CHAPTER I PRELIMINARY 1 SHORT TITLE, EXTENT AND COMMENCEMENT. 1.1 This Act may be called the Personal Data Protection Act, 2020. 1.2 It extends to the whole of Pakistan. 1.3 It shall come into force after one year from the date of its promulgation or such other date not falling beyond two years from the date of its promulgation as the Federal Government may determine through a notification in the Official Gazette providing at least three months advance notice of the effective date. 2 DEFINITIONS. In this Act, unless there is anything repugnant in the subject or context,─ a) “data subject” means a natural person who is the subject of the personal data; b) “personal data��� means any information that relates directly or indirectly to a data subject, who is identified or identifiable from that information or from that and other information in the possession of a data controller, including any sensitive personal data. c) d) e) f) Provided that anonymized, encrypted or pseudonymized data which is incapable of identifying an individual is not personal data. “data controller” means a natural or legal person or the government, who either alone or jointly has the authority to make a decision on the collection, obtaining, usage or disclosure of personal data.; “data processor” means a natural or legal person or the government who alone or in conjunction with other(s) processes data on behalf of the data controller. “Anonymized Data” means information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. ” processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; g) “third party”, in relation to personal data, means any person other than— (i) a data subject; (ii) a relevant person in relation to a data subject; (iii) a data controller; (iv) a data processor; or (v) a person authorized in writing by the data controller to process the personal data under the direct control of the data controller; h) “ filing system” means any set of data structured according to specific criteria suitable for accessing and/or processing of data; i) “relevant person” in relation to a data subject means (a) in the case of a data subject 4