Startup & Technology Law

Startup & Technology Law in Pakistan

Most startups do not fail because somebody forgot to print a legal document.

The legal problems usually appear later.

Two founders build a product together but never agree who owns what. A developer leaves and claims part of the code. An investor asks for a cap table nobody has maintained properly. A startup gives equity informally through WhatsApp messages. A SaaS company signs a large customer without defining service levels or liability. An app collects user information without deciding how that data can be used. A founder discovers that the company owns the brand but not the software written by a contractor.

Those are startup-law problems.

Sindh Lawyer provides legal services for startups, founders, technology companies, software businesses, SaaS providers, digital platforms, e-commerce businesses and investors in Pakistan.

Our work is built around the company’s stage:

Who founded it?

Who owns the equity?

Who owns the technology?

How will investors come in?

What contracts does the product need?

Is the business entering a regulated sector?

That is more useful than treating every startup as an ordinary company-registration client.

Choosing the Right Startup Structure

A startup may begin with one founder, several founders or an informal partnership.

Before incorporation, the founders should decide:

• who owns what;
• whether the business will be a company or another structure;
• who will be directors;
• who can make decisions;
• what happens if a founder leaves;
• whether investors are expected;
• whether employee equity may be offered;
• how intellectual property will be transferred into the business; and
• what future fundraising is likely to require.

Under Pakistan’s Companies Act framework, two or more persons may form a private company, while one person may form a single-member company. SECP currently processes name reservation and incorporation through its digital eZfile system under the Companies Act, 2017 and Companies Regulations, 2024.

The cheapest structure at incorporation is not always the best structure for the next investment round.

Founder Agreements Before the Company Grows

A founder agreement should be prepared while the founders still agree with one another.

Important subjects can include:

• founder ownership;
• roles;
• working commitment;
• decision-making;
• salary;
• intellectual property;
• confidentiality;
• future investment;
• dilution;
• vesting;
• founder departure;
• deadlock;
• transfer restrictions;
• non-solicitation;
• dispute resolution; and
• what happens if one founder stops contributing.

A startup with three founders should not operate indefinitely on:

“We all own one-third and we will decide later.”

That works only until the first disagreement.

Founder Equity

Equity should be documented accurately.

The company should know:

• issued shares;
• percentage ownership;
• shareholder names;
• founder shares;
• investor shares;
• employee equity;
• options;
• convertible instruments;
• transfers; and
• future dilution.

A spreadsheet used internally can help model ownership, but it is not a substitute for legally valid corporate records.

The cap table should be reconciled with the company’s actual statutory share record.

Cap Table Management

A startup may raise several rounds of funding.

A good cap table should show:

• current shareholders;
• number and class of shares;
• fully diluted ownership;
• employee-option pool;
• convertible instruments;
• warrants or similar rights;
• investment round;
• pre-money ownership;
• post-money ownership; and
• founder dilution.

Errors at seed stage become expensive during due diligence.

Investors generally want to know not only what founders believe they own, but what the company can legally prove they own.

Founder Vesting

Founder vesting can reduce risk where equity is divided early but founders have not yet contributed equally over time.

For example, founders may agree that certain rights become fully earned over a defined period.

The legal arrangement should address:

• vesting period;
• cliff;
• departure;
• good leaver;
• bad leaver;
• death/incapacity;
• transfer;
• repurchase or forfeiture mechanism where legally supportable; and
• treatment after investment.

Do not copy a US startup vesting clause into a Pakistani company agreement without checking whether the proposed mechanism fits Pakistan company law and the company’s articles.

Startup Incorporation

For many venture-backed or scalable businesses, a private limited company is commonly considered because it provides a corporate ownership framework capable of admitting future investors.

SECP states that company incorporation is now end-to-end digitized and governed through the Companies Act, 2017 and Companies Regulations, 2024.

Legal setup may involve:

• company name;
• business objects;
• shareholders;
• directors;
• share capital;
• registered office;
• memorandum;
• articles;
• beneficial ownership;
• founder IP assignments; and
• post-incorporation approvals.

Incorporation should not be treated as the final legal step.

It is the beginning of the company’s legal record.

Beneficial Ownership

Startups should keep ownership information accurate, particularly after fundraising.

The Companies Regulations, 2024 contain specific requirements relating to ultimate beneficial ownership, including declarations and records concerning persons who ultimately own or control qualifying interests in a company. The current regulations use a 25% ownership/voting/control threshold in relevant UBO provisions.

This becomes especially important where investment enters through:

• holding companies;
• foreign entities;
• nominee arrangements;
• investment vehicles; or
• layered shareholding structures.

Beneficial ownership should be considered during the transaction, not reconstructed after a regulator asks for it.

Founder and Shareholder Agreements

Once ownership becomes more complex, a shareholder agreement may regulate matters such as:

• board composition;
• reserved matters;
• founder control;
• investor consent rights;
• information rights;
• future fundraising;
• share transfers;
• pre-emption;
• tag-along rights;
• drag-along rights;
• founder departure;
• deadlock;
• exit; and
• dispute resolution.

The shareholder agreement and company articles should be coordinated.

Two documents governing the same company should not contradict each other.

Startup Investment

A startup investment is not simply:

“Investor gives Rs. 50 million for 20%.”

The transaction may need to address:

• valuation;
• investment amount;
• pre-money ownership;
• post-money ownership;
• share class;
• investor rights;
• board seat;
• information rights;
• founder vesting;
• conditions precedent;
• warranties;
• intellectual property;
• future fundraising;
• dilution;
• exit;
• liquidation rights;
• transfer restrictions; and
• dispute resolution.

The founders should understand not only how much money they are receiving, but what rights they are giving in return.

Term Sheets

A term sheet helps record the commercial principles before full investment documents are drafted.

