Pakistan Outbound Compliance: PTA (2026)

Quick answer

Outbound marketing calls and messages in Pakistan are regulated by the Pakistan Telecommunication Authority (PTA) under the Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communication Regulations, 2009, as amended in 2020 and 2022, with criminal backing from the Prevention of Electronic Crimes Act, 2016. The consent model is express opt-in taken before any marketing, recorded by the telemarketer, and screened against a Central Do Not Call Register that subscribers join and leave through the short code 3627. PTA publishes no clock hours: the regulations say only that communications must reach subscribers within "normal business hours", a phrase none of the three instruments defines, so treat the window as a policy decision you document rather than a published range.

Pakistan is an unusual market to plan for. The rulebook is detailed about who may send, on what channel, and how a subscriber opts out, and almost silent about the two things a dialler team asks first: what hours may we call, and what happens if we get it wrong. This guide separates what PTA has published from what it has not, so you can configure a campaign without inventing a rule.

At a Glance

Item	Position in Pakistan
Regulator	Pakistan Telecommunication Authority (PTA), پاکستان ٹیلی کمیونیکیشن اتھارٹی, established under section 3 of the Pakistan Telecommunication (Re-organization) Act, 1996
Law and date	Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communication Regulations, 2009, S.R.O. 713(I)/2009, signed 31 July 2009 and published in the Gazette of Pakistan Extraordinary on 5 August 2009; Amendment Regulations 2020, gazetted 14 September 2020; 2nd Amendment Regulations 2022, gazetted 31 December 2022; Prevention of Electronic Crimes Act, 2016
Licence needed	A telemarketer must be authorised by PTA, and registration is executed through the operators rather than directly by PTA. Telemarketers contract with CVAS registration holders or mobile operators, and the SLA is produced to PTA on demand. Whether a telemarketer holds a PTA licence of its own is not published
Calling hours (time zone)	Not published as clock hours. Regulation 4(3) requires only that communications be received by subscribers "within normal business hours", and the phrase is undefined in the 2009, 2020 and 2022 instruments. No time zone is named in any of them and no day-of-week or public-holiday restriction appears
Consent model	Express opt-in sought before marketing, requested in English and Urdu through the messaging channel, with the telemarketer responsible for keeping the record of individual consent in case of dispute. Every marketing message must carry an unsubscribe option
Do Not Call list	Yes. A Central Do Not Call Register (C-DNCR) covering calls and A2P promotional SMS, joined and left through the PTA-designated short code 3627. The register is established, maintained and funded by the operators, and registered telemarketers are given access limited to the subscriber's number and area code
Caller ID rule	Marketing traffic must run on short codes or alphanumeric IDs allocated by PTA and obtained through an aggregator or CVAS registration holder. Robocalls are permitted only for public awareness required by PTA or the Government. A reserved voice prefix for telemarketing is not published. Spoofing a source is a separate PECA offence
Recording rule	Not published. No call-recording notice, consent duty or retention period appears in the 2009, 2020 or 2022 regulations, or in PECA sections 21 to 23. That is a negative from the instruments read, not a confirmation that no duty exists, so confirm before relying on it
Data protection law	None in force. The Ministry of Information Technology and Telecommunication's legislation register lists Personal Data Protection Bills of 2018, 2020 and May 2023, each with status "Draft" and no notification number. Operators owe a confidentiality duty under regulation 15 of the 2009 Regulations
Penalties	Disconnection is the operative sanction against a telemarketer. PECA section 22 fines unsolicited communication or direct marketing without an unsubscribe option at up to PKR 50,000 first time and PKR 50,000 to 1 million for each later breach, and misleading or harmful spam at up to three months' imprisonment or PKR 50,000 to 5 million or both. Against a licensee, PTA may levy a fine up to PKR 350 million
Frequency caps	Not published as a daily or weekly cap. The only frequency rule is that operators must act against a telemarketer involved in sending an unsolicited call more than three times consecutively, followed by disconnection

Who Regulates Outbound Calling in Pakistan

The Pakistan Telecommunication Authority is the regulator, established under section 3 of the Pakistan Telecommunication (Re-organization) Act, 1996, and the anti-spam regulations define "Authority" by reference to that section. The instrument that matters for outbound work is the Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communication Regulations, 2009, made under S.R.O. 713(I)/2009 and in force from the date of its gazette notification on 5 August 2009. Two amendments have reshaped it since: one gazetted 14 September 2020 and a second gazetted 31 December 2022.

