Pakistan telecom cybersecurity rules under CTDISR-2025 mandate data localisation, CISOs, audits, continuity plans and 24-hour reporting.
Pakistan telecom cybersecurity rules have changed significantly under CTDISR-2025, introducing stricter requirements for data localisation, cyber governance, audits, and incident reporting.
Pakistan’s telecom sector has been operating under a new cybersecurity and data governance framework since late 2025, and most enterprises that depend on telecom infrastructure either do not know the specifics or have not yet worked out what the obligations mean for them. The Pakistan Telecommunication Authority’s Critical Telecom Data and Infrastructure Security Regulations, known as CTDISR-2025, replaced an earlier framework from 2020 after a detailed review and consultation with industry stakeholders. The new version contains 19 sections and 104 controls. It covers every licensed telecom operator and internet service provider in Pakistan.
For enterprises, the significance is not just that their telecoms provider now faces stricter regulation. It is that the framework introduces obligations around data residency, incident response, and governance structures that have direct implications for how Pakistani businesses should evaluate their telecom and connectivity vendors, design their own data management policies, and position themselves in sectors where regulatory alignment is becoming a commercial differentiator.
Here is what the regulation actually requires, and what it means.
What CTDISR-2025 Is
The Critical Telecom Data and Infrastructure Security Regulations are the primary cybersecurity governance framework governing Pakistan’s licensed telecommunications sector. The 2025 version substantially updates the 2020 framework, aligning Pakistan’s requirements with international standards including ISO/IEC 27001 and the NIST Cybersecurity Framework. The regulations apply to all PTA-licensed operators, including mobile network operators, ISPs, and other telecom licensees.
The framework has five substantive obligation areas that enterprises and their IT and compliance functions should understand.
Obligation One: Data Localisation
All telecom operators must now store and process what the regulation defines as Critical Telecom Data within Pakistan. This means subscriber records, operational data, and sensitive network data cannot be routed through or stored on infrastructure outside Pakistan’s geographical boundaries. Operators must submit an undertaking to the PTA confirming compliance, and the authority has the power to audit and penalise operators that route this data through offshore systems.
For enterprises, this matters in two ways. First, it provides a floor of data sovereignty for sensitive communications data that Pakistani enterprises generate: the telecom layer handling it is legally required to keep it on Pakistani soil. Second, it aligns with the State Bank of Pakistan’s existing data residency requirements for financial institutions and the National Data Governance Policy 2026 requirements for government agencies. An enterprise building a data compliance posture can now treat the telecom layer as a regulatory-aligned element rather than a point of vulnerability.
India has operated a comparable data localisation framework for payment data under RBI regulations since 2018, extended progressively to other sensitive categories. Vietnam’s cybersecurity law mandates domestic data storage for services operating on Vietnamese infrastructure. Pakistan’s framework is later than both but structurally coherent with the regional direction of travel.
Obligation Two: Appointing a CISO and Establishing an ISSC
Every licensed telecom operator must appoint a Chief Information Security Officer and establish a dedicated Information Security Steering Committee to oversee data security and regulatory compliance. The CISO role must be a substantive senior appointment, not a nominal designation, and the ISSC must have documented terms of reference and meeting cadences.
This obligation professionalises cybersecurity governance at the operator level in a way that has not previously been required. For enterprise clients of these operators, it creates a formal point of accountability: a named senior executive whose role encompasses the security of the infrastructure enterprise data runs through.
Obligation Three: Annual Risk Assessments and Cyber Audits
Operators must conduct annual risk assessments and independent cyber audits. Business continuity plans and disaster recovery procedures must be documented, tested, and updated regularly. The audit results must be available to the PTA and feed into the operator’s ongoing compliance posture.
The practical implication for enterprises doing due diligence on their connectivity providers is that CTDISR-2025 creates a standardised baseline against which operators can be assessed. An enterprise procuring managed connectivity services or leased-line infrastructure from a telecom licensee can now ask for evidence of CTDISR-2025 compliance as part of its vendor governance process, in the same way that ISO 27001 certification is used as a proxy for information security maturity in other procurement contexts.
Obligation Four: Business Continuity and Disaster Recovery
Operators must maintain documented and tested business continuity and disaster recovery plans covering major network disruptions, cyberattacks, and physical infrastructure failures. The plans must be reviewed and updated at defined intervals.
Pakistan’s enterprise sector has experienced the consequences of telecom infrastructure disruption through internet slowdowns, VSAT restrictions, and outage incidents over the past several years. A regulatory requirement for tested continuity planning at the operator level does not eliminate disruption risk, but it creates a minimum standard of preparation that operators are legally required to meet and demonstrate.
Obligation Five: 24-Hour Incident Reporting
Perhaps the most operationally significant obligation is mandatory incident reporting within 24 hours of a significant cybersecurity event. Operators must report major incidents to the PTA and cooperate with national cybersecurity response frameworks.
The 24-hour window is materially shorter than reporting timelines that have historically applied in Pakistan’s telecom sector. It reflects global regulatory direction: the EU’s NIS2 Directive requires 24-hour early warning for significant incidents affecting critical infrastructure, and the United States CISA framework has moved toward similarly compressed reporting windows. Pakistan’s framework places its telecom sector within that international standard.
For enterprise customers, faster incident disclosure means faster awareness of potential data exposure through the telecom layer. Enterprises handling sensitive data should ensure their incident response plans account for the possibility of a notified telecom incident affecting their connectivity or communications infrastructure.
These Pakistan telecom cybersecurity rules create a new compliance baseline for operators and the enterprises that depend on their infrastructure.
What Enterprise Should Take From This
CTDISR-2025 is a telecom regulation, but its implications extend into enterprise procurement, vendor governance, and data compliance strategy.
Enterprises with existing managed connectivity contracts should ask their operators for confirmation of CTDISR-2025 compliance status, including the name of the appointed CISO and the date of the most recent independent cyber audit. This is a legitimate due diligence question that the regulation creates grounds to ask.
Enterprises building or updating data governance policies should note that the telecom layer handling their communications now operates under a data localisation requirement. This reinforces rather than replaces the obligations that apply to enterprises directly under the National Data Governance Policy 2026, but it removes one potential gap in an end-to-end data residency posture.
Enterprises in sectors where regulatory alignment is commercially significant, including financial services, healthcare, and government contracting, should treat their telecom providers’ CTDISR-2025 status as a vendor compliance criterion in the same way they treat SBP or PTA licence status today.
Pakistan’s enterprise technology regulatory environment is becoming denser and more specific. CTDISR-2025 is one element of a framework that now includes the National Data Governance Policy, the Electronic Crimes Act, and sector-specific requirements from the SBP and SECP. Understanding how these frameworks interact is not compliance overhead. It is the foundation of operating credibly in Pakistan’s regulated sectors.
