October 26, 2026. Pakistan has no comprehensive data protection law in force, so the rule that governs cold email is section 25 of the Prevention of Electronic Crimes Act 2016 (PECA). It makes spamming an offence, including sending unsolicited information without the recipient's permission, and it requires anyone engaged in direct marketing to give recipients an option to unsubscribe. A first violation of either kind is fined up to Rs 50,000, and each later one Rs 50,000 to Rs 1,000,000. Harmful, fraudulent, misleading or illegal messages carry up to three months in prison, a fine of Rs 50,000 to Rs 5,000,000, or both.
Key numbers
| Item | Number |
|---|---|
| Fine, first unsolicited email or missing unsubscribe (PECA section 25(4)) | up to Rs 50,000 |
| Fine, each later violation (PECA section 25(4)) | Rs 50,000 to Rs 1,000,000 |
| Fine, harmful, fraudulent or misleading spam (or up to 3 months in prison, or both) | Rs 50,000 to Rs 5,000,000 |
| Prison for spoofing a sender (or a fine up to Rs 500,000, or both, section 26) | up to 3 years |
| Investigation agency created by the 2025 amendment (NCCIA, Act II of 2025) | 29 January 2025 |
| Personal Data Protection Bill (per Chambers, updated 10 March 2026) | 2023 draft, not passed |
Statute text read on 26 October 2026 in the Sindh Judicial Academy's consolidated PECA (amended to 2025); bill status from the Chambers Data Protection and Privacy 2026 Pakistan chapter.
What PECA section 25 says
The consolidated text of the Act, maintained by the Sindh Judicial Academy with amendments up to the PECA (Amendment) Act 2025, sets out four parts:
- The offence. A person commits spamming who, with intent, transmits harmful, fraudulent, misleading, illegal or unsolicited information to any person without the recipient's permission, or causes an information system to show such information, for wrongful gain.
- The unsubscribe duty. A person, including an institution or an organization, engaged in direct marketing must give the recipient the option to unsubscribe from that marketing.
- The higher tier. Spamming with harmful, fraudulent, misleading or illegal information is punishable by up to three months in prison, or a fine of Rs 50,000 that may extend to Rs 5,000,000, or both.
- The lower tier. Spamming with unsolicited information, or direct marketing without the unsubscribe option, is fined up to Rs 50,000 the first time and not less than Rs 50,000, up to Rs 1,000,000, for every later violation.
The Act does not define unsolicited, permission or wrongful gain, and the two duties sit side by side: one treats unsolicited messages sent without permission as spam, the other assumes direct marketing goes on and requires an exit. Read together, a cold email is safest when it is accurate, comes from a real sender and carries a working unsubscribe. Two more sections matter. Section 26 makes spoofing, sending information from a counterfeit source with dishonest intention, punishable by up to three years in prison, a fine of up to Rs 500,000, or both. Under section 43 spamming is non-cognizable, bailable and compoundable, and since the January 2025 amendment offences under the Act are investigated by the National Cyber Crime Investigation Agency (NCCIA).
No data protection law yet
The Personal Data Protection Bill 2023, drafted by the Ministry of Information Technology and Telecommunication, has completed consultation but has not been passed by both houses of Parliament, according to the Pakistan chapter of Chambers Data Protection and Privacy 2026, last updated on 10 March 2026. The same guide notes that the telecom regulator's 2009 spam regulations apply to licensed telecom operators, which must run spam controls, a Do Not Call register and telemarketer registration.
What it means for operators
- Put an unsubscribe in every email, a link or a plain reply-to-stop line, and suppress the address in every inbox and tool you send from.
- Send from your own authenticated domains. A lookalike or borrowed sender risks the spoofing offence, not just a deliverability problem; set up proper email infrastructure first, and budget the email hosting cost.
- Keep claims and subject lines true. Misleading content moves a message into the tier that carries prison.
- Keep records. Where each address came from, when you emailed it and when it unsubscribed.
- Follow the recipient's law too. A list that mixes Pakistani contacts with EU, UK or Canadian ones brings their consent rules with it; see our cold email laws by country guide.
We build these rules into every cold email campaign we run; if you are pricing outsourced outreach, see what a cold email agency costs per month. This is a summary of public documents, not legal advice.
Frequently Asked Questions
Cold email is not banned, but section 25 of PECA 2016 makes spamming an offence, including sending unsolicited information without the recipient's permission, and requires anyone engaged in direct marketing to offer an unsubscribe option. The Act does not define unsolicited or permission, so the safe practice is accurate content, a real sender and a working unsubscribe in every email.
Under PECA section 25, spamming with unsolicited information, or direct marketing without an unsubscribe option, is fined up to Rs 50,000 the first time and Rs 50,000 to Rs 1,000,000 for each later violation. Harmful, fraudulent, misleading or illegal messages carry up to three months in prison, a fine of Rs 50,000 to Rs 5,000,000, or both.
Not yet. The Personal Data Protection Bill 2023 has completed consultation but has not been passed by both houses of Parliament, according to the Chambers Data Protection and Privacy 2026 guide updated on 10 March 2026. PECA 2016 and sector rules apply in the meantime.
Yes. PECA section 25(2) requires any person, institution or organization engaged in direct marketing to give recipients the option to unsubscribe. Marketing without that option is fined up to Rs 50,000 the first time and up to Rs 1,000,000 for later violations.