PECA 2016 Explained: SIM and CNIC Data Laws in Pakistan

There is a law most Pakistanis have never read that quietly decides what happens to the person who sells your CNIC data, the shop that activates a SIM without checking who's standing there, and the stranger who won't stop calling you. It's the Prevention of Electronic Crimes Act, 2016, better known as PECA. People mostly hear about it in headlines about social media. But tucked between the sections on hate speech and cyber-terrorism are a handful of provisions that matter enormously to ordinary SIM and CNIC users. This guide walks through them in plain words, section by section, with the penalties, the process, and what it all means for you.

Rather than read the whole Act, try the finder below. Pick what worries you, and it shows the sections that apply.

What PECA Is, and What It Isn't

PECA is Act No. XL of 2016, enacted on 19 August 2016. It extends to the whole of Pakistan, applies to citizens wherever they are, and even covers acts committed outside Pakistan that affect a person, property, information system or data located here.

You can read the original wording in a published copy of the 2016 Act, and a consolidated version with later amendments. The Act was amended in 2025 by the Prevention of Electronic Crimes (Amendment) Act, 2025 (Act No. II of 2025), published in the Gazette on 29 January 2025. Among other things, the amendment adds section 26A on spreading false information, creates the Social Media Protection and Regulatory Authority, and replaces the FIA's cybercrime role with the National Cyber Crime Investigation Agency. I focus here on the sections that touch SIMs and CNICs.

One thing PECA is not: a data protection law. Pakistan has no comprehensive, enacted data protection statute. Sources reviewed in 2026 describe the Personal Data Protection Bill as approved by the Federal Cabinet but not yet passed by Parliament. So PECA works as criminal law. It punishes specific misuse. It doesn't set out general duties for how companies must collect, store or protect your data. That gap explains a lot about why SIM data leaks keep happening.

"Identity Information", Defined

Section 16 turns on a phrase, and the Act defines it. "Identity information" means information which may authenticate or identify an individual, or an information system, and enable access to any data or information system.

That's broad on purpose. A CNIC number clearly identifies a person, and the definition also reaches things that authenticate or enable access, which plausibly includes passwords and codes. A court decides what counts in a given case, but the practical point is safe: treat your CNIC number, 667 reply, OTPs and passwords as things the law takes seriously. That's why our guide to MNP 667 tells you to keep the reply private, and why our guide to the name on a SIM explains how a name becomes a bridge to the rest of your identity.

Section 16: The One You'll Hear About

Section 16 makes it an offence to obtain, sell, possess, transmit or use another person's identity information without authorisation. The punishment can be up to three years in prison, a fine of up to Rs. 5 million, or both.

Read those verbs slowly, because they cover the whole supply chain. The person who steals the data is caught, and so is the person who sells it, the person who holds it, the person who forwards it in a chat, and the person who uses it. That's why "I only asked a bot for a CNIC" is a risky defence. It's also why our guides on SIM owner details by number and fresh SIM data offers keep saying the same thing: a service that accepts a stranger's number and returns an identity is dealing in exactly what section 16 describes.

The second half of section 16 is easy to miss and quietly useful. If your identity information has been obtained, sold, possessed, used or transmitted without authorisation, you can apply to the Authority to have it secured, destroyed, blocked or stopped from being transmitted. In the 2016 text, "the Authority" means the Pakistan Telecommunication Authority. In other words, the law gives you a route to ask PTA to act, and it doesn't leave you relying on the police alone. The practical route runs through PTA's complaint portal or its helpline, 0800-55055.

Section 17: The SIM Seller's Problem

Section 17 is the one written for franchises and agents. It punishes anyone who sells or otherwise provides a SIM (or an equivalent module such as a UICC) without obtaining and verifying the subscriber's antecedents in the mode and manner approved by the Authority. The penalty is up to three years, a fine of up to Rs. 500,000, or both.

Two details stand out. The standard is set by the regulator: verification must follow the manner PTA approves. And on procedure, offences under section 17 are cognizable by the investigation agency on a written complaint by the Authority, so PTA can set the process in motion.