There is no obvious front door. The 2022 amendment defines a telemarketer as a person "who is authorized by the Authority to disseminate Messages/ Calls for the purpose of marketing", but the registration itself is executed through the operators: all operators must, for the purpose of controlling unsolicited communication, ensure registration of telemarketers. The commercial route follows the same logic. A telemarketer enters into agreements with CVAS registration holders or mobile operators, the SLA is provided to PTA on demand, and the marketing traffic runs on short codes or alphanumeric IDs that PTA has allocated. Whether a telemarketer can hold any PTA licence of its own, and by what application route, is not published, so budget time for the operator conversation rather than for a regulator application.

Consent and Opt-Out

Pakistan runs on express opt-in, and the amendment of 2022 made the mechanics explicit. Operators must devise a procedure that gives every subscriber the opportunity to give express consent for receiving telemarketing communication, and all telemarketers working through an SMS aggregator must seek individual consent by message, in English and Urdu, before sending any marketing communication.

The instrument even fixes the wording. The consent message offers the subscriber a choice between "To receive marketing msg; enter: Sub" and "Not to receive marketing msg: send msg to 3627". That second half is important: the prescribed opt-out route is the same short code as the national do-not-call register, so an opt-out and a register entry are the same act from the subscriber's point of view.

The evidence duty sits on you, not on the operator. The regulation states plainly that the telemarketer shall be responsible to keep record of individual consent in case of any dispute, and says nothing about the format, the retention period or the audit standard. Your own consent record is the only thing standing between you and an unanswerable complaint, so build it to survive a dispute a year later.

Two further duties run alongside. Every marketing or promotional message sent to someone who opted in must carry an option to unsubscribe, and the same duty exists in criminal law: section 22(2) of PECA requires a person or organisation engaged in direct marketing to provide the recipient with an option to unsubscribe. Separately, operators must ensure subscribers are well informed about the option to enter their particulars in the do-not-call register at the time of subscription.

What the rules do not say is how long a consent lasts. No instrument sets an expiry, and none requires consent to be evidenced separately for voice and for SMS; the texts speak of "Messages/ Calls" together. Treat consent age as your own policy, and record the channel anyway.

Do-Not-Call

Pakistan has a real national register. The 2022 amendment substituted regulation 7 to require all operators to establish a consolidated and central Do Not Call Register, and to give subscribers the option to register and unregister through the short code 3627 designated by PTA. The register is defined to cover unsolicited communication "through any means including Application to Person (A2P) promotional/ telemarketing SMSs and Calls", so it is not an SMS-only list.

The register is operator-run and operator-funded. The 2009 Regulations require operators to establish, maintain and operate the database at their own cost, within 90 working days of notification, and to provide a toll-free number or a provision on the existing helpline for registering subscriber requests. Telemarketers get access, but narrow access: the operator's procedure must provide timely, accurate and uninterrupted access to registered telemarketers, a verification procedure for the telemarketer to follow, and a restriction limiting what the telemarketer can see to the number and area code of the subscriber only.

Two timings belong in your process design. Operators must update the register within two working days of a subscriber's request, and a subscriber may only revoke a registration after the expiry of a minimum of 30 days from the date of that request. There is no mandated scrubbing frequency for your own list, which means the two-working-day operator update is the freshness you can rely on and anything longer is your own risk.

PTA also publishes adjacent consumer short codes that your quality team should recognise in complaint traffic: 420 for obnoxious communication, 3627 for unsolicited communication and the do-not-call register, and 9000 for spam reporting.

Calling Hours and Days

This is the single most important thing to get right about Pakistan, and it is a negative. The regulations impose an obligation without a number. Regulation 4(3) carries a proviso that all operators shall ensure that communications are received by subscribers within normal business hours, and the 2022 amendment re-enacted it word for word. The phrase "normal business hours" is not defined anywhere in the 2009, 2020 or 2022 instruments.

No clock definition was located, no time zone is named in any of the three instruments, and no day-of-week or public-holiday carve-out appears in any of them. Anyone who quotes you a Pakistani calling window as a regulator-sourced rule is quoting something other than these regulations. The practical answer is to pick a conservative window, write down why you picked it, and hold it in configuration so it can change the day PTA publishes a definition.

Frequency is treated the same way. No instrument sets calls per day or per week; the only frequency-shaped rule is that operators must act against a telemarketer involved in sending an unsolicited call more than three times consecutively, followed by disconnection of the telemarketer's telephone subscription.

