وَلَا يَجْرِمَنَّكُمْ شَنَآنُ قَوْمٍ عَلَىٰ أَلَّا تَعْدِلُوا ۚ اعْدِلُوا هُوَ أَقْرَبُ لِلتَّقْوَىٰ
“Protecting your digital rights with legal precision.”
In today’s digital world, cybercrimes are increasing rapidly, affecting individuals, businesses, and organizations alike. Our firm provides expert Cybercrime Legal Services in Pakistan, offering strong legal defense and support in matters involving online fraud, data theft, defamation, digital harassment, hacking, and electronic evidence.
We represent clients before the Federal Investigation Agency (FIA) and relevant courts, ensuring their digital rights and privacy are protected. Whether you are a victim seeking justice or facing false allegations under cybercrime laws, our experienced team delivers confidential, strategic, and effective representation.
Our Cybercrime Legal Services include:
Defense and prosecution in cybercrime cases
Representation before FIA and Cybercrime Courts
Legal assistance in data theft and hacking matters
Online fraud, identity theft, and defamation cases
Digital harassment and privacy violation complaints
Cyber law compliance and advisory services
📌 Why choose us?
We combine legal expertise with a deep understanding of technology to protect your rights, reputation, and digital security.
Qadir Chambers · Lahore, Karachi, Islamabad
Online harassment and blackmail. A hacked account or a drained one. An allegation under the Prevention of Electronic Crimes Act 2016 that arrived without warning. Whichever side of it you are on, the first forty-eight hours decide more than anything that follows — and since 2025 the agency you report to has changed.
Confidential. Nothing is reported, filed or disclosed to anyone until you decide it should be.
Free help, if you want it before you speak to a lawyer: Digital Rights Foundation cyber harassment helpline 0800 39393 · Ministry of Human Rights 1099 · Punjab Women's Helpline 1043 · Police 15.
Cybercrime law update
Almost every Pakistani guide to cybercrime still tells you to report to the FIA Cyber Crime Wing. That guidance is out of date, and following it costs people weeks.
The Prevention of Electronic Crimes (Amendment) Act 2025 — Act No. II of 2025, published in the Gazette on 29 January 2025 and signed on 30 January 2025 — created the National Cyber Crime Investigation Agency and vested cybercrime investigation powers in it. Before the amendment, PECA authorised the Federal Investigation Agency to investigate these offences. Complaints under the Act are now directed to the NCCIA rather than the FIA's Cyber Crime Wing.
The same amendment created the Social Media Protection and Regulatory Authority, with powers to monitor and regulate platforms and to require removal of content treated as unlawful, and it inserted a new offence at section 26A.
Section 26A penalises intentionally disseminating information the person knows or has reason to believe is false, and which is likely to cause fear, panic, disorder or unrest. The maximum penalty is three years' imprisonment, a fine of up to two million rupees, or both.
We will not pretend this provision is settled. It has drawn sustained criticism from press bodies and from the National Commission for Human Rights, it has been the subject of legal challenge, and the courts are still working out how it should be read. It is also being used: the NCCIA has summoned journalists under it. If a notice under section 26A has reached you, the position is arguable and it should be argued properly, not answered off the cuff.
PECA is broad, and the section that applies determines everything that follows — whether the offence is bailable, whether it can be compounded, and how quickly anything happens.
Images or videos obtained from a relationship, a hacked account, or a device that was repaired.
PECA sections 20 and 21
Section 20 covers offences against the dignity of a natural person; section 21 covers offences against the modesty of a natural person and of a minor. These are among the gravest offences in the Act, and unlike most of PECA they sit outside the general bailable and compoundable rule.
Section 21 is non-compoundable
Repeated messages, monitoring of your accounts, or your photographs being used without permission.
PECA section 24 — cyber stalking
Using an information system to coerce, intimidate or harass a person. The penalty extends to three years' imprisonment or a fine of up to one million rupees, or both — and where the victim is a minor, to five years or a fine of up to ten million rupees.
Up to 3 years · Rs 1,000,000
A social media account taken over, a company inbox accessed, data copied out.
PECA sections 3, 4 and 19
Unauthorised access to an information system, unauthorised copying or transmission of data, and unauthorised interception are separate offences. Section 19 alone carries up to two years' imprisonment or a fine of up to five hundred thousand rupees.
A fake profile in your name, a spoofed payment instruction, a business email compromised.
Electronic fraud, forgery and identity offences
PECA separately addresses electronic forgery, electronic fraud, and the unauthorised use of identity information. Where money has moved, the criminal complaint and the civil recovery are two different exercises and should be run as such.
Grooming, solicitation, or material involving a minor.
