system triggers Sections 6 to 8. Operators should tag which service accounts reach those systems so incident reports identify the aggravated tier early.
- Identity information and fraud: Section 16 protects a person's identity information; Section 14 covers fraud. Automated account-takeover and fraud bots exploit both, so keep authentication logs that tie each session to a credential.
- Retention means logging: a service provider cannot meet Section 32 without traffic records. Include API gateway and machine-to-machine traffic in retention scope and protect those logs from tampering.
- Decryption assistance: Section 35 lets officers require decryption information. Know where keys for each system live, who controls them and how to provide lawful access without exposing unrelated data. See the Cryptographic Key Management Guide.
- AI agents: an agent that posts content to social media on your behalf is subject to Section 26A and Authority directions like any user account. Keep human approval on public posting and log what the agent published and why.
Compliance steps
- Classify your role: victim-only, service provider, critical infrastructure operator, social media platform or several. Each adds duties.
- Set retention: if you are a service provider, define which traffic data you retain, for at least one year, with access restricted to warrant-backed requests.
- Write a law enforcement request procedure: verify warrants and officer authority, route to legal, log every disclosure, apply the 14-day confidentiality duty, and preserve a record of data provided.
- Build a reporting path: know how to file a complaint with the NCCIA, which offences are cognisable, and what evidence (logs, timelines, credential records) investigators will need.
- Tighten machine identity authorisation: owner, purpose and scope for every service account and API key, with revocation on contract end.
- Prepare for seizure: agree how you would provide forensic copies of data, since Section 35 treats seizure of hardware as a last resort.
- Platforms: maintain the complaints procedure required by Section 2S and a process to action Authority directions within the time set.
| PECA area | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Authorised access for people and services | PR.AA-01, PR.AA-05 | AC-2, AC-6 |
| Traffic data retention | PR.PS-04 | AU-11, AU-9 |
| Decryption and key control | PR.AA-01 | SC-12 |
| Incident handling and reporting to the NCCIA | RS.CO-02, RS.MA-01 | IR-4, IR-6 |
| Legal obligations | GV.OC-03 | PM-18 |
Common failure patterns
- Using outdated agency names: runbooks that still route complaints to the FIA Cyber Crime Wing waste time; the NCCIA is the investigation agency.
- Unclear authorisation for machine access: no documented scope for an integration makes it hard to show access was unauthorised when a key is abused.
- Retention without access control: traffic data kept for a year but readable by many staff becomes its own data protection risk.
- Disclosing without a warrant: Section 32 data goes out only on a court warrant; informal requests should be refused politely and logged.
- No key inventory: a decryption demand under Section 35 cannot be answered precisely, so too much data is handed over.
Practitioner checklist
- Record which PECA roles apply to you: victim, service provider, critical infrastructure, platform.
- Retain specified traffic data for at least one year if you are a service provider.
- Keep a law enforcement request procedure with warrant checks and a disclosure log.
- Update incident runbooks to name the NCCIA as the investigation agency.
- Document owner, purpose and scope for every service account and API key.
- Map which machine identities reach designated critical infrastructure.
- Keep a key inventory so decryption requests can be met narrowly.
- Require human approval for AI agents that publish to social media.
Standards and references
- Gazette of Pakistan (National Assembly): Prevention of Electronic Crimes (Amendment) Act, 2025, Act No. II of 2025
- Sindh Judicial Academy: Prevention of Electronic Crimes Act 2016 and Rules, consolidated up to 2025
- Gazette of Pakistan, 22 August 2016: Prevention of Electronic Crimes Act, 2016 (Act No. XL of 2016), copy hosted by Punjab CERT
- NIST: Cybersecurity Framework 2.0
- MITRE ATT&CK: T1078 Valid Accounts
This guide summarises Pakistan's Prevention of Electronic Crimes Act 2016 as amended and is not legal advice. Related NHI Mgmt Group resources: Computer Misuse and Anti-Hacking Laws Guide · Budapest Convention and UN Cybercrime Convention Guide · eDiscovery and Legal Hold Guide · API Key Management Guide