Pakistan’s AI data protection gap is widening fast. Hospitals are using AI to manage patient records. Banks are using it for fraud detection. But there are still no binding rules telling them what they can and cannot do with your data. Industry is now raising the alarm before that gap causes real harm.
Densight Labs Points to a PKR 9.7 Trillion Risk
Densight Labs, an applied AI firm and consultancy to companies like L’Oreal and Aga Khan University Hospital, released a policy paper claiming its recommendations, combined with the necessary investment, can help unlock a PKR 9.7 trillion digital transformation opportunity. But the firm’s CEO says that opportunity cannot be realised safely without proper rules in place first.
Pakistan urgently needs a data protection framework and clear guidelines for AI use in healthcare and financial services, the Densight Labs CEO warned in late July 2026. Founded by Numan Ahmad, a LUMS alumnus, the firm was built specifically to bridge the gap between AI awareness and real-world AI adoption for organisations across South Asia. His concern carries weight precisely because Densight Labs works inside these sectors every day.
The Personal Data Protection Bill Is Still Not Law
Here is the part most coverage skips over. Pakistan does have a draft data protection bill. It has been talked about for years. But it remains just a draft.
The core point, stated plainly: the Personal Data Protection Bill is not law. It has not been enacted. Organisations should not treat it as binding until Parliament passes it and the President assents to it.
The Ministry of IT’s revised draft had not been published in final form or submitted to Parliament as of May 2026. That means right now, in mid-2026, any hospital or bank deploying AI tools handles your most sensitive data with no dedicated, enforceable privacy law protecting you.
Pakistan does not currently have an effective, dedicated legal framework governing the processing of personal data for research and development purposes, and no specific statutory conditions have been formally prescribed in this regard. For healthcare AI in particular, this is a serious problem. A diagnostic AI model trained on Pakistani patient data is operating in a legal vacuum.
What the National AI Policy 2025 Does and Does Not Do
On 30 July 2025, under the leadership of Prime Minister Shehbaz Sharif, the federal cabinet approved the National AI Policy 2025. It was a welcome step. But it is important to understand what the policy actually is.
Effective July 2025, this policy establishes a framework rather than direct legal obligations. While the policy itself does not impose immediate fines, it mandates future actions and compliance. Think of it as a plan to make rules, not the rules themselves.
Central to the policy is the establishment of an AI Regulatory Directorate, tasked with ensuring ethical AI practices, data protection, and algorithmic transparency. That directorate is still being set up. Until it is operational and backed by enforceable law, hospitals and banks are essentially self-regulating.
Earlier in June 2026, Pakistan published a draft National Data Governance Policy that proposes a regulatory framework for AI, a slow but essential step towards creating its infrastructure as the National AI Policy was introduced approximately a year ago. A draft, again. Not a law.
Why Healthcare and Finance Are the Highest-Risk Sectors
Not all AI use is equally risky. A chatbot suggesting recipes is very different from an AI tool reading your blood tests or deciding whether to approve your loan.
Key players in scope for high-risk AI applications include health diagnostics, critical infrastructure, and law enforcement. In these areas, a wrong AI decision can mean a missed diagnosis, a wrongful loan rejection, or a data breach that exposes millions of financial records.
The current AI regulatory discourse in Pakistan demonstrates a troubling imbalance. It heavily emphasises economic opportunities and cybersecurity for the government, but notably lacks comprehensive consideration of user rights, protections, and data security.
Pakistan’s banking sector does have some older rules. Within the banking sector, the Payment Systems and Electronic Funds Transfers Act, 2007, provides for the secrecy of financial institutions’ customer information, and violation is punishable with imprisonment, a financial fine, or both. But this law was written long before AI existed. It says nothing about what banks can do when an algorithm makes a credit decision using your personal data.
For readers following Pakistan’s wider fintech growth, this regulatory gap matters a great deal. As digital banks go live and fintech investment flows into Pakistan, the absence of AI-specific rules in finance becomes an even bigger vulnerability.
What Needs to Happen Next
A national data protection law remains pending, deterring international investors from storing proprietary data on domestic servers due to unclear privacy and liability frameworks. Legislative urgency must accompany AI strategy. A National Data Protection Law linked explicitly within the AI policy is essential.
Experts point to the EU’s AI Act as a model. The EU AI Act, which came into effect on February 5, 2025, offers a striking contrast to Pakistan’s approach by establishing clear, enforceable boundaries around AI deployment. While Pakistan’s framework prioritises economic growth and state security, the EU legislation explicitly prohibits AI applications that threaten fundamental rights and civil liberties.
Pakistan does not need to copy the EU word for word. But it does need binding sector rules for healthcare and finance, not just policy roadmaps. The country is also investing heavily in AI skills. Pakistan’s plan to upskill one million non-IT workers in AI will only create real value if those workers operate within a safe, rules-based environment.
Densight Labs CEO Numan Ahmad describes what success in Pakistan’s AI ecosystem would look like: a Pakistani professional in any sector, including healthcare and finance, can pick up an AI tool and deploy it into their actual workflow without needing a technical co-founder to hold their hand. That vision is achievable. But it requires the government to match the speed of AI adoption with the speed of regulation.
Frequently Asked Questions
Does Pakistan have any AI data protection law right now?
No binding AI data protection law exists in Pakistan as of mid-2026. The Personal Data Protection Bill is still a draft and has not been passed by Parliament. The National AI Policy 2025 is a framework, not enforceable law.
Why are healthcare and banking the biggest concerns?
These two sectors handle the most sensitive personal data: your medical records and your financial information. An AI error or data breach in either sector can cause serious real-world harm. Without specific rules, there is no clear legal accountability when something goes wrong.
What has the government done so far?
The National AI Policy 2025 introduces regulatory sandboxes, cybersecurity protocols, and transparency frameworks to ensure ethical AI use, data protection, and public trust. In June 2026, a draft National Data Governance Policy was also published. But both are still at the planning stage, not enforceable rules.
How does Pakistan compare to other countries on AI regulation?
Pakistan is behind most large economies. The EU AI Act is already in force. India, the UAE, and Singapore all have sector-specific AI guidance for healthcare and finance. Pakistan’s policy acknowledges the need to align with OECD AI principles and international standards, but implementation lags far behind the policy language.