Caller ID and Number Presentation

The regulations approach number presentation from the messaging side. Telemarketers must enter into SLAs with SMS aggregators or mobile operators specifying the nature of the services provided through short codes or alphanumeric IDs allocated by PTA, and all messages must be disseminated through approved short codes or alphanumeric IDs. The 2009 Annex-A carried a blunter version of the same idea, requiring all businesses to use PTA-registered short codes for marketing campaigns, but the 2022 amendment substituted Annex-A wholesale and the replacement does not carry that item; the duty now lives in the amended regulation 6.

For voice, the notable rule is a prohibition rather than a numbering scheme. The 2022 amendment defines a robocall as a phone call that uses a computerised system to deliver a pre-recorded public awareness message, and new regulation 6(A) allows operators to enable transmission through robocalls only for public awareness to consumers as required by PTA or the Government of Pakistan. In practice that closes pre-recorded commercial broadcast as an option in Pakistan and leaves agent-answered and conversational calling.

A reserved voice prefix or distinguishing range for telemarketing, the analogue of India's 140 series, is not published; no instrument reached creates one. Rules on withheld or anonymous caller ID presentation are likewise not published. What is certain is the downside of getting identity wrong: section 23 of PECA makes it an offence to send information with a counterfeit source intended to be believed authentic, punishable by up to three years' imprisonment or a fine up to PKR 500,000.

Call Recording and Notices

No call-recording notice duty, consent duty or retention period for telemarketing calls appears in the 2009, 2020 or 2022 regulations, or in PECA sections 21 to 23. That is a negative taken from the instruments actually read, not proof that no such duty exists elsewhere in Pakistani law, and it is the kind of gap that a sectoral banking or insurance rule often fills quietly.

There is no data-protection statute in force to fall back on either. The prudent position is to announce recording at the start of the call anyway, keep the announcement in the language of the conversation, retain recordings for a period you can justify, and confirm the position with PTA and local counsel before treating the silence as permission.

Messaging Rules for SMS and WhatsApp

Messaging is where the Pakistani regime is most prescriptive, and the requirements stack. Marketing messages go out on PTA-allocated short codes or alphanumeric IDs, obtained through an SMS aggregator or CVAS registration holder under an SLA that PTA may call for. Individual consent is sought by message in English and Urdu before any marketing content. Every message carries an unsubscribe route, and the prescribed one points at 3627. The do-not-call register expressly covers A2P promotional and telemarketing SMS as well as calls, so the same screening applies to both channels.

The regulations do not name WhatsApp or other over-the-top channels. The short-code and aggregator machinery is built around the operator network, so it does not map cleanly onto a business messaging API. The safe reading is that the consent, unsubscribe and do-not-call duties are channel-neutral in intent, and that the numbering and aggregator duties are specific to operator messaging. Confirm the treatment of over-the-top channels with PTA rather than assuming either answer.

Data Protection and Retention

Pakistan has no general personal-data-protection statute in force. The Ministry of Information Technology and Telecommunication's own legislation register lists three Personal Data Protection Bills, dated 2 July 2018, 9 April 2020 and 1 May 2023, and every one of them carries the status "Draft" with no notification number, on a page whose footer reads 2026. The May 2023 draft would create a National Commission for Personal Data Protection, would require an adequate legal regime or explicit consent before transferring personal data abroad, and would require critical personal data to be processed on infrastructure inside Pakistan. None of that is law today.

One consequence matters more than the rest. The draft bill contains no direct-marketing provision at all, so even if it is enacted in its current shape, marketing consent in Pakistan will continue to rest on the PTA regulations and on PECA rather than on data-protection law. What is in force is narrow: regulation 15 of the 2009 Regulations requires every operator to ensure the confidentiality of all information disclosed by subscribers under those regulations. No statutory retention period for marketing contact data appears in any in-force instrument located, so retention is a policy you set and defend.

Penalties and Enforcement

The sanction that actually reaches a telemarketer is disconnection, not a fine tariff. Unregistered telemarketers face disconnection by the operator after seven working days' notice. A telemarketer involved in sending unsolicited calls more than three times consecutively faces disconnection of its telephone subscription, and operators must maintain an up-to-date blacklist of terminated telemarketers with their antecedents. For obnoxious communication, a repeat offence after a first warning obliges the operator to suspend the originator's subscription immediately and no later than 24 hours after the complaint, with permanent blocking for further instances. No published schedule of administrative fines aimed specifically at telemarketers was located.

The money sits in two other statutes. Under PECA, spamming that involves misleading, fraudulent or harmful content is punishable by imprisonment up to three months or a fine of PKR 50,000 rising to PKR 5 million, or both. Sending unsolicited information, or conducting direct marketing without an unsubscribe option, carries a fine not exceeding PKR 50,000 for a first breach and not less than PKR 50,000 rising to PKR 1 million for every later one. One caution on citation: PTA's own 2022 amendment refers to spamming as section 25 of PECA, while the National Assembly's published text as passed places spamming at section 22. Cite the substance rather than the section number.

