PDO-02

IRIS taxpayer system

Federal Board of Revenue (FBR)

Last reviewed October 2026

What it does

IRIS is the Federal Board of Revenue's online tax system. People and businesses use it to register as taxpayers, file income tax returns and wealth statements, and pay what they owe. It is built and run for FBR by a company called PRAL.

Why it matters

It holds what people earn and own. Tax law lets FBR pass taxpayer details to other bodies in listed circumstances.

Legal basis: Income Tax Ordinance, 2001, as amended to 30 June 2026.

On the register because: it holds records on at least a million people or covers the whole country; it holds identity, biometric, health, financial, location or communications data; its records are used to decide something about an individual.

How it scores

52.9 out of 100

44.0 to 62.0 if the weights change

Transparency

69.4

System disclosure

75.0

Flows and sharing

66.7

Accountability records

66.7

Safeguards

40.3

Rules on use

33.3

Individual rights

62.5

Security and oversight

25.0

8 disclosed 6 partly disclosed 5 not found

The nineteen questions

This record shows what the agency has published. Not found means nothing was found in the places searched on the date checked. It does not mean the safeguard does not exist.

System disclosure

Transparency

Does the agency say what this system is for and what it is used to decide?

Disclosed

The IRIS page describes itself this way. PRAL's site calls IRIS 'Pakistan's largest e-filing system'.

Source: iris.fbr.gov.pk/

Show evidence

In the agency's words:

IRIS 2.0 ... helps you file your FBR income tax return easily

Checked 8 October 2026. Saved copy.

Does the agency cite the law, rule or notification this system runs under?

Disclosed

FBR's own guide to the system cites the section it implements.

Source: download1.fbr.gov.pk/Docs/2020122914123835238ProfileUpdate-UserGuide.pdf

Show evidence

In the agency's words:

User Guide – Profile Update u/s 114A of the income Tax Ordinance, 2001

Checked 8 October 2026. Saved copy.

Does the agency list the kinds of personal data this system holds?

Partly disclosed

The kinds of statement filed are named; there is no list of the personal data the system holds.

Source: iris.fbr.gov.pk/

Show evidence

In the agency's words:

simplified income tax form, income and wealth statements, and e-filing

Checked 8 October 2026. Saved copy.

Is there a named office or officer responsible for the data in this system, with contact details?

Partly disclosed

General helpline and query form only. No named officer for IRIS data.

Source: www.fbr.gov.pk/ask-fbr/173354

Show evidence

In the agency's words:

You can contact the FBR Helpline through the following channels: i) Telephone: +92 51 111 772 772

Checked 8 October 2026. Archived copy.

Flows and sharing

Transparency

Does the agency say which other public bodies receive or can query this data?

Disclosed

Section 216(3) lists the bodies and purposes for which taxpayer particulars may be disclosed (pp. 463 to 468 of the text on pakistancode.gov.pk, amended to 30 June 2026).

Source: pakistancode.gov.pk/pdffiles/administratorc09ecd376211abe32a7e44510f3fd719.pdf

Show evidence

In the agency's words:

s.216(3)(s), p. 467: to the Financial Monitoring Unit (FMU) for the purpose of performing functions as laid down in the Anti-Money Laundering Act, 2010 (VII of 2010) ... s.216(6A), p. 468: Nothing contained in sub-section (1) shall prevent the Board from providing data to any person approved by the Federal Government to process and analyze such data for broadening of tax base or for checking evasion

Checked 8 October 2026. Archived copy.

Does the agency name the companies or outside bodies that build or run this system?

Disclosed

Pakistan Revenue Automation (Pvt) Ltd lists IRIS among the systems it builds and runs for FBR. PRAL's site says it is 'instrumental in helping Federal Board of Revenue' and does not state who owns it.

Source: www.pral.com.pk/

Show evidence

In the agency's words:

PRAL manages FBR's Helpline ... Pakistan's largest e-filing system, IRIS is one of the best integrated systems in the country

Checked 8 October 2026. Saved copy.

Does the agency say where the data is stored and whether any of it leaves Pakistan?

Not found

Where we looked

fbr.gov.pk Privacy Policy and Terms of Use (no storage location); pral.com.pk ('management of computer and server operations', no location, nothing on transfers abroad); iris.fbr.gov.pk. Checked 8 October 2026.

Accountability records

Transparency

Has the agency named an official who answers information requests, and said how to file one?

Disclosed

Named officer with contact details and a prescribed request form. The page does not cite the Act or explain the steps.

Source: fbr.gov.pk/public-relations-job-description/142248/173819

Show evidence

In the agency's words:

Designated PIO (Public Information Officer) / Secretary (Compliance) ... Ms. Kiran Zahra ... 051-9201307 ... ss.compliance@fbr.gov.pk ... Prescribed form (Request for Information)

Checked 8 October 2026. Archived copy.

