Offshore cloud infrastructure is the default for most Virtual Asset Service Providers (VASPs), and a strict data-localisation rule would make Pakistan a difficult market to serve from existing global infrastructure. The Virtual Assets Act, 2026 does not impose that strict rule — but it also does not leave the question open-ended. Section 39 sets a permissive default with a hard override the Pakistan Virtual Assets Regulatory Authority (PVARA, “the Authority”) can invoke at any time.
Does the Virtual Assets Act require VASPs to keep data inside Pakistan?
No, not as a default rule. Section 39(1) states that a Licensee may store or process data outside Pakistan, subject to compliance with applicable laws relating to data protection, cybersecurity, and cross-border data transfers, and subject to such safeguards as shall be prescribed by Regulations.
Section 39(1) states:
A Licensee may store or process data outside Pakistan, subject to compliance with applicable laws relating to data protection, cybersecurity, and cross-border data transfers, and subject to such safeguards as shall be prescribed by Regulations.
The word “may” signals permission, not prohibition. A Licensee is not required to build Pakistan-only data infrastructure from day one, which is a materially different posture from jurisdictions that mandate in-country data residency for regulated financial data. That said, the permission is conditional on two things: compliance with whatever other data protection, cybersecurity and cross-border transfer laws already apply, and compliance with safeguards Regulations under the Act had not yet published at the time of writing.
What safeguards will apply to offshore data storage?
The Act does not specify the content of these safeguards directly — section 39(1) defers that detail to future Regulations. What can be inferred is the general shape of the safeguards regime from adjacent provisions of the Act that already touch cross-border data handling:
- section 47(2), on the travel rule, requires that originator and beneficiary information obligations be “implemented in compliance with applicable data protection, data governance, and cybersecurity laws, ensuring the confidentiality, integrity, and security of the information”
- section 48(1) requires Licensees to establish secure reporting channels, and where required secure automated interfaces, enabling the Authority to access prescribed data for supervisory and enforcement purposes
- section 40, on sensitive information, requires segregation, need-to-know access controls, encryption, and audit trails for defined categories of sensitive data, regardless of where that data physically sits
None of these provisions is stated by the Act to be the specific safeguards regime section 39(1) anticipates, but together they indicate the direction Regulations are likely to take: confidentiality, integrity, security, and Authority access, rather than a location-based rule alone.
When can PVARA force a licensee to localise data immediately?
Section 39(2) is the override to the section 39(1) default. It states that nothing in section 39 prevents the Authority from requiring immediate localisation or restricted cross-border transfer of specific datasets where necessary in the interest of national security, financial stability, consumer protection, or enforcement effectiveness.
Section 39(2) states:
Nothing in this section shall prevent the Authority from requiring immediate localization or restricted cross-border transfer of specific datasets where necessary in the interest of national security, financial stability, consumer protection, or enforcement effectiveness.
This is drafted as a standing reserve power, not a formal process with notice periods or a right to representations set out in section 39 itself. The trigger conditions — national security, financial stability, consumer protection, enforcement effectiveness — are broad and undefined by the Act, meaning the Authority retains wide discretion over when to invoke this power. A Licensee relying on offshore infrastructure under section 39(1) should treat section 39(2) as a live possibility, not a theoretical backstop, precisely because the grounds for invoking it are not narrowly drawn.
| Section | What it establishes |
|---|---|
| Section 39(1) | Default permission to store or process data outside Pakistan |
| Section 39(1) | Conditional on applicable data protection/cybersecurity/cross-border laws and future safeguards Regulations |
| Section 39(2) | Authority’s power to order immediate localisation or restricted transfer of specific datasets |
| Section 5(2) | Other laws on data protection, cybersecurity or cross-border transfer prevail over the Act where inconsistent |
Does offshore storage let a VASP avoid Pakistan’s other data protection laws?
No. Section 5(2) states that where any other law prescribes measures relating to data protection, data governance, or cybersecurity, financial secrecy, or cross-border transfer of personal data, “such provisions shall prevail and be complied with by the Authority and Licensees.” This is one of the narrow exceptions to the Act’s general rule in section 5(1) that the Act otherwise prevails over inconsistent legislation.
In practice, this means section 39(1)’s permission to store data offshore does not override any separate Pakistani statute governing cross-border personal data transfer that a Licensee is already subject to. The two regimes apply cumulatively: a Licensee must satisfy both the Act’s future section 39(1) safeguards Regulations and whatever independent data protection law already applies to it. The source documents do not name that other law specifically, and this article does not guess at its content.
Does offshore storage change a licensee’s obligations to give PVARA access to its data?
No, and this is a point worth stating plainly. Section 48(1) requires Licensees to establish secure reporting channels, and where required secure automated interfaces, enabling the Authority and other notified agencies to access prescribed data for supervisory and enforcement purposes, regardless of where that data is physically stored. Section 48(2) gives the Authority power to prescribe the technical standards, security requirements and data specifications for those interfaces.
Offshore storage under section 39(1), in other words, is a question of where data sits, not a means of limiting the Authority’s access to it. A Licensee choosing offshore infrastructure for cost or scalability reasons should design its architecture around continued Authority access under section 48 from the outset, rather than treating data location and data accessibility as the same question.
What should a VASP do when designing its data architecture for Pakistan?
- treat section 39(1) as permission, not certainty — the safeguards Regulations that condition it had not been published at the time of writing, so architecture decisions made now may need to adapt once they appear
- identify which specific categories of data section 40’s “sensitive information” definition would apply to, since those categories carry segregation and encryption duties regardless of storage location
- build in the technical capability for rapid, restricted data localisation for any dataset the Authority might reasonably view as sensitive to national security, financial stability, or consumer protection, given the breadth of section 39(2)’s trigger conditions
- design supervisory access under section 48 into the system from day one, rather than as a retrofit, since offshore storage does not reduce this obligation
- confirm separately, with legal counsel, whether any existing Pakistani data protection statute applies to the business’s data flows independent of the Act, since section 5(2) preserves those obligations regardless of what PVARA later prescribes
Section 39 gives VASPs real flexibility on where they run their infrastructure, which matters for firms building on established virtual asset cloud stacks rather than standing up Pakistan-only systems from scratch. That flexibility, however, sits inside a framework where the Authority can reverse it for a specific dataset without much procedural friction, and where separate data protection law and the Authority’s own supervisory access rights apply regardless of where the data is stored. Firms should plan their corporate setup and technology architecture around that reality rather than around the permissive headline of section 39(1) alone.
Related reading
- PVARA Exchange License: Capital, Rules & Obligations 2026
- PVARA Transfer & Settlement License: Crypto Payments 2026
- PVARA Licensing Process: NOC to Full Licence, Step by Step
- The PVARA Licensing Gold Rush: Pakistan’s Crypto Frontier
- PVARA Custody License: Safeguard Customer Crypto 2026
About this analysis
This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.
Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.
Entering Pakistan's crypto market?
CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.
Visit CoinConnect