Section 216 of the Income Tax Ordinance, 2001 provides for the confidentiality of taxpayer information. Traditionally, FBR officials are barred from disclosing any particulars of a taxpayer, except in limited and specific cases.
However, the Finance Act 2025 introduces significant new exceptions to this confidentiality regime by inserting three new clauses. These amendments aim to enable external auditors, policy researchers, and academic institutions to access anonymized or protected taxpayer data—under strict conditions.
Breakdown of Amendments to Section 216(3)
Clause (ba) – External Auditors May Access Data
A new clause has been added after (b):
“(ba) to an auditor appointed on contractual basis or engaged through a third party including a payroll firm in the Federal Board of Revenue, after a non-disclosure agreement is made with such auditor as may be prescribed, to assist any authority mentioned in clauses (b) to (g) of sub-section (1) of section 207.”
Key Takeaways:
FBR can appoint external auditors under contract or via a third party.
Data access is allowed only after signing an NDA.
Access is limited to assistance roles in tax-related proceedings.
Example: If FBR hires a private audit firm to verify large corporate returns, it can share taxpayer info after a legal NDA is signed.
Clause (kd) – Access to Tax Policy Office
“(kd) to the Tax Policy Office for the purpose of processing and analyzing data for research and policy analysis.”
Key Takeaways:
FBR can share data with its own Tax Policy Office.
Purpose must be data processing, analysis, and tax policy design.
Example: To analyze tax trends among SMEs, the Tax Policy Office may receive segmented data from IRIS and PRAL systems.
Clause (ke) – Access to Universities & Donor Agencies
“(ke) to the recognized universities and international donor agencies subject to the conditions that before sharing, the taxpayer’s data shall be anonymized.”
Key Takeaways:
Data sharing with third parties now permitted for academic or international research.
Must ensure complete anonymization of taxpayer identity.
Only recognized universities or donor institutions are eligible.
Example: A university conducting a World Bank-sponsored study on tax evasion in digital markets may receive anonymized datasets from FBR.
Legal and Administrative Implications
Reinforces data protection by mandating NDAs and anonymization.
Enhances data-driven policymaking in taxation.
Opens doors for academic collaboration and global benchmarking.
Calls for development of data governance SOPs to monitor usage and compliance.
FAQs – Section 216 Amendments (Finance Act 2025)
What is Section 216 of the Income Tax Ordinance about?
It governs the confidentiality of taxpayer records within the FBR system.Who can now receive taxpayer data under clause (ba)?
Contractual auditors or firms working with FBR after signing an NDA.What’s the purpose of sharing data with external auditors?
To assist FBR-authorized officers in investigations, audits, and assessments.Can any payroll firm access taxpayer data?
Only if formally engaged by FBR and bound by non-disclosure terms.What is the Tax Policy Office’s role?
It evaluates tax data to help FBR formulate evidence-based tax policy.Is taxpayer identity protected under the new clauses?
Yes, especially for clause (ke), data must be anonymized before sharing.Which universities are considered recognized?
Those officially recognized by HEC or international partners accepted by the FBR.Can donor agencies access live taxpayer data?
No. They may only access sanitized, anonymized information for policy studies.Will FBR monitor data misuse?
FBR must ensure all parties comply with data confidentiality protocols.Is there a format for the NDA with auditors?
The NDA format is to be prescribed by the FBR through rules or notification.Can taxpayers object to their data being shared?
The law does not currently provide an individual objection mechanism.Does this amendment help academic research?
Yes, it enables deeper fiscal studies and economic modeling using real data.Can provinces request access under these clauses?
Not unless they fall under recognized institutions or officially coordinated initiatives.Is the data sharing retroactive?
Likely only forward-looking, for data accessed post-July 2025.Is there any penalty for misuse of shared data?
Yes. NDA breaches or data leaks may trigger criminal prosecution under Section 216(4).Can foreign universities access the data?
Only through international donor collaborations with formal FBR approval.Will taxpayer consent be sought?
Not explicitly required for anonymized or authorized institutional sharing.Can freelancers or consultants access such data?
No. Only auditors under contract or prescribed engagement can access it.Are there limits on what data can be shared?
Yes. The purpose is restricted to audit, analysis, and policy, not commercial use.Will FBR issue SOPs for these amendments?
Most likely. Operational guidelines will follow to define processes and controls.
Disclaimer:
This blog is for informational and educational purposes only. It does not constitute legal or tax advice. For case-specific matters, please consult a licensed tax practitioner or legal counsel. The publisher assumes no liability for any action taken based on this content.
