What to Do If NCCIA Takes Your Phone in Pakistan: Your Rights Under PECA
If NCCIA seizes your phone, PECA gives you a written list, two witnesses and a way to ask for a copy of your data. See the steps to take and what to ask for.
Short answer: If NCCIA takes your phone, PECA says the officer must list what was seized, with the date and time, and give you a copy of that list in front of two witnesses. You can apply for a forensic copy of your data at your own cost. Ask to see the warrant and call a lawyer before you answer questions.
A phone is more than a handset. It holds your bank apps, family photos and work chats. When it leaves your hands in a case, you need to know what the officer must do and what you are entitled to ask for.
We read the Prevention of Electronic Crimes Act, 2016 (PECA), compiled with amendments up to 2023, and the 2025 amendment text that created the National Cyber Crime Investigation Agency (NCCIA). The NCCIA's own website blocked our request on 12 October 2026, so we could not read its procedures. This is a plain reading of the law, not legal advice. Whether your phone is lawfully held depends on your case, so speak to a lawyer.
The officer needs a court warrant in the ordinary case
Section 33 of PECA lets a court issue a warrant to search a specified place and to access or seize a device or data. The application must show reasonable grounds and a specifically identified offence. Ask to see the warrant and read the place and offence it names.
There is one exception. For cyber terrorism under section 10, a gazetted officer may search without a warrant if waiting would risk the data being lost. The court must be told within 24 hours. Outside that case, a warrant is the normal rule.
A warrant is not the same as a notice. Under section 31, an officer can send a written notice to preserve specific data for up to 90 days, and must tell the court within 24 hours. That notice asks a person or company to keep data. It does not by itself take your phone.
Our check of whether NCCIA can access your phone and photos sets out each route in one table.
The officer must list what was taken and give you a copy
Section 36 says the officer must make a list of everything seized or made inaccessible, with the date and time. A copy goes to the owner or the person it was taken from, in the presence of two witnesses. Check the list line by line before you sign anything.
| What to check on the list | Why it matters |
|---|---|
| Make, model and IMEI of each phone | Proves exactly which device was taken |
| SIM cards, memory cards and chargers | Shows what left your hands with it |
| Date and time of seizure | Starts the clock for every later step |
| Names of the two witnesses | PECA requires them at the handover of the list |
| Officer's name and case reference | Lets your lawyer find the file |
Take a photo of the list if you are allowed to. Note the IMEI yourself beforehand. The steps to check an IMEI number show where to find it on any phone.
You can apply for a forensic copy of your data
Under section 36(2), the owner can apply, and pay the prescribed cost, for a forensic image of the data or system. A forensic image is an exact copy of everything on the device. Applying matters because you may need your own files while the original stays held.
The officer can refuse in one case. If giving the copy could harm the investigation, the officer must approach the court within seven days of your application for an order not to give it. The court decides after recording reasons.
So keep a written, dated copy of your application. The seven day period runs from the day the officer receives it.
Seizing the whole device is meant to be a last resort
Section 35 says the officer must act with proportionality and must not disturb data that has nothing to do with the offence. It also says the whole device should be seized only as a last resort, when technical measures such as copying cannot keep the data intact.
The officer must also keep the data from being released to others and must keep a log of what was done to it. If you believe far more was taken than the case needs, put that in writing and give it to your lawyer.
Section 35 also allows an officer to require a person who holds decryption information to open the data in readable form. That is why the passcode question comes up. Your lawyer can tell you how it applies to your case before you answer.
What to do in the first hour and the first week
Stay calm, be polite and do not hand over anything beyond what the warrant covers. Ask for the written warrant and the seizure list. Then call a lawyer and tell one family member where you are.
- Ask to see the warrant, and read the place, the offence and the court that issued it.
- Check the seizure list and that two witnesses are present.
- Speak to a lawyer before you unlock the phone or give a passcode.
- Write down the officers' names, time, place and what was said.
- Apply in writing for a forensic copy of your data and keep proof of delivery.
- Secure your accounts from another device, and change passwords and sign out linked devices.
Step six protects your accounts, not the case. The steps to check linked devices on WhatsApp and to turn on two step verification help you do it from another phone. Do not delete messages or files, since deleting after a seizure may be treated as tampering. Ask your lawyer first.
If you are detained, the court clock starts at once
PECA section 30A, as compiled in the text we read, says a person detained for investigation must be produced before a court within 24 hours of arrest, excluding the journey time. Police custody remand is limited to 14 days at a time and 30 days in total.
This applies if you are arrested, not just if your phone is taken. Most phone seizures do not involve detention. If a relative is held, ask for the court and the date of production and tell a lawyer straight away.
Common questions
Can NCCIA take my phone without a warrant?
In the ordinary case, no. Section 33 requires a court warrant. The one exception we read is a section 10 cyber terrorism offence, where the court must be told within 24 hours.
Do I have to give my passcode?
Section 35 allows an officer to require a person holding decryption information to grant access in readable form for the investigation. Ask a lawyer how it applies to you before you answer.
Will I get my phone back?
PECA does not give a fixed return date in the sections we read. You can apply for a forensic copy of the data, and a lawyer can apply to the court for the return of the device.
Can a caller on the phone tell me my phone will be seized?
A seizure happens by warrant and in person, with a written list. A phone call threatening seizure unless you pay or share a code is the pattern of a scam, as covered in the check of a fake PTA or NCCIA call.
Can I appeal if the court rules against me?
PECA section 47 says an appeal against a final judgment or order of the court lies within thirty days. For interim orders, ask your lawyer which remedy applies.
Who do I contact if I think the seizure was wrong?
Your lawyer can raise it with the court that issued the warrant. You can also write to the NCCIA through its published contact, which you should confirm yourself on the official portal.
How we verified this
What we checked, where we read it, and what we could not confirm.
We read the compiled Prevention of Electronic Crimes Act, 2016 with amendments to Act XXXVII of 2023 and the National Assembly text of the 2025 amendment on 12 October 2026. The agency's complaint portal at complaint.nccia.gov.pk blocked our automated request, so confirm contacts in a browser. The Act is also available from Pakistan Code. Section numbers should be checked against the final gazetted text before you rely on them in a case.
About the author
Technology Journalist & Multimedia Producer
Ahmad Ali is a technology journalist and multimedia producer at Pakistan Era, joining the team in October 2026. He covers consumer technology and digital life for Pakistani readers, combining research with hands-on product testing.
