Personal Data Protection Ordinance Paved for Privacy and Progress
The Advisory Council has approved the Personal Data Protection Ordinance, 2025, comprising 57 sections and categorizing personal information into four distinct classes — open, internal, confidential, and restricted. The ordinance mandates explicit consent from data subjects for data collection and processing.
It also introduces penalties and administrative fines for violations, unauthorized access, or misuse of data. Provisions have been included for periodic audits of data processing by independent data auditors. Furthermore, it allows bilateral and multilateral data exchange and integration to promote international cooperation.
According to the ordinance, parental or legal guardian consent will be required for processing data related to children or individuals incapable of providing consent. Data subjects will have the right to withdraw their consent at any time. The ordinance also allows the processing of sensitive personal data under specific conditions.
However, it permits the use of data without consent in cases involving national security, public interest, crime prevention, education, and research.
Earlier, the Information and Communication Technology (ICT) Division initiated the formulation of the Personal Data Protection Ordinance, 2025 to ensure the privacy, security, and responsible use of personal information. The ordinance was approved in the Advisory Council meeting held on October 9.
According to the ICT Division, “The ordinance will play a crucial role in protecting citizens’ personal data, ensuring the fair use of information technology, and fostering a secure environment for innovation in the digital age.” The division further stated that the implementation of the proposed law would ensure international standards in the collection, storage, processing, transfer, and disposal of personal data, thereby contributing to the sustainable development of the digital economy.
The ICT Division expressed confidence that the Personal Data Protection Ordinance, 2025 would be a “transformative step toward safeguarding citizens’ privacy and fostering data-driven innovation.”
