CHAPTER I PRELIMINARY (1) Short title, extent, and commencement. – (1) This Act may be called the Personal Data Protection Act, 2023. (2) It extends to the whole of Pakistan. (3) It shall come into force not beyond two years from the date of its promulgation as the Federal Government may determine by notifying in the Official Gazette by providing at least three months’ advance notice from the effective date. 2. (a) Definitions. – In this Act, unless there is anything repugnant in the subject or context, ─ ─ “anonymized data” means personal data which has undergone the irreversible process of transforming or converting personal data to a form in which a data subject cannot be identified; (b) “authorised person” means a person or a guardian authorised by the court to make a data access or data correction request; (c) “biometric data” means personal data resulting from specific technical processing relating to the physical, physiological, or behavioural characteristics of a person, which allow or confirm the unique identification of that person, such as facial images or dactyloscopic data; (d) “child” means a person who has not attained the age of eighteen years; (e) “Commission” means the National Commission for Personal Data Protection (NCPDP) of Pakistan established under section 35 of the Act; (f) “consent” means any freely given, specific, informed, and unambiguous indication of the data subject’s intention by which the data subject by a statement or by clear affirmative action, signifies agreement to the collecting, obtaining, and processing of personal data provided that it conforms with section 13 and 14 of the Contract Act, 1872; 6