VPNs with servers in Pakistan

Real-time collection and recording of information likewise runs through a court satisfied, on an authorised officer’s information, that the content is reasonably required for a specific investigation (section 39). Whether a VPN operator is a service provider bound by section 32 is not established.

Section 37 of PECA lets the Authority, which since the 2025 amendment is the Social Media Protection and Regulatory Authority, remove or block, or direct the removal or blocking of, information if it considers it necessary in the interest of the glory of Islam or the integrity, security or defence of Pakistan, public order, decency or morality, in relation to contempt of court, or for the commission or incitement of an offence under the Act.

Section 11 punishes information that advances or is likely to advance interfaith, sectarian or racial hatred, with up to seven years’ imprisonment, a fine, or both. Section 20 covers the intentional public display or transmission of information known to be false that intimidates a natural person or harms their reputation or privacy, with up to three years in prison, a fine of up to Rs 1 million, or both.

The PECA (Amendment) Act 2025 added section 26A, an offence carrying up to three years in prison, a fine of up to Rs 2 million, or both. The interior minister told the National Assembly that 187 cases had been registered under the amended Act.

On 8 July 2024 the telecommunications ministry authorised officers of the Inter-Services Intelligence, of grade 18 or above, to intercept calls and messages or trace calls under section 54 of the Pakistan Telecommunication (Re-organisation) Act 1996, in the interest of national security. A petition challenged the notification as unconstitutional, and the Human Rights Commission of Pakistan called it a flagrant violation of articles 9, 14 and 19.

The Supreme Court held in Benazir Bhutto v President of Pakistan (1998) that telephone tapping violates the right to privacy. The order of the rows is the security score, and a server’s location is not a recommendation.