PTA resumes VPN provider registration

The Pakistan Telecommuni-cation Authority (PTA) has resumed the registration of virtual private network (VPN) service providers, allowing companies to acquire class licences for data services at fees ranging from Rs100,000 to Rs300,000.

According to PTA officials, the licensing initiative aims to bring VPN providers under regulatory oversight. Following the implementation, providers will be required to operate with locally registered data centres and comply with Pakistan's data protection laws.

According to sources, the class licensing framework will enable the PTA to monitor and regulate VPN services effectively.

Crucially, the PTA will gain access to user data and browsing history under licensing conditions, a move designed to bolster cybersecurity measures. The measure will also empower the authority to detect and trace cyberattacks more effectively.

The initiative has come in light of consultations with stakeholders, including the Pakistan Software Houses Association (P@SHA), which formally requested the registration process to streamline operations.

Sources added that VPN providers must adhere to local data protection regulations, ensuring compliance with domestic laws. Furthermore, companies offering these services will need to establish local data centres to facilitate monitoring and regulatory requirements.

Earlier, the PTA had announced the resumption of granting class licences for data services to providers in Pakistan. "VPN service providers are required to obtain Class Licence for Data (Data Services) to provide VPN and related services," the statement read.

Previously, the telecom regulator issued licences to companies offering internet, cellular services, and vehicle trackers. However, it has now introduced a new category for VPNs under licensed services.

The plan aims for local companies - operating under Pakistan's laws, licence terms, and regulatory provisions - to provide proxy services to users. The shift enables the regulator to exert greater control over these companies compared to the current scenario, where most VPN providers are foreign entities.

Documents available on PTA's website reveal that the terms of licences for existing service providers would also extend to any company offering VPN services. One provision specifies that companies must "[p]romptly provide all information, as and when desired by the Authority [PTA], which helps it to quantify proliferation of the technologies or services whether technical, regulatory or financial in nature".