CHAPTER I PRELIMINARY 1. ​Short title, extent and commenceme​nt.—(1) This Act may be called the Personal Data Protection Act, 2017. (2) It extends to the whole of Pakistan. (3) It shall come into force after one year from the date of its promulgation or such other date not falling beyond two years from the date of its promulgation as the Federal Government may determine through a notification in the Official Gazette providing at least three months advance notice of the effective date. 2. ​Definitions​.─ In this Act, unless there is anything repugnant in the subject or context,─ (a) “Commission" means the National Commission for Personal Data Protection (NCPDP) established under section [] of the Act; (b) “commercial transaction” means any transaction of a commercial nature, whether contractual or not, which includes any matters relating to the supply or exchange of goods or services, agency, investments, financing, banking and insurance; (c) “data” means information which is intentionally processed by means of equipment operating automatically or otherwise in response to instructions as part of a relevant data filing system and includes any representation of data that can be processed electronically; (d) “data controller” means a person who either alone or jointly or in common with other persons processes any personal data or has control over or authorizes the processing of any personal data, but does not include a data processor; (e) “data processor”, in relation to personal data, means any person, other than an employee of the data controller, who processes the personal data solely on behalf of the data controller, and does not process the personal data for any of his own purposes”; (f) “data subject” means an individual who is the subject of the personal data; (g) “personal data” means any information that relates directly or indirectly to a data subject, who is identified or identifiable from that information or from that and other information in the possession of a data controller, including any sensitive personal data and expression of opinion about the data subject which— (i) is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose; (ii) is recorded with the intention that it should wholly or partly be processed by means of such equipment; or (iiii) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, 3