Against a licensed operator the numbers are larger. Where a licensee contravenes the Act, rules or licence conditions and fails to remedy after a show-cause notice, PTA may levy a fine extending to PKR 350 million, or suspend or terminate the licence, impose additional conditions or appoint an administrator where the contravention is grave or persistent. General offences under the Act carry imprisonment up to three years or a fine up to PKR 10 million or both. Those figures matter to a dialler because your traffic rides on someone else's licence.

What Changed in 2025 and 2026

Very little, and that itself is the finding. No new PTA anti-spam instrument dated 2023, 2024, 2025 or 2026 was located; the most recent amending instrument is the 2nd Amendment Regulations, 2022, gazetted 31 December 2022. An archive index of PTA's own site covering spam, unsolicited, telemarketing, robocall and nuisance terms returns nothing later. That is a negative drawn from an index of the regulator's site while the site itself was unreachable, so it is not proof that nothing newer exists.

On the data side, the Personal Data Protection Bill was still a draft in 2026. The Ministry's news feed runs to 1 September 2026 and carries no enactment announcement; the nearest legislative item concerns a fresh bill on the telecommunications reorganisation act. The Ministry does publish a Data Governance Policy dated June 2026, but that is a policy document rather than a statute and its effect on telemarketing is not published. Whether PTA issued any enforcement determination or circular on telemarketing in 2025 or 2026 could not be confirmed; the archived operator determinations on spamming that were located are all dated 26 October 2021.

How the Platform Supports Each Rule

DialerBee provides compliance-supporting controls that help you meet the obligations above. Pakistan does not ship as a jurisdiction pack, so calling hours, do-not-call handling and consent are configured per tenant. The legal responsibility stays with the operator of the campaign.

Pakistani rule	Control that supports it
Communications received within "normal business hours", undefined	Calling windows configured per tenant and applied before the call is originated, so your chosen window is enforced and auditable
Express opt-in taken before marketing	Consent created, updated and revoked as auditable records
Telemarketer keeps the record of individual consent for disputes	An audit trail on every rule override, with auditor export
Screening against the C-DNCR, joined through 3627	Your do-not-call list is imported once, then searched and checked on every attempt
Opt-out honoured without waiting for a list refresh	A revocation takes effect on the next attempt, not the next list refresh
Marketing runs on PTA-allocated short codes and IDs	SMS sent under your own sender IDs from a reviewed template library
Numbers and identity you can prove are yours	Caller-ID pools owned exclusively per tenant, mapped per campaign with verified ownership, provisioned through your own carriers under BYOC
Robocalls reserved to public awareness	Campaign modes chosen per campaign, so pre-recorded broadcast can be disabled for the market
Recording position not published, so retention is yours to justify	Recording with configurable retention, signed-URL playback, legal hold and per-tenant isolation
Consent requested in English and Urdu	Language-aware AI across 11 languages, with UCS-2 aware SMS segment counting

Pakistan Outbound Compliance Checklist

Get authorised as a telemarketer through an operator or CVAS registration holder before you dial or send.
Sign the SLA specifying the services delivered through PTA-allocated short codes or alphanumeric IDs, and keep it ready for PTA on demand.
Obtain express opt-in before any marketing communication, requested in English and Urdu.
Store the individual consent record yourself, with timestamp, channel and wording, and keep it retrievable for a dispute.
Put an unsubscribe option in every marketing message, and point it at the prescribed 3627 route.
Register for access to the Central Do Not Call Register and run the operator's verification procedure before each campaign.
Set your own rescrub cadence, since PTA mandates none, and note that the operator's own update duty is two working days.
Choose a conservative calling window, document why you chose it, and hold it in configuration rather than in a spreadsheet.
Remove pre-recorded broadcast calling from Pakistani campaigns; robocalls are reserved to public awareness required by PTA or the Government.
Never present a counterfeit or misleading source on a call or message.
Announce call recording at the start of the call even though no duty is published, and set a retention period you can defend.
Watch for complaint traffic on 420, 3627 and 9000 and treat a rise as an early warning of disconnection.
Keep operator disconnection risk on your continuity plan, since it is the sanction that reaches telemarketers first.
Review the position when PTA next publishes, and do not treat today's silence on hours or recording as permanent.

