Can an employee's copying of confidential customer data be a criminal offence?

An employee's copying of confidential customer data can amount to a criminal offence in Pakistan if the specific statutory ingredients are established. It is not automatically criminal merely because the employer regards the information as proprietary or the employee later joins a competitor. Section 4 of the Prevention of Electronic Crimes Act, 2016 addresses unauthorised copying or transmission of data with dishonest intention. Sections 3 and 5 concern different conduct, such as unlawful access or interference, subject to their precise wording.

The contractual and criminal questions should be analysed separately. An NDA can establish relevant restrictions, but a contractual breach alone does not prove every penal ingredient. The company should preserve reliable electronic evidence before issuing accusations or seeking enforcement action.

What data was copied?

Identify the exact spreadsheets, CRM records, database tables, customer contact lists or transaction histories allegedly taken.

Describe why those files were non-public, how they were stored and which staff could access them.

A broad claim that an employee took "company information" may not support a focused investigation.

Section 4: copying or transmission

Section 4 PECA refers to copying or transmitting data without authorisation and with dishonest intention.

The employer should show what was copied or transmitted, from which account or system, and why the act exceeded actual permission.

An export log by itself may establish a technical event but not conclusively resolve every question of authorisation and intention.

An authorised business export

A sales employee may be authorised to download customer orders to complete a legitimate report.

Such a download must be distinguished from secretly transferring a customer list to a personal account for later competing use.

The employment role, company policies, instructions and timing of the event provide context.

Authorisation has boundaries

Permission to view data does not necessarily include permission to retain copies after resignation or share them with an outside business.

The relevant access controls and written employment duties can clarify limits.

An employer cannot simply redefine previously permitted activity as criminal after a personal disagreement without assessing the actual facts.

Dishonest intention

PECA's required mental element should be established through credible surrounding evidence.

Messages proposing a sale of confidential data, concealed transfers or misuse for personal gain may be relevant.

A mistake, routine synchronisation or authorised backup may present a materially different case.

Section 3: unauthorised access

Section 3 concerns unauthorised access under its own statutory conditions.

The employee's authority to log in, and whether access occurred after termination or through a stolen password, may matter.

A company should not automatically plead both sections 3 and 4 without identifying the separate conduct.

Section 5: interference

Section 5 addresses specified unauthorised interference or damage to data or systems.

Deleting, altering or disrupting records requires its own factual and statutory evaluation.

Copying data while leaving the original unchanged is not automatically proof of data destruction or operational sabotage.

Forensic preservation

Secure system logs, email forwarding records, cloud download history, user permissions and departure dates.

A responsible forensic investigator may preserve evidence through controlled collection and chain-of-custody procedures.

Do not allow staff to overwrite accounts or reset the only relevant laptop before securing necessary records lawfully.

Employment and confidentiality duties

Obtain the signed NDA, appointment letter, technology-use policy and termination instructions.

The company may have a continuing contractual right to protect actual confidential information independent of criminal procedure.

A broad post-employment non-compete raises different issues under section 27 of the Contract Act, 1872.

Proving business harm

The employer should distinguish the technical act of copying from the financial consequences it alleges.

A customer export may create risk even before demonstrated revenue loss, but a civil damages claim must establish its own legal and evidentiary basis.

Avoid making unsupported assumptions that every lost customer resulted from the copied spreadsheet.

Proper company authority

The company should identify the officer authorised to lodge complaints and provide records.

Corporate resolutions, delegations and representations can be important where authority is disputed.

Accurate authorisation also protects the company from internal disputes over who may act on its behalf.

Reporting under current cybercrime law

The 2025 PECA amendments affect investigative arrangements. Identify the currently authorised agency and prescribed complaint process.

Submit an objective account with relevant logs, access policy and known suspects rather than a list of speculative statutory offences.

The investigative authority must independently assess whether legal ingredients are established.

Civil injunctions

A company may seek an appropriate order restraining unlawful use or disclosure of defined information under applicable contract and civil remedies.

The order should identify protected data, threatened conduct and legal entitlement.

A company cannot necessarily prohibit all competition simply because a former employee knew its customers.

Recovery or deletion of files

A notice may demand return of company property and lawful deletion of unauthorised copies, with evidence preservation carefully managed.

Immediate destruction of suspected files can conflict with forensic needs. The process should preserve proof before appropriate deletion.

Any undertaking should address backups, recipients and further use precisely.

Personal data considerations

Customer lists may contain CNICs, phone numbers and financial records. The company should minimise further exposure while investigating.

Legal complaints should disclose sensitive material only to the extent necessary and through suitable protected channels.

An incident response plan should also assess contractual and sector-specific obligations owed to customers.

A practical example

An employee downloads a restricted CRM export one hour before resignation and forwards it to a personal email account. Later messages indicate an intention to contact those customers for another company.

These facts may be significant for section 4 and confidentiality claims, subject to proof of permission, actual transmission and dishonest intention.

If the export was part of a documented authorised assignment, the outcome may differ.

Opinion and recommended course

An employee's copying of data can engage PECA section 4 when unauthorised copying or transmission and dishonest intention are proved. Contractual breach alone does not automatically establish cybercrime.

Identify specific data, preserve original logs, assess authorisation and intent, obtain proper company approval and pursue proportionate civil or criminal remedies based on independently sustainable grounds.

Principal authorities: Prevention of Electronic Crimes Act, 2016, sections 3–5 as amended in 2025; Contract Act, 1872; Specific Relief Act, 1877; Qanun-e-Shahadat Order, 1984; applicable employment agreements and corporate authority.