That's the backdrop to news like the December 2025 raid on a Sheikhupura franchise, which PTA described in a press release after a woman complained that her CNIC had repeatedly been used for unauthorised SIM activations. I'm not suggesting any specific charge in that case, only that it's the kind of conduct section 17 exists for. The newer 365-day disowning rule matters too: a longer accountability period discourages quick "register and shed" schemes.

Sections 24 and 26: When the Problem Is a Caller or a Message

Cyber stalking (section 24)

Section 24 covers using communication means with the intent to coerce, intimidate or harass, including contacting or trying to contact someone repeatedly despite their clear indication of disinterest. It also covers monitoring someone's electronic communications, spying that causes fear, and harmful sharing of their photos or videos without consent. The maximum is three years, a fine of up to Rs. 1 million, or both, rising to five years and Rs. 10 million if the victim is a minor. Victims can also apply to PTA for removal or blocking of the offending information.

This is the section behind the complaint route in our guide to the 76367 network check: find the operator, keep screenshots, then report.

Spoofing (section 26)

Section 26 punishes establishing a website, or sending information, from a counterfeit source intended to be believed authentic, with dishonest intention. The maximum is three years, a fine of up to Rs. 500,000, or both. If that sounds like the "Your SIM will be blocked, click here" messages and lookalike portals doing the rounds, it should. We describe how that scam borrows real PTA advisories in our guide to fake SIM data offers. And if a caller-ID label ever makes you trust a call, remember the limits we cover in Truecaller vs official PTA verification.

Sections 3, 4 and 14: Access, Copying and Fraud

These three are the general-purpose tools. Each turns on "dishonest intention", which the Act defines as intending to cause injury, wrongful gain, wrongful loss or harm to someone.

• Section 3, unauthorised access: up to three months, a fine of up to Rs. 50,000, or both.
• Section 4, unauthorised copying or transmission of data: up to six months, a fine of up to Rs. 100,000, or both.
• Section 14, electronic fraud: up to two years, a fine of up to Rs. 10 million, or both. This is the one for deceiving someone through a system or device for wrongful gain.
• Section 13, electronic forgery: up to three years, a fine of up to Rs. 250,000, or both, where data is altered to appear authentic.

Sections 3 and 4 are much lighter than 16 and 17, which shows the law treats identity data and SIM issuing as more serious than generic data access. In a real leak, several sections can apply at once.

Section 41: When the Insider Is the Leak

Most people picture a leak as an outside hacker. In practice, many leaks come from people who were given access. Section 41 is aimed at them. It punishes any person, including a service provider or an authorised officer, who has secured access to personal information about another person and discloses it to someone else, without consent and not as required by law, with the intent to cause harm, or knowing that harm or wrongful loss or gain is likely. The maximum is three years, a fine of up to Rs. 1 million, or both.

Where a service provider or officer claims good faith, the burden of proving it lies on them. For anyone worried about a franchise employee or operator insider passing on CNIC details, this is the section that speaks to it. If it happens to you, the route is your operator's official helpline first, then PTA, and where cybercrime is involved, NCCIA. Our cnic.sims.pk portal guide shows how to check whether any SIMs were registered on your CNIC in the meantime.

The Penalty Ladder

Here are the maximum prison terms side by side, so you can see how the sections relate. They're maximums set by the Act, not automatic sentences.

How Investigators Lawfully Get Data

If you've wondered why there's no public tool that turns a number into a name, the Act's process chapter is the answer. Sensitive records don't flow to whoever asks. They flow through a chain that involves courts.

1. Preserve

   Section 31: an authorised officer can serve written notice to preserve specific data for up to 90 days, and must tell the Court within 24 hours.

2. Retain

   Section 32: service providers keep traffic data for at least a year, and hand it over only on a court warrant.

3. Warrant

   Sections 33 and 34: a Court can issue warrants to search and seize, or to disclose content data, after recording reasons.

4. Real-time

   Section 39: a Court can order real-time collection of information, for no longer than necessary and not beyond seven days unless extended.

Section 35 adds that officers must act proportionately and protect the integrity and secrecy of what they access. This is the lawful counterpart of everything our guides warn you not to try, and it's why a complaint beats a lookup. File it, and let the people with warrants act.

