After a considerable delay, Pakistan is finally witnessing a positive development in the direction of building a digital economy, a transformation that was long overdue. In this regard, the Prime Minister has constituted the Pakistan Crypto Council (PCC), which has swiftly begun laying its groundwork. On May 23, 2025, the Chairman of the PCC held a significant meeting with Field Marshal General Syed Asim Munir, a key supporter behind the Special Investment Facilitation Council (SIFC), to discuss ongoing initiatives aimed at digitalising Pakistan’s economy.
In another important diplomatic engagement, the Chairman PCC also met with the Malaysian Foreign Minister, Mohamad Bin Hajji Hasan, where they explored collaborative opportunities in blockchain technology, digital assets, and Shariah-compliant finance. Malaysia, notably, has already made impressive progress in transitioning from a traditional economy to a digitally integrated one.
While these developments are promising and welcomed by us as legal-tech experts and researchers but one critical area remains under-addressed by both Pakistan and Malaysia: comprehensive legislation. Malaysia introduced its Personal Data Protection Act (PDPA) in 2010, at a time when AI-driven technologies were neither prevalent nor as impactful as they are today. Since 2023, however, AI-enabled systems have experienced exponential growth across sectors, from education to finance, bringing with them new legal and ethical challenges.
Despite having key legislative instruments such as the PDPA 2010, Communications and Multimedia Act 1998, and Cybersecurity Act, Malaysia’s current legal landscape lacks AI-specific provisions to safeguard personal data against misuse by intelligent systems. One of the main criticisms of Malaysia’s PDPA is its commercial scope, which excludes non-commercial data processing and leaves individuals vulnerable to privacy violations. In addition, jurisdictional overlaps, regulatory fragmentation, and weak inter-agency coordination continue to hamper effective enforcement.
Pakistan, on the other hand, lacks even a foundational legal framework for data protection and AI governance. Its draft Personal Data Protection Bill was initiated in 2018 and tabled in the National Assembly in 2021, but it remains under legislative consultation to date. As Pakistan positions itself for digital economic reform, this legislative vacuum could severely limit the credibility and sustainability of its efforts, mirroring the limitations seen in Malaysia’s outdated PDPA.
Malaysia has shown further progress by launching a dedicated Artificial Intelligence Office in December 2024, with the goal of shaping national AI policies and addressing regulatory challenges. This initiative is part of Malaysia’s ambition to become a regional hub for AI development (Reuters, Dec. 12, 2024). Pakistan must follow suit by enacting both data protection and AI-specific legislation to ensure regulatory integrity and citizen rights.
Globally, comprehensive legal models already exist. The European Union’s General Data Protection Regulation (GDPR), the United Kingdom’s Data Protection Act 2018, and the California Consumer Privacy Act (CCPA) have set high benchmarks. While GDPR remains a robust framework for data protection, it only partially addresses AI-related concerns through Articles 5 and 22. Recognizing this gap, the EU passed the Artificial Intelligence Act in 2024, a detailed and targeted regulatory response to the growing presence and risks of AI technologies. Similarly, the UK is in the process of debating a standalone AI bill to fill the regulatory void.
In conclusion, Pakistan must prioritize the immediate enactment of a comprehensive Data Protection Act to ensure that its digital reforms yield tangible, secure, and sustainable benefits. Simultaneously, a dedicated AI regulation bill must be introduced to address the full spectrum of AI-related legal and ethical challenges. While Malaysia is more advanced in AI policy formulation, it must also expedite the legislative process to bring its AI strategy into legal effect.
As Pakistan seeks to attract foreign investment and transform its financial infrastructure to meet international standards, establishing a clear, enforceable legal framework will be crucial. The due process of law not only safeguards citizens but also builds investor confidence, facilitating secure and transparent digital investments into the country.
To accelerate this transformation, Pakistan and Malaysia could consider establishing a bilateral regulatory task force focused on harmonizing standards for AI governance, data protection, and digital finance. This would not only enhance regional cooperation but also align both countries with global regulatory trends, positioning them as attractive, future-ready investment destinations.
