NCCIA and the law
Digital fraud, hacked accounts, identity theft, harassment, the publication of intimate images and theft of corporate information are not identical offences. Each event requires a separate assessment of the conduct, intention, evidence and law. In Pakistan the National Cyber Crime Investigation Agency, or NCCIA, is the specialised federal investigation agency under the Prevention of Electronic Crimes Act, 2016, as amended in 2025. Its specialised status does not make every internet dispute criminal. The first question is whether the facts satisfy the elements of a particular provision of PECA; the second is whether the required evidence is available and was lawfully obtained.
How NCCIA was established
Section 29 of PECA, substituted by the Prevention of Electronic Crimes (Amendment) Act, 2025, establishes NCCIA for the inquiry into, investigation and prosecution of offences specified in PECA. The provision contemplates the transition of the former FIA Cyber Crime Wing's personnel, cases and related matters. It provides for a Director General appointed for a non-extendable three-year term. Investigating officers have functions analogous to officers of equivalent police rank under criminal procedure, subject to PECA's safeguards. Section 30 restricts investigative powers under the Act to authorised officers. The existence of a federal specialised agency must not be confused with an unlimited power to investigate ordinary contractual disputes.
What offences fall within PECA?
Sections 3, 4 and 5 address unauthorised access, copying or transmission of data, and interference with information systems or data. Sections 13 and 14 address electronic forgery and electronic fraud. Section 16 concerns unauthorised use of identity information. Section 20 contains a specific offence concerning the dignity of a natural person, section 21 addresses specified offences against modesty, section 24 addresses cyberstalking, and section 26 concerns spoofing. Other provisions address critical infrastructure, malicious code and child exploitation. The statutory definition of each offence matters more than the label attached to a complaint. A fake account, for instance, may or may not satisfy identity misuse, forgery or fraud depending on the actual acts.
False information and the 2025 amendment
The 2025 amendment introduced section 26A concerning intentional dissemination, public exhibition or transmission through an information system of information that the person knows or has reason to believe is false or fake and that is likely to cause or create fear, panic, disorder or unrest in the general public or society. The maximum prescribed punishment is three years imprisonment, a fine of two million rupees, or both. Those knowledge and public-consequence requirements cannot be ignored. A disagreement, mistaken statement or unpopular opinion is not automatically a proved offence. The amendment also changed section 43's procedural classifications, including for specified offences under sections 13, 14, 20 and 26A.
Cognizable, non-bailable and non-compoundable offences
Section 43 differentiates among offences. Following the amendment, listed offences are cognizable, non-bailable and non-compoundable, whereas other offences follow the classifications prescribed by the section. A cognizable offence may permit investigative steps within the applicable criminal procedure; it does not excuse an unlawful arrest or search. Non-bailable does not mean bail can never be granted by a competent court. Non-compoundable describes the statutory position on compromise, not a rule dispensing with judicial proceedings. The appropriate response to an NCCIA inquiry therefore depends on the exact charge, the facts supporting it, and the present procedural stage.
How a cybercrime complaint is filed
NCCIA's official instructions identify the online complaint form, Pakistan Citizen Portal and Cybercrime Reporting Centres as reporting routes. The complainant should provide their correct particulars, a concise timeline, relevant account names or URLs, available identification of suspects and a clear explanation of the loss or harm. Original messages, emails, payment receipts, bank transaction references and access alerts should be retained. A screenshot is useful but should not be treated as a substitute for all original data. Where a bank account has been targeted, contact the bank using a separately verified channel without delaying evidence preservation. A complaint being submitted is not the same as an offence being established.
An inquiry is not a conviction
The agency may scrutinise an allegation, seek preliminary information and, where grounds exist, proceed to investigation. Criminal prosecution is a distinct phase in which the State must establish the statutory ingredients through admissible evidence. A person's presence at an inquiry, the issuance of a notice or the registration of a case should not be described as a finding of guilt. Corporate disputes call for particular care: a supplier's failure to deliver goods does not by itself prove electronic fraud, while a deliberate false payment instruction could present a different case. A legal response should preserve contracts and correspondence showing what was promised, done and known.