Who Enforces What

• PTA (the "Authority"): sets SIM verification standards, receives applications to secure, destroy or block identity information, and can put section 17 cases in motion by written complaint.
• The investigation agency: under the 2025 amendment, the National Cyber Crime Investigation Agency took over from the FIA as the agency for inquiries, investigations and prosecutions under PECA. You can file through its complaint portal or on 1799, and find more on the NCCIA website.
• Courts: designated courts try offences and can order compensation to victims in addition to punishment, under section 45.

Other Laws in the Background

PECA doesn't work alone. The Pakistan Penal Code applies to PECA offences to the extent it isn't inconsistent with the Act. The Pakistan Telecommunication (Re-organization) Act, 1996 is the source of PTA's authority. Commentators also note that the NADRA Ordinance 2000 and the Electronic Transactions Ordinance 2002 contain some data protection-related provisions, though neither is a dedicated data protection law. And Article 14 of the Constitution recognises privacy as part of a person's dignity.

Without a general data protection act, the law punishes misuse after it happens. It doesn't guarantee the organisations holding your data have secured it, so protect your own records.

What This Means for You

1. Know what's on your CNIC. Text 668 or use the portal, using our 668 SMS code guide, and read how many SIMs one CNIC can hold to understand the totals.
2. Guard identity data like cash. CNIC copies, 667 replies, OTPs and passwords are all things the law treats seriously. Don't post or forward them.
3. Don't become the offender. Asking a bot for someone's details, saving them or forwarding them can fall within section 16's verbs.
4. If your identity is misused, use the remedy. Apply to PTA under section 16, report the SIM to your operator, and escalate to PTA and NCCIA as needed.
5. Keep evidence, such as dated screenshots and complaint references. The 365-day rule makes more sense once you see the law behind it.

For the wider set of official checks, see our CNIC SIM check guide, and for every method compared, checking SIM owner details by CNIC.

PECA 2016: FAQs

What is PECA 2016?

The Prevention of Electronic Crimes Act, 2016 (Act XL of 2016) is Pakistan's main cybercrime law. It covers offences such as unauthorised access, electronic fraud, identity information misuse, unauthorised SIM issuing, stalking and spoofing, and sets out how they're investigated.

Which PECA section covers CNIC misuse?

Section 16, unauthorised use of identity information. It punishes obtaining, selling, possessing, transmitting or using another person's identity information without authorisation, with up to three years in prison, a fine of up to Rs. 5 million, or both.

Which section covers illegal SIM issuing?

Section 17, unauthorised issuance of SIM cards. It punishes selling or providing a SIM without obtaining and verifying the subscriber's antecedents as approved by the Authority, with up to three years, a fine of up to Rs. 500,000, or both.

Can I ask PTA to remove my identity information?

Section 16(2) lets a person whose identity information is misused apply to the Authority, which in the 2016 text means PTA, to secure, destroy, block access to or prevent transmission of it. PTA can take measures it considers appropriate.

What law covers harassing calls and messages?

Section 24, cyber stalking, covers intending to coerce, intimidate or harass through communication means, including repeated contact despite clear disinterest. The maximum is three years, a fine of up to Rs. 1 million, or both.

Are fake PTA messages and portals covered?

Section 26, spoofing, covers dishonestly setting up a website or sending information from a counterfeit source meant to be believed authentic. It carries up to three years, a fine of up to Rs. 500,000, or both.

What if an operator employee leaks my details?

Section 41 punishes disclosing personal information you gained access to without consent, with intent to cause harm or knowing harm is likely, by up to three years, a fine of up to Rs. 1 million, or both. Report to your operator, then PTA, and NCCIA for cybercrime.

Does Pakistan have a data protection law?

Not a comprehensive, enacted one as of the 2026 sources I reviewed. The Personal Data Protection Bill 2023 was approved by the Federal Cabinet but hadn't passed Parliament.

Related guides: SIM Owner Details (main guide) · SIM Owner Details by Number · Fresh SIM Data · 365-Day SIM Disowning Rule · How Many SIMs on One CNIC · Pak Sim Data: Real or Scam?.
Note: laws and complaint channels can change. Check the current text of the Act and confirm details on pta.gov.pk. This site is independent and is not a government or legal service.