Sources

Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communication Regulations, 2009, S.R.O. 713(I)/2009, Gazette of Pakistan Extraordinary, 5 August 2009. PTA gazette PDF, archived copy
Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communication (Amendment) Regulations, 2020, Gazette of Pakistan Extraordinary, 14 September 2020. PTA gazette PDF, archived copy
Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communication (2nd Amendment) Regulations, 2022, Gazette of Pakistan Extraordinary, 31 December 2022. PTA gazette PDF, archived copy
Prevention of Electronic Crimes Act, 2016, text as passed by the Majlis-e-Shoora, sections 22 and 23. National Assembly of Pakistan
Pakistan Telecommunication (Re-organization) Act, 1996, sections 23 and 31. Ministry of Information Technology and Telecommunication
Ministry of Information Technology and Telecommunication, Legislations register listing the Personal Data Protection Bills of 2018, 2020 and 2023 as drafts, accessed 11 September 2026. MoITT Legislations
Final Draft Personal Data Protection Bill, May 2023, clauses 2, 31, 32 and 50. MoITT draft bill PDF
PTA public notice on short codes 420 for obnoxious communication, 3627 for unsolicited communication and the DNCR, and 9000 for spam reporting. PTA notice, archived copy

Note on sourcing: pta.gov.pk did not respond during research, so PTA's own gazette PDFs were read from an archived capture of PTA's own site. The documents are the regulator's text, not a third-party summary.

Frequently Asked Questions

What are the legal calling hours in Pakistan?

There is no published clock window. Regulation 4(3) of the 2009 Regulations requires operators to ensure that communications are received by subscribers within normal business hours, and the 2022 amendment re-enacted that proviso word for word, but the phrase is not defined in the 2009, 2020 or 2022 instruments. No time zone is named and no day-of-week or public-holiday rule appears. Choose a conservative window, document the reasoning, and confirm with PTA before launch.

Does Pakistan have a Do Not Call register?

Yes. The 2022 amendment requires all operators to establish a consolidated and central Do Not Call Register and to let subscribers register and unregister through the PTA-designated short code 3627. It covers unsolicited communication through any means, including application-to-person promotional and telemarketing SMS as well as calls. Operators must update it within two working days of a subscriber request, and a subscriber may only revoke a registration after a minimum of 30 days.

Do I need a licence to run a telemarketing campaign in Pakistan?

You need to be authorised by PTA as a telemarketer, but the registration is executed through the operators rather than directly by the Authority. Telemarketers enter into agreements with CVAS registration holders or mobile operators, and the SLA is produced to PTA on demand. Whether a telemarketer can hold a PTA licence of its own, and the application route for it, is not published.

Are robocalls allowed in Pakistan?

Not for marketing. The 2022 amendment defines a robocall as a call using a computerised system to deliver a pre-recorded public awareness message, and new regulation 6(A) allows operators to enable robocall transmission only for public awareness to consumers as required by PTA or the Government of Pakistan. Commercial pre-recorded broadcast therefore has no lawful route, which leaves agent-answered and conversational calling.

How must consent be obtained and kept in Pakistan?

Consent is express and sought before marketing. Telemarketers working through an SMS aggregator must seek individual consent by message in English and Urdu, using the prescribed wording that offers a subscribe keyword or an opt-out to 3627. The record is your responsibility: the regulation states that the telemarketer shall keep the record of individual consent in case of any dispute. No format, retention period or expiry is specified.

Does Pakistan have a data protection law?

Not in force. The Ministry of Information Technology and Telecommunication's legislation register lists Personal Data Protection Bills from July 2018, April 2020 and May 2023, each with status "Draft" and no notification number, and its news feed to 1 September 2026 announces no enactment. The May 2023 draft also contains no direct-marketing provision, so marketing consent rests on the PTA regulations and PECA rather than on data-protection law.

What are the penalties for unsolicited marketing in Pakistan?

Under PECA, sending unsolicited information or conducting direct marketing without an unsubscribe option carries a fine not exceeding PKR 50,000 for a first breach, and not less than PKR 50,000 rising to PKR 1 million for each later one. Spam involving misleading, fraudulent or harmful content carries up to three months' imprisonment or a fine of PKR 50,000 to 5 million, or both. Against a licensee, PTA may levy a fine extending to PKR 350 million and may suspend or terminate the licence.

Must I announce that a call is being recorded in Pakistan?

No such duty is published. No call-recording notice, consent requirement or retention period appears in the 2009, 2020 or 2022 regulations or in PECA sections 21 to 23. That is a negative from the instruments read rather than a confirmation, and there is no data-protection statute in force to fall back on, so announce recording anyway, set a retention period you can justify, and confirm the position with PTA and local counsel.

Pakistan Outbound Calling Compliance: PTA (2026)