Passenger data retention and audit in Pakistan

How long traveller records are kept

The Federal Investigation Agency (FIA) says its Integrated Border Management System (IBMS) has a database of more than 206 million travellers based on arrivals and departures since 2003 ¹. It says IBMS took over maintaining and updating the database prepared by the PISCES system from 2003 to 2010 ¹. The record counts on that page are given up to 30 June 2020 ¹.

The FIA's Annual Administration Report 2025 says IBMS recorded 22,650,199 travellers in 2025 and holds records of 57,560 deportees and 73,358 offloadees ². Neither the IBMS page nor the report states a retention period or a deletion rule for these records ^1,2. This page will add one if an official schedule is published.

Secrecy rules for identity data

The National Database and Registration Authority Ordinance, 2000 governs NADRA's databases ³. Section 28, headed information not to be divulged, bars employees and others from communicating information outside their official duties ³. The penalty is imprisonment of up to five years, a fine of up to one million rupees, or both ³.

Section 29 protects the security and secrecy of NADRA's databases ³. Section 29(2) sets rigorous imprisonment of up to fourteen years, a fine of at least one million rupees, or both, for breaches ³. The Pakistan Code text is marked updated till 7.10.2022 ³. The sources checked do not set a retention period for NADRA records.

Controls the FIA reports

The FIA report for 2025 describes a Flight Manifest Comparison Report ². It says the check found 24,119 passengers who skipped IBMS processing in the quarter it describes, and that 9,388 of them were brought back into the system ². The report says this work was done to maintain data integrity and stop-list sanctity ².

The report says IBMS data sharing with other agencies is controlled and comes with safeguards, without listing them ². It does not describe access logs or an external audit of IBMS ².

Audit findings on passports

Business Recorder reported on 18 September 2025 that a subcommittee of the National Assembly's Public Accounts Committee directed the Interior Ministry to bring back a machine-readable passport system from the Pakistan High Commission in New Delhi ⁴. The report said the system was installed in 2006, became the subject of an audit objection after it never became operational, and had sat unused for about a decade ⁴.

Passport officials told the committee the system worked for about three months and raised data-security concerns about connecting it to the internet, per the report ⁴. The report said the committee settled that objection with a directive to complete the return quickly ⁴.

The same subcommittee asked for an inquiry report on the theft of 32,674 passport booklets flagged by an audit objection ⁴. Officials said the thefts took place between 1994 and 2000 from 25 offices, and that the booklets were blacklisted and the names placed on the Passport Control List ⁴. NADRA officials said a new system had been introduced to prevent similar incidents ⁴.

Data protection law status

Dawn reported on 11 April 2020 that the Ministry of IT released a draft Personal Data Protection Bill, 2020 for consultation ⁵. Rights groups asked that data collected during the Covid-19 pandemic be time-bound and deleted within a set timeframe, as reported by Dawn ⁵. On 19 March 2025 ARY News reported that approval of the bill had been delayed again ⁶.

The Digital Nation Pakistan Act bill, as passed by the National Assembly, defers to other laws that set measures on citizens' data rights and cybersecurity in section 28(2) ⁸. UN Security Council Resolution 2396 (2017) urged ICAO to set a standard for the collection, use, processing and protection of PNR data ⁷.