A buyer books a 5 marla plot. Within a week, a photo of their CNIC has passed through a dealer's phone, a sub-dealer's WhatsApp group, the front desk printer and a paper file in an unlocked cabinet. Every extra copy is a chance for someone to register a SIM, open an account, or walk up to the transfer desk pretending to be the owner. Many society managers assume a data protection act in Pakistan would spell out what to do. As of October 2026 there is still no comprehensive one in force, yet existing laws already punish the misuse of identity information.
This guide explains where personal data protection in Pakistan stands, which laws apply to property offices today, and a practical privacy playbook for housing societies, developers and dealers.
Editorial note (October 2026): This guide is general information based on publicly available laws, court decisions, regulator notices and market reports as of October 2026. Rules, rates and procedures change — confirm current requirements with the relevant authority, your bank, or a qualified lawyer or tax advisor before acting. This is not legal, tax or investment advice.
Is there a data protection act in Pakistan? The status in October 2026
Short answer: no. Pakistan does not yet have a comprehensive personal data protection law covering private businesses such as housing societies and estate agencies. The Ministry of IT and Telecommunication (MoITT) has circulated draft Personal Data Protection Bills since 2018. A 2023 version was approved in principle by the federal cabinet but never passed by Parliament, and in March 2025 ARY News reported that the IT ministry had asked a Senate committee for more time to finalise the draft.
In August 2026, a Dawn opinion piece on Pakistan's privacy debate noted that the bill has remained a draft since 2018 and the country still lacks a comprehensive data privacy law. When we checked the National Assembly's list of Acts in October 2026, no data protection act appeared. Some 2026 commentary refers to a "finalised" bill, but we found no Act number, presidential assent or gazette notification, so treat any "Data Protection Act 2025" or "2026" label as a draft.
- The draft National Data Governance Policy 2026, released by MoITT for consultation in June 2026, is aimed mainly at government data held by public bodies and their contractors. It is not a privacy law for private businesses.
- A future law is likely to bring a regulator (drafts propose a National Commission for Personal Data Protection), consent and purpose rules, individual rights and significant penalties. The final text may differ, so build good habits now.
Laws that already protect buyers' personal data
No dedicated privacy law does not mean no liability. These laws already matter when a society or dealer handles CNIC, NICOP or passport copies:
| Law | What it covers | Why it matters to a property office |
|---|---|---|
| PECA 2016, section 16 | Obtaining, selling, possessing, transmitting or using another person's identity information without authorisation: up to three years' imprisonment, a fine up to Rs 5 million, or both | Forwarding, selling or reusing a buyer's CNIC details beyond the purpose they were given for |
| PECA sections 13 and 14 | Electronic forgery (up to three years, fine up to Rs 250,000) and electronic fraud for wrongful gain (up to two years, fine up to Rs 10 million) | Edited CNIC images, fabricated digital transfer papers, fake payment screenshots |
| Pakistan Penal Code | Forgery, cheating and cheating by personation | Impersonating a seller at the transfer desk; forged affidavits or powers of attorney |
| NADRA Ordinance 2000 | Sections 28 and 29 punish divulging NADRA registration data or breaching its security | Relevant when you use NADRA verification services; it does not regulate your own photocopies |
| AML Act 2010 and FBR's AML/CFT Regulations for DNFBPs | Agents, builders and developers must identify customers and keep due diligence records for a prescribed minimum period | You must collect and keep identity documents, so the goal is safe handling, not collecting nothing |
| Constitution, Article 14, and civil law | Dignity and, subject to law, privacy of home are inviolable; general duty of care under contract and tort | Careless disclosure can support a civil claim, depending on the facts |
The text of PECA section 16 also lets the affected person apply to the Authority under PECA to have the information secured, destroyed or blocked. PECA complaints are handled by the National Cyber Crime Investigation Agency (NCCIA), which took over the FIA's cybercrime wing in 2024. For record-keeping duties, see our guide to AML/CFT compliance for real estate agents.
How buyer data actually leaks from property offices
Most leaks in this business are not hacks. They are everyday habits:
- Dealer phones: CNIC photos sit in galleries and personal cloud backups long after the deal.
- Open WhatsApp groups: "file available" posts with CNIC and allotment images shared with hundreds of members.
- Paper: extra photocopies, unlocked cabinets, and old files sold to the raddi trade.
- Spreadsheets: one Excel sheet of every buyer's CNIC, mobile and address, emailed around or copied to USB drives.
- Former staff: still in groups and still holding logins.
Even large institutions get this wrong. Dawn reported in March 2024 that a joint investigation team found the particulars of as many as 2.7 million citizens had been compromised between 2019 and 2023, allegedly involving NADRA offices in Karachi, Multan and Peshawar. If a national database can leak through insiders, a sales office with no controls is an easier target.
Common office practices: the risk and a safer alternative
| Common practice | Risk | Safer alternative |
|---|---|---|
| Dealer photographs the buyer's CNIC and forwards it on WhatsApp | Copies stay on several phones and backups indefinitely | Upload to the society's system through a secure upload link, then delete from the phone |
| Posting CNIC and allotment images in groups to prove ownership | Anyone can reuse them for impersonation or a fake file | Share plot number, size and demand only; verify ownership through the society office |
| Unmarked photocopies | The same copy can be reused for a SIM or another deal | Write purpose, plot and date across each copy |
| Every staff member sees full buyer records | Insider misuse goes unnoticed | Role-based access; full CNIC visible only to verification and transfer staff |
| Buyer spreadsheets on email and USB drives | Uncontrolled copies, no record of who opened what | One system of record with individual logins, restricted exports and an audit trail |
| Old files thrown out or sold as scrap | CNIC copies end up in public hands | Cross-cut shredding after the retention period, with a disposal log |
| Transfer processed on copies and a signature | Impersonation using copied documents | Original CNIC, both parties present, biometric checks where available |
A personal data protection playbook for societies and dealers
1. Collect only what you need
At booking, a typical file needs the buyer's CNIC, NICOP or passport (front and back), contact details, address, nominee details, payment proof, and source-of-funds information where your AML risk assessment calls for it. At transfer, collect the same for both parties plus the transfer documents. Skip family members' CNICs unless they are nominees or joint owners, and put the list in writing.
