The Asia Internet Coalition (AIC), comprising major global digital media companies, has raised significant concerns regarding Pakistan’s proposed data localization policies.
In a recent report titled “Data Localization in Pakistan,” the AIC warns that the enactment of the Personal Data Protection Bill, based on its May 2023 draft, could lead to substantial economic and employment challenges.
The report estimates that if the bill is enacted in 2024, labor productivity in Pakistan could decline by 14.7 percent by 2025. This decline is projected to result in a GDP loss of approximately USD 16.5 billion in the year following the bill’s enactment. Additionally, the report suggests that this decrease in productivity could translate to a potential loss of 3.2 million jobs.
The AIC’s report highlights that the current policy and regulatory landscape in Pakistan already includes some data localization requirements. However, the introduction of the new draft bill would significantly tighten these measures. The proposed bill grants a newly constituted commission broad powers to refuse the transfer of personal data on grounds such as “public interest” or “national security of Pakistan.”
The report underscores the potential negative repercussions of data localization on businesses and the broader economy. It points out that the additional requirements for handling sensitive and critical data, along with differentiated compliance processes for the private and public sectors, pose significant challenges. These challenges are likely to be exacerbated when data needs to be shared between public and private organizations.
Concerns have also been raised about the implications of data localization on cybersecurity. The report notes that international cloud providers offer a variety of services that local providers may not be able to match due to a lack of economies of scale. Additionally, the use of distributed systems can enhance resilience, making databases less susceptible to cybersecurity threats and outages.
The AIC’s report also highlights the cost implications of data localization for firms. Case studies indicate that labor costs could increase due to the need to hire additional human resources. While this might suggest job creation, the economic analysis indicates a potential net loss of jobs in the longer term. This could be due to some firms ceasing operations if costs become unsustainable, as well as the time needed to bridge skills gaps.
The report suggests that changes in the wider policy environment and market could alter the implications for firms. For instance, if an international cloud service provider were to establish data centers in Pakistan, the costs for firms might decrease. However, concerns about data security and availability in the absence of distributed systems may persist.
Sectoral impacts of data localization requirements are expected to vary. The IT/ITES sectors, in particular, could see strategic shifts affecting investment and growth. Conversely, impacts on health provision could have broader effects on the quality of life for Pakistan’s citizens.
The extent of the impacts will also depend on the government’s approach to enforcement. A lighter touch approach may yield less severe economic consequences compared to a more stringent enforcement strategy. However, the report concludes that the potential risks of data localization appear to outweigh its merits, as evidenced by regional peers moving away from such measures.
The AIC report also highlights the potential increase in hosting costs due to data localization. One IT company estimated a 70 percent rise in hosting costs, while an e-commerce retailer projected that a fully locally compliant solution for financial services could cost over ten times more than its current cloud-based solution. These high costs are likely to disproportionately impact small and medium-sized firms.
Furthermore, the report raises concerns about increased cybersecurity risks associated with centralized data storage. An e-commerce retailer emphasized that centralized approaches compromise the security benefits of decentralized architectures. Additionally, an IT company expressed concerns about disaster recovery and data mirroring under data localization requirements.
As Pakistan considers the enactment of the Personal Data Protection Bill, the AIC’s report serves as a critical reminder of the potential economic and cybersecurity challenges that data localization policies could entail.