Are audit, evaluation or performance reports that cover this system published?

Disclosed

Auditor General's Audit Report on the accounts of the Federal Board of Revenue, Audit Year 2024-25 (224 pages), linked from agp.gov.pk/AuditReports. It makes an audit recommendation on controls in IRIS and refers to PRAL's data at pp. 23, 25 and 168 to 170.

Source: agp.gov.pk/SiteImage/Policy/AR%20on%20accountof%20federal%20board%20of%20revenue%202024-25.pdf

Show evidence

In the agency's words:

p. 19: should put in place validation checks while generating Computerized Payment Receipts (CPRs) in the E-Portal of Inland Revenue Information System (IRIS), to ensure that no CPR is generated without filling of mandatory fields, to plug the loopholes in the electronic tax collection system.

Checked 9 October 2026. Saved copy.

Has a privacy or data protection impact assessment of this system been published?

Not found

Where we looked

fbr.gov.pk Privacy Policy; fbr.gov.pk publications list; pral.com.pk. Checked 8 October 2026.

Rules on use

Safeguards

Is there a privacy notice or data policy that covers this system?

Partly disclosed

The policy excludes FBR's online systems, saying e-filing systems 'may have their own Terms of Use'. None was found for IRIS. The IRIS login page, read on 9 October 2026, links no terms or privacy notice.

Source: www.fbr.gov.pk/Privacy-Policy/543

Show evidence

In the agency's words:

This policy is applicable only to official website of FBR

Checked 8 October 2026. Archived copy.

Does the agency say how long records in this system are kept?

Not found

Where we looked

fbr.gov.pk Privacy Policy (no retention); Terms of Use; pral.com.pk. The Ordinance's records section binds taxpayers, not FBR. Checked 8 October 2026.

Does the agency state limits on using this data for anything beyond its stated purpose?

Partly disclosed

A confidentiality rule with listed exceptions, read in the official text amended to 30 June 2026. It restricts disclosure; it does not limit what FBR itself may use the data for.

Source: pakistancode.gov.pk/pdffiles/administratorc09ecd376211abe32a7e44510f3fd719.pdf

Show evidence

In the agency's words:

s.216(1), p. 463: shall be confidential and no public servant save as provided in this Ordinance may disclose any such particulars.

Checked 8 October 2026. Archived copy.

Individual rights

Safeguards

Does the agency explain how a person can see their own record?

Disclosed

A taxpayer can log in and view the profile FBR holds.

Source: download1.fbr.gov.pk/Docs/2020122914123835238ProfileUpdate-UserGuide.pdf

Show evidence

In the agency's words:

Click option "My Profile" on the Top right side of the screen

Checked 8 October 2026. Saved copy.

Does the agency explain how a person can get an error in their record corrected?

Disclosed

Published procedure for correcting profile data. The guide does not list which fields can be changed.

Source: download1.fbr.gov.pk/Docs/2020122914123835238ProfileUpdate-UserGuide.pdf

Show evidence

In the agency's words:

Fields with sign can be edited for updating data/ profile ... After changes are verified, Profile u/s 114A will be updated.

Checked 8 October 2026. Saved copy.

Is there a complaint route for misuse of this data, with a stated response time?

Partly disclosed

Five complaint routes are listed (Chairman, Federal Tax Ombudsman, ADR, e-CRM, Citizen Portal). No response time is stated and none mentions data misuse.

Source: www.fbr.gov.pk/pakistan-citizen-portal-pcp/81166/152494

Show evidence

In the agency's words:

Regular update and real time tracking regarding the status of complaints

Checked 8 October 2026. Saved copy.

Can a person find out who has accessed their record?

Not found

Where we looked

fbr.gov.pk Privacy Policy; Profile Update guide; pral.com.pk. Checked 8 October 2026.

Security and oversight

Safeguards

Has the agency committed to telling people about data breaches, or published a record of past ones?

Not found

Press reporting cannot support a code. If FBR published a statement on the 2021 incident, this becomes 0.5.

Where we looked

fbr.gov.pk Privacy Policy and Terms of Use (no breach clause); FBR press-release search for the August 2021 attack found press reports of an FBR press conference (ProPakistani, 1 September 2021) but no FBR statement. Checked 8 October 2026.

Does the agency say who independently audits the security or data handling of this system, and how often?

Partly disclosed

PRAL's home page shows certificate badges under this heading, one of them for ISO 27001, with no certifier, scope or date.

Source: www.pral.com.pk/

Show evidence

In the agency's words:

ISO CERTIFICATIONS

Checked 8 October 2026. Saved copy.

Agency reply

Not yet sent to the agency.

Sources

Official pages and documents cited on this record.