The Asia Internet Coalition (AIC), consisting of major global digital media companies, has raised concerns about “Data localization,” stating it could lead to lower productivity, slower growth, and reduced employment.
The AIC report, “Data Localization in Pakistan,” predicts a 14.7 percent decline in labor productivity by 2025 if the Personal Data Protection Bill, based on its May 2023 draft, is enacted in 2024. This could result in a GDP loss of USD 16.5 billion in the following year, along with a potential loss of 3.2 million jobs due to firms’ and consumers’ reactions to the policy changes.
The report highlights that the current regulatory landscape in Pakistan already requires some data localization, but the new bill would further tighten these measures. The Commission formed under this bill would have broad powers, including the ability to refuse personal data transfers for reasons like “public interest” or “national security of Pakistan.”
Data localization could also negatively impact businesses and the economy. The distinction between sensitive and critical data, along with different compliance processes for the private and public sectors, poses challenges. There are also concerns about cybersecurity, as local providers may not offer the same services as international cloud providers, which benefit from economies of scale. Distributed systems can enhance resilience, making databases less vulnerable to cyber threats and outages.
The report suggests that data localization could increase costs for firms, potentially leading to job losses. While hiring more human resources might seem like job creation, the economic analysis suggests otherwise due to the long-term view of the impact, including potential operational shutdowns if costs become unsustainable. Additionally, skill gaps and the time needed to bridge them could contribute to job losses.
Changes in the policy environment and market could alter these implications. For instance, if an international cloud service provider set up data centers in Pakistan, costs for firms might decrease, though concerns about data security and availability could persist.
Sectoral impacts would vary, with the IT/ITES sectors potentially facing significant challenges that could affect investment and growth. Conversely, impacts on health provision could influence the quality of life for Pakistani citizens. The extent of localization’s impact would depend on the government’s enforcement approach, with lighter enforcement leading to less severe economic effects.
Overall, the report argues that the risks of data localization may outweigh its benefits, as seen by regional peers moving away from such measures. Data localization could significantly increase hosting costs and raise cybersecurity risks, particularly for small and medium-sized firms.
An IT company estimated a 70 percent increase in hosting costs, while an e-commerce retailer projected that a fully locally compliant solution for financial services would cost about ten times more than its current cloud-based solution. The high costs of data localization could disproportionately impact small and medium-sized businesses, and centralized data storage could compromise security benefits provided by a decentralized architecture. Concerns were also raised about disaster recovery and data mirroring under data localization requirements.