Arrest, remand and bail
Arrest and detention must comply with PECA's relevant provisions, the Code of Criminal Procedure and constitutional safeguards. Article 10 of the Constitution protects persons arrested or detained, while Article 10A addresses fair trial and due process. The statutory classification of the alleged offence and the available record determine the route for seeking pre-arrest or post-arrest bail. Remand must be justified to the competent court; it is not a substitute for punishment. Persons facing an inquiry should obtain the relevant notices and instructions, preserve records, avoid deleting messages and seek legal representation. Attempts to influence witnesses or destroy evidence may substantially worsen the position.
Search and seizure of phones and laptops
PECA contains provisions governing preservation of electronic data, warrants, search, seizure and access to relevant records. Section 33 provides a mechanism for judicial search and seizure warrants in specified circumstances. Section 35 addresses the manner in which investigative powers are exercised, including concerns about proportionality, integrity and confidentiality. A seized business computer may contain client records or unrelated sensitive information. Investigators and counsel should identify the statutory basis, material sought and any available safeguards. The proper response to an overbroad request is a lawful procedural challenge, not unauthorised interference with evidence or an order.
Messages, metadata and forensic proof
Electronic evidence can include email headers, message databases, subscriber information, traffic data, access logs, original files and forensic images. Different provisions and processes apply to content, traffic data and real-time collection. An encrypted platform may not possess readable message contents, and access to data held overseas can require foreign legal cooperation. A screenshot by itself rarely proves who controlled the account. Investigators should examine attribution, possible credential compromise, device access, timestamps, file integrity and independent corroboration. The Qanun-e-Shahadat Order, 1984, and Electronic Transactions Ordinance, 2002, are important parts of the wider evidentiary framework.
Constitutional rights and online speech
Articles 4, 9, 10, 10A, 14 and 19 of the Constitution concern lawful treatment, liberty, detention safeguards, due process, dignity, privacy and expression. They must be read with PECA's actual text. Protecting victims from fraud, harassment and abuse is legitimate, but investigative steps must have lawful authority. Investigations involving journalism, political commentary and contested publications require attention to the knowledge and harm elements of any alleged speech-related offence. Being criticised or embarrassed online is not by itself proof of every PECA charge. Conversely, deliberate impersonation, threats and exploitation do not become lawful simply because they occur on social media.
International incidents and business remedies
PECA contains territorial and extraterritorial provisions that may engage conduct outside Pakistan where the statutory connecting factors exist. Jurisdiction is different from the practical ability to locate a suspect or obtain evidence from a foreign service provider. Businesses suffering a breach should assess both criminal reporting and civil or contractual relief, including preservation orders, confidentiality claims and injunctions where available. An employer should not assume every employee-data dispute is criminal, nor ignore clear evidence of deliberate unlawful access. Parallel proceedings require coordination so that urgent containment does not destroy the evidentiary record needed later.
What complainants and accused persons should do
Victims should preserve originals, record the chronology, notify banks or platforms promptly where necessary, identify a specific statutory offence and keep reports factual. They should avoid publishing private images or publicly naming a suspect on the strength of guesswork. Persons accused should preserve relevant communications, establish the complaint and charge particulars, scrutinise the investigator's authority and assess available judicial remedies with counsel. Both sides should distinguish allegations from forensic findings. For the AI dimension, consult our connected guide on artificial intelligence law and the related article on cyber incident response. Readers should also verify current rules and case law before taking procedural action.
Primary materials
Consult the official PECA amendment published in the Gazette at the National Assembly website and the NCCIA complaint guidance. See also Artificial Intelligence Law in Pakistan and Cyber Incident Response. This commentary is general information, not advice on the facts of a particular case.
General information only. No advice is given on any particular matter.