2. Take documents out of WhatsApp
Never accept identity documents in groups. If a buyer must send one by chat, use the office's official number, move it into the system and delete it from the chat. Turn off media auto-download and saving to the gallery on office phones, and use business numbers so chats stay with the office when staff leave.
3. Mark every copy with its purpose
Have buyers write a line such as "For booking of Plot 123, Block C only, 25-10-2026" across the copy and sign it, keeping the photo and CNIC number clear. A marked copy is much harder to reuse for a SIM or an unrelated deal.
4. Control access by role
The front desk needs a name, plot and balance, not a CNIC image. Only verification, transfer and compliance staff need full identity documents. Show partial CNIC numbers on lists and reports, and review access every quarter. See role-based access control in real estate.
5. Retain for the required period, then dispose securely
AML/CFT duties mean you cannot delete identity documents as soon as a deal closes. Set a written retention schedule that follows the AML Act and FBR's regulations, longer where litigation is ongoing. When the period ends, shred paper, delete digital copies and log what was destroyed.
6. Train staff and bind dealers
Run short annual training with attendance recorded, and add confidentiality clauses to dealer agreements. When someone leaves, remove them from groups and disable logins the same day. Our guide to internal fraud controls for sales offices covers the wider control set. For encryption, backups and hosting, see data security questions to ask before buying real estate software and securing real estate data from ransomware.
Stopping fake transfers built on copied documents
The costliest CNIC misuse in this sector is a fraudulent transfer. Someone gets copies of the owner's CNIC and allotment letter, then brings in a look-alike, uses a forged power of attorney, or applies for a "duplicate" file claiming the original was lost. Controls that work:
- Originals and presence. Both parties appear with original CNICs (NICOP or passport for overseas Pakistanis), and staff compare photos against the file.
- Biometric verification where available. RDA made NADRA biometric verification mandatory for buyers and sellers in 2023, and LDA signed a biometric MoU with NADRA in 2019. Private societies can ask NADRA about verification services for organisations; under NADRA's "Ijazat Aap Ki" consent service, verification requests need a six-digit passcode sent to the citizen's registered mobile.
- Callback to the number on record. Call the owner on the number in your records, not the one on the application, and message that number whenever a transfer or duplicate request is filed.
- Powers of attorney. Check registration or attestation and confirm directly with the principal.
- Duplicates. Require an affidavit, a newspaper notice, a waiting period and senior approval.
- A log of every check, showing who verified what and when.
Fraudulent transfers often end in possession fights; see our guide to illegal possession (qabza) and the law in 2026. For Punjab's move to digital society records, see our guide to the Punjab housing society management system and property certificates.
What to do when buyer CNIC data leaks
- Contain it: ask recipients or group admins to delete the material, revoke access and change passwords.
- Find the scope: which buyers, which documents, since when, and who received them.
- Flag affected files for enhanced verification on any transfer, duplicate or refund request.
- Tell affected buyers what happened and suggest they check SIMs registered against their CNIC through PTA's 668 SMS service.
- Report criminal misuse to the NCCIA under PECA if data was sold or used for fraud.
- Fix the cause and record what changed.
No general law yet forces a private society to report a breach, but a fast, honest response limits damage and protects your reputation.
How CAPITALESTATEPK helps
Software does not make an office privacy-compliant on its own, but it removes the habits behind most leaks. CAPITALESTATEPK keeps identity documents in a document vault attached to each customer record instead of phone galleries and WhatsApp chats. Role-based access limits who sees full records, the audit trail shows who created, edited or approved each booking, receipt and transfer, and transfers follow an approval workflow. To move buyer documents into one controlled system, book a demo.
Frequently Asked Questions
Is there a data protection act in Pakistan in 2026?
Not a comprehensive one, as of October 2026. The Personal Data Protection Bill has been in draft since 2018 and has not been enacted. PECA 2016, the NADRA Ordinance and AML rules still govern how personal data is handled.
Is it illegal to share someone's CNIC copy on WhatsApp?
Sending your own CNIC for a booking you requested is fine. Forwarding someone else's CNIC, selling it or using it for another purpose without authorisation can fall under PECA section 16, punishable with up to three years' imprisonment, a fine up to Rs 5 million, or both. Each case depends on its facts.
How long should a housing society keep buyer CNIC copies?
At least as long as AML/CFT rules require for due diligence records, and longer if a case is in court. Then destroy paper copies securely and delete digital ones. Check FBR's current regulations for the exact period.
Can someone transfer my plot using a copy of my CNIC?
A well-run transfer desk should not allow it, because it requires the original CNIC, the owner in person and, increasingly, biometric verification. Fraud happens where offices accept copies, unverified powers of attorney or unchecked duplicate requests.
What should I do if my CNIC copy has been misused?
Ask the society holding your file to flag it for extra verification, check SIMs registered against your CNIC through PTA's 668 service, and file a complaint with the NCCIA if you suspect fraud.