Mandatory Registration for All IoT Gateways
The Pakistan Telecommunication Authority (PTA) has introduced stricter controls on Internet of Things (IoT) services through an updated regulatory framework. Under the revised rules, all Low Power Wide Area Network (LPWAN) licensees are now required to register every IoT gateway with the Authority.
The new requirements are part of the updated Regulatory Framework for Short Range Devices (SRD) and Terrestrial Internet of Things (IoT) Services v1.4. By making gateway registration compulsory, PTA aims to create a more complete and accurate map of long-range IoT deployments across the country. This will allow the regulator to track where devices are operating, which networks they rely on and how traffic is being handled behind the scenes.
Stricter Data Localisation and Security Powers
One of the most important changes in the revised framework is the tightening of data localisation rules. PTA has barred the storage of IoT data outside Pakistan without its prior approval. This means that companies running large-scale IoT platforms can no longer freely host or store device data on foreign servers unless the regulator has formally authorised it.
The framework also gives PTA the power to order the immediate suspension of IoT services on national security grounds. This allows the regulator to act quickly if a particular deployment, gateway or service is found to pose a risk to critical infrastructure, public safety or sensitive information. Together, these measures are designed to reduce cyber risks, protect user data and keep greater control over how smart device networks are run in Pakistan.
Bi-Annual Reporting and Local Traffic Routing
LPWAN operators are now subject to enhanced reporting and compliance obligations. Licensees must submit updated lists of all operational IoT gateways on a bi-annual basis, ensuring that PTA always has a current record of active sites and nodes.
In addition, the framework requires that backend traffic generated through LPWAN networks must be routed via PTA-licensed Local Access Providers. This routing requirement is meant to keep core IoT traffic within approved national networks and to make monitoring, lawful interception and security enforcement easier for authorities.
PTA has further clarified that IoT networks operating in shared spectrum will function strictly on a secondary, non-interference and non-protection basis. In practice, this means that such networks must not cause harmful interference to primary users of the spectrum and cannot demand protection if they experience disruption.
Licensing Rules, Commencement Deadlines and Exemptions
Under the revised framework, LPWAN licences will be issued under the Class Value-Added Services (CVAS) regime for an initial term of five years, with renewals to be handled in line with federal government policy. License holders are required to commence services within one year of licence issuance; otherwise, their licence will be automatically cancelled.
Existing LPWAN licensees have also been instructed to obtain commencement certificates within one year of the framework’s issuance. PTA has clarified that Cellular Mobile Operators and Local Loop licensees will not need a separate LPWAN licence to provide IoT services in designated LPWAN bands. However, they will still be required to seek prior approval from the regulator before launching such services.
Mission-critical IoT services—such as those linked to public safety, utilities and transport—will only be allowed over exclusively assigned or fully licensed frequency bands. This is intended to ensure reliability, avoid interference and protect essential systems from unexpected outages.
Support for Research, Testing and Innovation
Despite the tougher compliance environment, the updated framework also leaves room for experimentation and innovation. PTA has allowed academia, government bodies, private companies and law enforcement agencies to conduct non-commercial IoT tests and trial projects without obtaining a full LPWAN licence.
These trial activities can run for up to six months and are capped at ten devices per model. All test setups will remain subject to inspection by PTA and the Frequency Allocation Board, ensuring that experimental networks do not interfere with licensed services or create security risks.
By tightening gateway registration, data localisation and reporting obligations, while still allowing controlled trial environments, PTA is signalling that the future of IoT in Pakistan will be more regulated but also more secure. For operators, the new framework means closer scrutiny and clearer rules. For users and public authorities, it promises greater protection of local data and more reliable smart services in the years ahead.
