Govt Warns Other Countries Could Breach Pakistan’s Sensitive Data Stored Abroad

The National Cyber Emergency Response Team (NCERT) has issued a new cybersecurity advisory warning about the growing risks linked to the use of foreign cloud technology products in Pakistan, particularly Software as a Service platforms used across government, business, and education sectors.

In its advisory, titled Deployment of Cloud Technology Products in Pakistan, NCERT raised concerns over national security, data sovereignty, and regulatory compliance. It warned that data hosted and processed outside Pakistan may be subject to foreign laws that allow compelled disclosure or lawful interception, potentially exposing sensitive government and commercial information.

The advisory specifically pointed to the widespread use of platforms such as Zoho Corporation across sectors, including education, information technology, finance, and small businesses. According to the document, the use of foreign-hosted services increases the risk of unauthorized access to sensitive data, communications, procurement records, and financial information.

NCERT also flagged concerns related to digital surveillance and intelligence risks, noting that foreign cloud platforms may have access to communication metadata, files, location data, and other sensitive records through privileged administrative controls. The advisory said such access could be exploited for unauthorized monitoring or data collection.

The document further highlighted the presence of local implementation partners supporting these foreign services in Pakistan, underscoring the scale of their use and the urgency of risk assessment. It identified a lack of data localization, use of foreign sub-processors, and systems with broad administrative capabilities as key factors increasing vulnerability.

As part of its recommendations, the NCERT urged immediate stakeholder sensitization and called on organizations and regulators to review and gradually discontinue the use of foreign state-linked cloud services where risks are significant. It also recommended promoting Pakistan-based SaaS alternatives with verified local data storage to strengthen cybersecurity and protect national interests.