PAKISTAN CLOUD FIRST POLICY PSE shall consider how any data on the cloud can be retrieved and returned when the contract for cloud services expires. They shall ensure that the CSP specifies how data will be transferred back if required and agree on a timeline, which shall be included within the contract. Most importantly, all PSE shall instruct that the copies of the data will be deleted, overwritten, or otherwise rendered inaccessible upon expiration or termination of a contract. Moreover, CSP shall adhere to data protection regulations of GOP. CSP must not have the access or capability to monitor government data and content, maintaining strict adherence to the level of confidentiality, integrity and availability. Date of Application and Validity This policy becomes effective by the date it is provided approval by the competent authority. The policy is subject to holistic review as and when required Annex-F: Minimum Suggested Requirements for Contracts Page 15 of 21