Data Residency for HRM in Pakistan — What the Regulator Wants

"Data residency" is one of those terms that means very different things in different rooms. For an HRM in Pakistan it has a specific, concrete meaning: where the database that holds employee personal data physically sits, who has access to it, and whether that arrangement satisfies the regulators that govern your industry.

What employee data counts as sensitive

An HRM holds, at minimum: employee name, CNIC, date of birth, address, phone number, salary, bank account details, performance reviews, warnings, medical declarations and (often) attendance photos. In aggregate this dataset is more sensitive than most companies realize, because:

• CNIC + bank details is enough for identity theft and bank fraud.
• Salary + performance review history is enough to recruit-away an entire team.
• Medical declarations are protected under several Pakistani laws and most international frameworks.

This is the data the regulators care about.

Which regulators care, and what they ask

State Bank of Pakistan (banks, NBFCs, microfinance, EMIs)

SBP's outsourcing and data security guidelines require that customer data stay inside Pakistan, and that any third-party processor be auditable. While the HRM holds employee data (not customer data), bank IT audits in practice extend the same scrutiny — most banks cannot use a SaaS HRM hosted abroad. A self-hosted deployment with the database inside the bank's network solves this cleanly.

Personal Data Protection (proposed PDP Bill)

The PDP framework, while not yet final, has signalled local-storage and cross-border transfer restrictions. Forward-looking buyers are already structuring their HRM deployments to satisfy the proposed rules.

FBR

FBR cares about payroll tax filings and salary certificates. The constraint here is less about residency and more about reproducibility — your HRM must be able to regenerate any historical payroll run for an FBR audit, which means the audit trail must survive for at least six years.

Provincial social security (PESSI, SESSI, KESSI, BESSI)

Province-specific contribution rates and reporting requirements. No residency constraint here, but the HRM must compute contributions per the right provincial rule based on employee location.

PTA (telecom)

Subscriber data residency requirements apply to telecom carriers' customer data. The HRM for the telecom's own employees inherits the same controls in practice.

Defense and government-adjacent

Sector-specific rules vary, but the default position is on-premise, air-gapped where possible, with no vendor-cloud exposure.

Three viable residency models

Model A: Self-hosted, in-house database (most strict)

The HRM database runs on the customer's own hardware, inside the customer's network. Access is over LAN/VPN only. No vendor sees the data. This is the only model that satisfies the strictest regulators (banks, defense, intelligence-adjacent).

See our deployment walkthrough.

Model B: Local cloud, customer-owned tenant

The HRM cloud is hosted in Pakistan or a region the regulator accepts. Each customer is a structurally-isolated tenant with their own encryption key. This satisfies most non-bank enterprise residency requirements while preserving the operational benefits of SaaS.

Model C: Standard managed cloud (no residency constraint)

For non-regulated buyers without a residency requirement, the standard managed cloud is fastest and cheapest. Zaffre HRM offers it with the same security controls (structural tenant scoping, bcrypt + RS256 credentials, RBAC, immutable audit trail, encrypted backups).

How Zaffre HRM supports each model

Zaffre HRM is the only HRM in the Pakistani / Gulf market that offers all three models on the same product code base. The cloud SaaS and the self-hosted deployment run the same application logic — the only difference is where the database lives and who operates it.

• Self-hosted, in-house database — for banks, government, defense, healthcare, telecom and any buyer with the strictest residency requirements.
• Local cloud, isolated tenant — for mid-market and large enterprise buyers who want SaaS operations with residency.
• Standard managed cloud — for SMB and growth-stage buyers with no residency constraint.

See the security page for the full controls list, or contact us for a residency assessment.