Civil registry and national identity database
National Database and Registration Authority (NADRA)
Last reviewed October 2026
Send a correctionWhat it does
This is the database behind the national identity card. NADRA registers citizens and residents and stores their personal details, photograph and fingerprints. Banks, mobile phone companies and government departments check people's identities against it.
Why it matters
Almost every adult in Pakistan is in it, and enrolment is not a choice. The identity it issues is needed to vote, open a bank account, get a SIM card or travel.
Legal basis: National Database and Registration Authority Ordinance, 2000 (VIII of 2000).
On the register because: it holds records on at least a million people or covers the whole country; enrolment is mandatory or cannot practically be avoided; it holds identity, biometric, health, financial, location or communications data; its records are used to decide something about an individual.
How it scores
63.9 out of 100
48.0 to 76.9 if the weights change
The nineteen questions
This record shows what the agency has published. Not found means nothing was found in the places searched on the date checked. It does not mean the safeguard does not exist.
System disclosure
TransparencyDoes the agency say what this system is for and what it is used to decide?
DisclosedThe Services Charter, p. 1, adds what the identity is used for: elections, healthcare, education, social security, communication and financial services.
Show evidence
In the agency's words:
NADRA is mandated to register all citizens and legal residents of Pakistan and to establish, maintain, and operate secure multipurpose national identity databases and digital infrastructure to support public service delivery, governance, and national development.
Checked 8 October 2026. Archived copy.
Does the agency cite the law, rule or notification this system runs under?
DisclosedThe Services Charter, p. 4, also cites section 7 for the National Data Warehouse and Citizen Database.
Show evidence
In the agency's words:
In line with the mandate specified in Clause (i) of Subsection (1) of Section 7 of NADRA Ordinance, 2000
Checked 8 October 2026. Archived copy.
Does the agency list the kinds of personal data this system holds?
DisclosedCharter p. 22 lists the fields a card holder can change: name, father/husband name, date of birth, addresses, gender, marital status, education, mobile number, email.
Show evidence
In the agency's words:
p. 4: It is a comprehensive repository, storing data such as biometric information, demographic details, and identity records.
Checked 8 October 2026. Archived copy.
Is there a named office or officer responsible for the data in this system, with contact details?
Partly disclosedDepartmental and helpline contacts are published. No named officer or office responsible for citizens' data (no data protection officer or equivalent) was found.
Show evidence
In the agency's words:
p. 30: Verification Services Department ... 051-9108134; Public Information Officer (pio@nadra.gov.pk)
Checked 8 October 2026. Archived copy.
Flows and sharing
TransparencyDoes the agency say which other public bodies receive or can query this data?
DisclosedCharter pp. 25-27 describe the verification services through which these bodies query the database. Named bodies count without a formal register of agreements (reading rule R-3).
Show evidence
In the agency's words:
p. 13, Other stakeholders, Public: Judiciary; Security Exchange Commission of Pakistan; Election Commission of Pakistan; State Bank of Pakistan; Pakistan Bureau of Statistics; Federal Board of Revenue; Pakistan Telecommunication Authority; Benazir Income Support Program; Law Enforcement Agencies. Private: Insurance Companies; Financial Institutions; Telecom Operators ...
Checked 8 October 2026. Archived copy.
Does the agency name the companies or outside bodies that build or run this system?
Not foundWhere we looked
Services Charter; Terms & Conditions page; verification page; About NADRA. tenders.nadra.gov.pk was not opened. Checked 8 October 2026.
Does the agency say where the data is stored and whether any of it leaves Pakistan?
Partly disclosedLocation is stated. Nothing states whether any citizen data is transferred abroad (NADRA runs identity projects for other countries).
Show evidence
In the agency's words:
We store your data on our secure servers in Pakistan.
Checked 8 October 2026. Archived copy.
Accountability records
TransparencyHas the agency named an official who answers information requests, and said how to file one?
DisclosedThe site's Right to Information page explains how to file a request; charter p. 30 gives the PIO's email and address. The two links printed in the charter (public-information-officer, RTI-Request-Form.pdf) are old addresses.
Show evidence
In the agency's words:
p. 4: every citizen has the right to access certain categories of information held by NADRA by submitting a written request to the NADRA's Public Information Officer (PIO) ... requests will be processed within 10 days.
Checked 8 October 2026. Archived copy.
Are audit, evaluation or performance reports that cover this system published?
Partly disclosedNADRA publishes statistics and a 25-year book. The charter, p. 3, says its accounts are audited by chartered accountants appointed in consultation with the Auditor General, but no audit or evaluation report was found on the site.