PECA sections 22, 22A, 22B and 22C
The Act deals specifically with material involving children, with online grooming, solicitation and cyber enticement, with commercial sexual exploitation, and with use of an information system for the kidnapping, abduction or trafficking of a minor. Report immediately and preserve everything; we act for families and for children affected.
An NCCIA summons, a complaint by a business rival, or an allegation arising from something you posted.
PECA section 43 — bail and compounding
Most PECA offences are non-cognizable, bailable and compoundable. The exceptions are the serious ones — cyber terrorism under section 10, offences against modesty under section 21, and child-related material under section 22. Knowing which side of that line an allegation falls on is the first question to answer.
Most offences are bailable
A defamatory post, a leaked image, a fake page trading on your name or your brand.
Removal and blocking of unlawful content
PECA provides for the removal or blocking of unlawful online content, and the 2025 amendment placed further powers in the Social Media Protection and Regulatory Authority alongside the Pakistan Telecommunication Authority. Platform-level reporting and the statutory route often need to run in parallel.
This is the part of a cybercrime case that a client controls entirely, and the part most often mishandled in the first hour. Accounts get deleted. Chats get cleared in distress. Screenshots get cropped to hide something embarrassing, and in doing so remove the only thing identifying the sender.
| Capture | Why it matters |
|---|---|
| Full screenshots | Showing the sender's username or number, the timestamp, and the platform interface — not a cropped image of the text alone |
| Complete URLs | The full link to a profile, post or page, copied as text rather than photographed |
| Original files | The original image or video file, not a re-shared or re-compressed copy, since metadata is often stripped in transit |
| Call and message logs | Exported where the platform allows it, rather than reconstructed from memory later |
| Financial records | Transaction references, account details and timings where money has moved |
| A written timeline | Dates, times and what happened — written while you still remember it clearly |
Two cautions from practice. Do not confront the other party in a way that produces messages you would rather a court did not read. And do not close the account the material is on — however strong the urge — until the evidence has been secured, because once it is gone the platform will rarely retrieve it for you.
Two very different kinds of file come through this practice, and they need different handling from the first day.
Urgent advice for people being threatened with the publication of images or private material, including complaint drafting, takedown steps, and handling the matter without widening the disclosure.
Complaints under section 24 of PECA, with the evidential record assembled properly before filing, and coordination with protection remedies where the harassment is coming from within the family.
Preparing and filing cybercrime complaints with the National Cyber Crime Investigation Agency, following them up, and escalating where an investigation stalls.
Representation where a notice, complaint or FIR names you — including bail, the compoundability question under section 43, and challenging complaints brought to settle a commercial or personal score.
Advice and representation where a notice concerns allegedly false information. The provision is contested and the response should be drafted, not improvised.
Unauthorised access, copying of data, and electronic fraud affecting a business — run alongside the civil recovery and any employment or contractual issue.
Takedown and blocking of unlawful content through the statutory route and at platform level, including defamatory posts, impersonation pages and leaked material.
Acting under a special power of attorney where the offender, the victim or the evidence sits in Pakistan and you do not. We handle the filings and attend on your behalf.
You do not need to know which section of PECA applies. Working that out is the job.
You tell us what has happened. Nothing is reported or filed, and nothing is disclosed to anyone, until you decide.
Before anything else. Captures, URLs, original files and a written timeline, assembled in a form that will hold up.
Which PECA provision applies decides whether the offence is bailable, whether it can be compounded, and how it will be investigated.
Filing with the NCCIA and pursuing it, or responding to a notice, complaint or FIR that names you.
Removal of content rarely waits for the criminal case. Platform reporting and the statutory route are run alongside each other.
Trial, compounding where that is genuinely in your interests, or the civil claim where money needs recovering.
Cybercrime law in Pakistan changed substantially in 2025 and is still moving. Rather than ask you to take our word for what the law says, here is what this page is built on and when it was last checked.
Pakistan has no enacted data protection statute. The Personal Data Protection Bill 2023, and a later draft prepared in 2025, remain unpassed. Any page telling you that Pakistan has a data protection law in force is wrong, and a data breach is currently addressed through PECA and through contract rather than through a dedicated privacy regime.
Section 26A is contested and its interpretation is not settled. We say so on this page rather than presenting it as clear law.
This page is reviewed quarterly and immediately on any amendment or superior court ruling affecting the provisions above. The review date appears at the foot of the page.
If your question is not here, ask it in person. Most people find the position is better than they feared.
Do not pay, and do not delete anything. Payment confirms you will pay and the demands continue. Capture full screenshots showing the sender's identifier, the timestamp and the platform, save the complete URLs as text, and write down a timeline while it is fresh. Then take advice before responding further. Offences against the modesty of a natural person fall under section 21 of the Prevention of Electronic Crimes Act 2016, which is among the provisions excluded from the general rule that PECA offences may be compounded.
