Pakistan Moves to Bring Overseas-Hosted Data Back Home in Major Cybersecurity Push
Pakistan is preparing to relocate a substantial share of its government and business data back within its own borders, as officials and industry leaders push for local hosting to reduce cyber risks and keep sensitive information firmly under domestic legal jurisdiction.
The scale of the current problem is significant: more than 90 percent of Pakistan’s data is presently stored abroad, largely through hosting providers, cloud services, and mobile application platforms based in countries including the United States and Singapore. The planned shift comes amid a broader cybersecurity push, one that’s being shaped in part by the geopolitical realignment triggered by the ongoing US-Iran conflict.
Why Cybersecurity Concerns Are Driving This Shift
Industry experts argue that keeping critical data hosted outside Pakistan increases the country’s exposure to security breaches while weakening its overall data sovereignty. Over the past two decades, multiple public institutions and financial organisations in Pakistan have experienced cyber incidents that resulted in data leaks and real financial damage.
Pakistan Computer Emergency Response Team Director General Dr Haider Abbas revealed that the country recorded 253 cyberattacks in 2026 alone, referencing a ransomware attack just last week on a government entity in which data was encrypted and later restored from backups. The scale of the broader threat becomes even clearer looking back further: during 2024-25, Pakistan faced 927 attacks targeting critical infrastructure across both public and private sectors, with experts believing a substantial number of these intrusions originated from outside the country.
Ransomware in particular continues to rank among the most damaging cyber threats facing organisations worldwide, and specialists argue that relocating critical information into Pakistan-based facilities would help reduce these risks while giving the country greater control over its essential digital systems.
A Formal Government Framework Takes Shape
To address this, the federal government has proposed a cybersecurity framework under which public bodies currently hosting websites and digital applications abroad would be required to transfer them to data centres located within Pakistan.
Mehwish Salman Ali, chief executive officer of Data Vault Pakistan, outlined how this migration should be sequenced, suggesting that data linked to strategic and defence institutions should be prioritised first, followed by public sector bodies, banks and financial institutions, healthcare providers, and the logistics sector. She noted that the government is simultaneously upgrading its ICT infrastructure so that state organisations can access secure computing resources while keeping critical information inside the country and within Pakistani legal jurisdiction.
As part of this broader effort, the National Telecommunication Corporation has entered into a three-year agreement with Data Vault Pakistan to support the migration of data for more than 100 public sector organisations, shifting them from foreign hosting arrangements to domestic data centres. The initiative also includes a gradual upgrade of the country’s artificial intelligence infrastructure alongside the data migration effort.
Pakistan Already Has a Growing Local Foundation
This isn’t starting entirely from scratch. More than 30 data centres are already operational within Pakistan, with public sector institutions including the State Bank of Pakistan and the Pakistan Telecommunication Authority, along with several private companies, having already established local facilities that provide hosting and digital infrastructure services. This existing capacity offers at least a partial foundation on which the broader migration effort can be built.
Industry Voices Call for a Structured, Phased Approach
Ashar Irshad, director of marketing and sales (South) at Sky47, argued that shifting official websites and digital platforms to sovereign local data centres should be treated as far more than a simple technical upgrade. He said the transition should be implemented through a phased national strategy, with critical government systems prioritised and supported by clear data residency policies, modern cloud adoption frameworks, robust cybersecurity standards, and partnerships with local, carrier-neutral, and hyperscaler-ready data centre operators.
He added that this approach could strengthen Pakistan’s digital infrastructure while also fostering investment, innovation, and long-term economic growth, framing the moment as an opportunity for Pakistan to build a resilient, sovereign digital ecosystem where government data stays within national borders while still benefiting from world-class cloud and AI infrastructure. According to Irshad, the focus should be on creating secure, scalable, and future-ready digital platforms capable of supporting the country’s growing digital economy.
Broader Economic Benefits Beyond Security
Beyond the direct cybersecurity gains, officials and industry experts note that local hosting could also help cut foreign exchange outflows tied to paying for overseas hosting services, lower overall data management costs, and improve disaster recovery capabilities for critical systems. Expanding Pakistan’s domestic data centre industry may further encourage both local and foreign investment, generate skilled technology jobs, and support the transfer of advanced technologies into the country’s broader digital ecosystem.
A Long-Standing Vulnerability Finally Being Addressed
This latest push builds on years of growing awareness around Pakistan’s heavy reliance on foreign-hosted infrastructure, an issue that has been flagged repeatedly by officials and industry voices in recent years. Previous statements from Pakistan Telecommunication Authority leadership have similarly highlighted the extent to which the country’s data has remained stored on foreign servers, a vulnerability that successive cybersecurity incidents have only made more apparent over time.
What Comes Next
With a formal cybersecurity framework proposed, a three-year migration agreement already in place covering more than 100 public sector organisations, and existing local data centre capacity to build upon, Pakistan appears to be moving from acknowledging this vulnerability toward actually addressing it at scale. Whether the migration proceeds at the pace envisioned will likely depend on how quickly the government can implement clear data residency policies and secure the infrastructure investment needed to support such a large-scale shift, but the direction of travel is now fairly clear: keeping Pakistan’s most sensitive data within its own borders and its own legal jurisdiction.
