The latest draft of Pakistan’s Personal Data Protection Bill (PDPB) 2023 raises significant concerns regarding the autonomy of the National Commission for Personal Data Protection (NCPDP), as it places the Commission under federal government control, compromising its independence. Ambiguous terms like "legitimate interest," "public interest," and "national interest" lack clear definitions, creating scope for misuse by data controllers. The bill's requirement for data localisation is impractical given Pakistan's inadequate infrastructure and energy constraints, posing risks of data misuse or leakage. Broad exemptions under Section 4 grant undue discretion to the federal government, undermining accountability. While positive aspects, such as requiring user consent for data processing, are included, the imposition of administrative fees to access personal data contradicts international standards like the GDPR, which discourage such practices.