To the National Cyber Crime Investigation Agency. The Prevention of Electronic Crimes (Amendment) Act 2025 created the NCCIA and vested cybercrime investigation powers in it, replacing the arrangement under which the Federal Investigation Agency's Cyber Crime Wing investigated these offences. A great deal of online guidance still names the FIA, which is why complaints are sometimes filed in the wrong place and lose weeks.
It is a criminal offence. Section 24 of PECA makes it an offence to use an information system to coerce, intimidate or harass a person, with a penalty extending to three years' imprisonment or a fine of up to one million rupees, or both. Where the victim is a minor the penalty extends to five years, or a fine of up to ten million rupees. Separate provisions address offences against dignity and against modesty.
Usually the two run in parallel rather than one after the other. PECA provides for removal or blocking of unlawful online content, and the 2025 amendment placed further powers in the Social Media Protection and Regulatory Authority alongside the Pakistan Telecommunication Authority. Platform-level reporting is often faster in the first instance, and we pursue both.
Your consultation is confidential, including from your family. This is the concern that keeps most blackmail victims from getting help, and it deserves a direct answer: we will explain which steps are visible to whom, and what can be done without widening the circle, before anything is filed.
Two, and they need running separately. Unauthorised access to an information system, unauthorised copying of data and unauthorised interception are criminal offences under PECA, with section 19 alone carrying up to two years' imprisonment or a fine of up to five hundred thousand rupees. Recovering the money is a civil matter. A criminal complaint is not a recovery mechanism, and treating it as one is a common and expensive mistake.
Take advice first. What you say at that stage becomes part of the record, and an explanation given informally cannot be withdrawn later. We will establish which provision is being invoked, whether the offence is bailable and compoundable, and what should and should not be said before you attend.
Most of them are. Section 43 provides that offences under the Act are non-cognizable, bailable and compoundable, with exceptions for the serious provisions — cyber terrorism under section 10, offences against modesty under section 21, and child-related material under section 22. Which provision is alleged therefore determines a great deal about what happens next.
Many can. Section 43 makes most offences under the Act compoundable, subject to the exceptions noted above. Whether compounding is in your interests is a separate question from whether it is available, and it is worth taking advice rather than agreeing terms under pressure from an intermediary.
Yes. PECA complaints are sometimes used as leverage in commercial and personal disputes, and the elements of the offence still have to be made out. We test whether the alleged conduct actually falls within the section relied on, and address the underlying dispute in the proper forum rather than allowing it to be litigated through a criminal complaint.
Section 26A, inserted by the 2025 amendment, penalises intentionally disseminating information the person knows or has reason to believe is false and which is likely to cause fear, panic, disorder or unrest. The maximum penalty is three years' imprisonment, a fine of up to two million rupees, or both. It has been criticised by press bodies and by the National Commission for Human Rights, it is the subject of legal challenge, and its scope is not settled — which means a notice under it is arguable and should be answered with advice.
Full screenshots showing the sender's identifier and the timestamp rather than cropped images of text, complete URLs copied as text, the original image or video files rather than re-shared copies, exported message and call logs where the platform permits, financial records where money has moved, and a written timeline. Capture it before you do anything else, because it is the part of the case entirely within your control.
Not before the evidence is secured. Deleting an account removes the record, not the problem, and platforms will rarely retrieve it for you afterwards. The impulse is completely understandable, and it is the single most common way a strong case becomes a difficult one.
Not at present. The Personal Data Protection Bill 2023, and a later draft prepared in 2025, remain unenacted. Data misuse is currently addressed through the criminal provisions of PECA and through contract, rather than through a dedicated privacy statute. Any guide telling you otherwise is out of date.
Electronic evidence is dealt with under the Qanun-e-Shahadat Order 1984, and how material is captured and produced affects the weight it carries. This is why the manner of capture matters as much as the content: a full screenshot showing the identifier and timestamp does work that a cropped image cannot.
Yes, under a special power of attorney. We act for clients in the United Kingdom, the Gulf, North America and Europe where the offender, the victim or the evidence is in Pakistan, handle the filings, and attend on your behalf.
It varies with the provision alleged, whether the accused is identified, and whether platforms cooperate with requests for information. A takedown can move in days while the criminal case takes considerably longer. We will give you a realistic picture at the first meeting rather than a figure designed to reassure.
Evidence disappears, content spreads, and accounts get deleted in the moment of panic. A single confidential conversation will tell you what to preserve, which provision applies, and whether to report, defend or take down first.
Every consultation is confidential. Your privacy comes first.