Show evidence
In the agency's words:
NADRA Footprint; NADRA's 25 Year Book
Checked 8 October 2026. Archived copy.
Has a privacy or data protection impact assessment of this system been published?
Not foundThe government's own NR&BP Framework, notified 1 January 2025, says at p. 24: 'There is no requirement for conducting Data Protection Impact Assessments (DPIAs) before implementing new technologies or processing activities involving biometric data.'
Where we looked
Services Charter; Terms & Conditions page; NR&BP Framework v2.0; Downloads (Policies, Notifications, Guidelines). Checked 8 October 2026.
Rules on use
SafeguardsIs there a privacy notice or data policy that covers this system?
DisclosedPublished under Terms & Conditions. Covers site data, PakID app data and biometric data.
Show evidence
In the agency's words:
This privacy policy explains how NADRA manages the personal information it collects from applicants at the time of filing application for ID cards.
Checked 8 October 2026. Archived copy.
Does the agency say how long records in this system are kept?
Partly disclosedRetention is stated for biometric data only. Nothing on how long demographic records, or records of deceased persons, are kept.
Show evidence
In the agency's words:
Biometric data used for verification is not retained after the session. If the user opts to update their photograph or fingerprint, that new data is securely transmitted and permanently stored in NADRA's official identity database.
Checked 8 October 2026. Archived copy.
Does the agency state limits on using this data for anything beyond its stated purpose?
DisclosedThe privacy policy adds that biometric data is 'used strictly for' identity verification and record updates.
Show evidence
In the agency's words:
p. 2: personal information of the citizen is only used for the purposes for which it was collected and is not disclosed to third parties without proper authorization.
Checked 8 October 2026. Archived copy.
Individual rights
SafeguardsDoes the agency explain how a person can see their own record?
DisclosedRoutes published in the charter: Family Registration Certificate (p. 24), SMS 8009 for family-tree verification (p. 26), PakID app. A published route to obtain one's record in any form counts (reading rule R-5).
Show evidence
In the agency's words:
p. 6: Access to Information: The right to access their personal information held by NADRA and to request corrections if necessary.
Checked 8 October 2026. Archived copy.
Does the agency explain how a person can get an error in their record corrected?
DisclosedCharter p. 22 lists which fields can be changed and how often.
Show evidence
In the agency's words:
p. 21: ID Card Holder seeking update of demographic details must submit relevant documents as per list of acceptable documents mentioned in NADRA Registration Policy
Checked 8 October 2026. Archived copy.
Is there a complaint route for misuse of this data, with a stated response time?
DisclosedChannels: NCCMS portal, 1777, PMDU, complaint registers, open forums. The time limits are for service complaints generally; none is specific to data misuse.
Show evidence
In the agency's words:
p. 28: Approximately 93% of complaints are resolved within seven days. ... Grievances through this channel are properly recorded on a complaint register ... and their resolution is ensured within 15 days.
Checked 8 October 2026. Archived copy.
Can a person find out who has accessed their record?
Partly disclosedA citizen can block verification and, for Digital ID, must consent to each share. The Digital ID Citizen Guide, p. 5, says 'all data access and usage is recorded' but does not say the citizen can see that record.
Show evidence
In the agency's words:
p. 2: The Block or Enable Biometric Verification feature in the PakID app lets you control who can access your personal data and biometric information stored with NADRA.
Checked 8 October 2026. Archived copy.
Security and oversight
SafeguardsHas the agency committed to telling people about data breaches, or published a record of past ones?
Not foundThe NR&BP Framework, pp. 24-25, itself records the 'absence of mandatory breach notification protocols'.
Where we looked
Terms & Conditions / privacy policy (no breach clause); Services Charter; first page of Media Releases (April-September 2026); NR&BP Framework. Checked 8 October 2026.
Does the agency say who independently audits the security or data handling of this system, and how often?
Partly disclosedSecurity measures are asserted. The charter's audit section (p. 3) covers financial accounts only. No independent security auditor, certification or date is named on the site.
Show evidence
In the agency's words:
Revision of agreements incorporating Information Security Protocols ... Incorporation of Two-factor authentication ... Revamped APIs to ensure data privacy
Checked 8 October 2026. Archived copy.
Agency reply
Not yet sent to the agency.
Sources
Official pages and documents cited on this record.
- https://www.nadra.gov.pk/website-governance
- https://www.nadra.gov.pk/verification
- https://www.nadra.gov.pk/assests/downloadsPdf/nadra-services-charter-1-0-0.pdf
- https://www.nadra.gov.pk/term-and-condition
- https://www.nadra.gov.pk/nadraStatistics
- https://www.nadra.gov.pk/assests/downloadsPdf/biometric-block-unblock.pdf