Typical startup terms may include:

• valuation;
• investment;
• percentage ownership;
• type of security;
• governance;
• board rights;
• investor protections;
• founder restrictions;
• option pool;
• exclusivity;
• due diligence; and
• closing conditions.

The document should state clearly which provisions are binding and which are not.

A short term sheet can determine the economics of the entire investment round.

Startup Due Diligence

Investors usually investigate whether the company owns what it says it owns.

Legal due diligence can include:

Corporate

• incorporation;
• capitalization;
• shareholders;
• directors;
• statutory filings;
• beneficial ownership.

Founder Matters

• founder agreements;
• founder equity;
• vesting;
• disputes;
• previous employers.

Intellectual Property

• source code;
• trademarks;
• domains;
• contractor IP;
• employee IP;
• open-source software.

Commercial

• customer contracts;
• vendors;
• SaaS agreements;
• licences;
• partnerships.

Employment

• employment agreements;
• consultants;
• compensation;
• equity.

Regulatory

• sector licences;
• fintech permissions;
• telecom issues;
• cybersecurity;
• platform regulation.

A startup that organizes these documents early can usually move through fundraising diligence more efficiently.

Employee Stock Options

Equity compensation can help startups retain employees where cash compensation is limited.

SECP has expressly clarified that private companies, particularly startups, may structure employee stock-option arrangements within the Companies Act framework, including offering declined or unsubscribed shares to employees under predetermined contractual arrangements.

An ESOP arrangement should address:

• eligible employees;
• option pool;
• exercise price;
• vesting;
• exercise period;
• departure;
• termination;
• treatment on sale of company;
• dilution;
• approvals; and
• required corporate steps.

A verbal promise such as:

“We will give you 2% after one year”

creates uncertainty for both the employee and founders.

Intellectual Property Should Sit With the Startup

For a technology business, the most valuable company asset may be intangible.

That may include:

• software;
• source code;
• algorithms;
• database structure;
• brand;
• domain;
• UI designs;
• documentation;
• content;
• proprietary processes; and
• technical know-how.

The company should be able to answer:

Who created it?

Under what agreement?

Was ownership assigned to the company?

If the answer is unclear, an investor may treat the IP as a due diligence risk.

Founder IP Assignment

Founders often start work before the company is incorporated.

They may create:

• source code;
• designs;
• pitch materials;
• trademarks;
• domain names;
• datasets; or
• business processes

personally.

After incorporation, those assets should be reviewed to determine whether they need to be transferred or licensed formally to the company.

A company registration certificate does not automatically transfer pre-incorporation intellectual property from a founder.

Developer and Contractor IP

Technology companies frequently outsource development.

A contractor agreement should clarify:

• scope;
• deliverables;
• source-code access;
• repository access;
• milestones;
• payment;
• confidentiality;
• IP ownership;
• third-party code;
• open-source components;
• security;
• warranties;
• support; and
• termination.

Paying a developer for software does not always answer every intellectual-property question unless the agreement does.

Software Development Agreements

A development agreement should distinguish between:

building new software

and

licensing existing technology.

The developer may already own:

• frameworks;
• libraries;
• reusable modules;
• development tools; or
• pre-existing code.

The contract should explain what becomes the client’s property and what remains licensed.

SaaS Agreements

A SaaS business needs contracts that reflect the product rather than a generic consultancy agreement.

A SaaS agreement may cover:

• account access;
• subscription;
• users;
• service availability;
• acceptable use;
• customer data;
• security;
• support;
• integrations;
• intellectual property;
• confidentiality;
• fees;
• renewal;
• suspension;
• termination;
• liability; and
• data export after termination.

Enterprise customers may also require a separate data-processing or security schedule.

Service Level Agreements

An SLA can define measurable service standards such as:

• uptime;
• support hours;
• response times;
• incident severity;
• resolution targets;
• backups;
• maintenance windows;
• service credits; and
• escalation.

Do not promise “100% uptime” unless the infrastructure and commercial model genuinely support that commitment.

The SLA should describe what happens when the service level is missed.

Technology Licensing

A technology company may license:

• software;
• APIs;
• datasets;
• algorithms;
• trademarks;
• content;
• hardware designs; or
• other technology.

The licence should specify:

• permitted use;
• user limits;
• territory;
• duration;
• exclusivity;
• sublicensing;
• modifications;
• reverse engineering;
• fees;
• audit;
• termination; and
• ownership of improvements.

The contract should separate ownership from permission to use.

API Agreements

APIs create contractual and technical dependencies.

An API agreement may address:

• authentication;
• rate limits;
• permitted calls;
• customer data;
• uptime;
• security;
• prohibited use;
• commercial fees;
• intellectual property;
• developer documentation;
• changes to endpoints;
• suspension; and
• termination.

If another company builds its product around your API, unilateral changes can create substantial commercial consequences.

App and Platform Terms

Consumer-facing apps and digital platforms should have terms matching how the service actually works.

Depending on the product, terms may address:

• account creation;
• eligibility;
• payments;
• subscriptions;
• user-generated content;
• prohibited conduct;
• refunds;
• suspension;
• platform role;
• third-party services;
• intellectual property;
• dispute procedures; and
• limitation of liability.

A marketplace should not use the same terms as a direct seller if its commercial role is different.

Website Terms of Use

Terms of Use may help regulate:

• access;
• acceptable behavior;
• user accounts;
• intellectual property;
• third-party links;
• content;
• suspension;
• disclaimers; and
• platform liability.

The document should be written around the actual website rather than copied from an unrelated foreign service.

Privacy Policies

A privacy policy should describe the startup’s real data practices.

Depending on the product, it may explain:

• data collected;
• why it is collected;
• account information;
• device information;
• analytics;
• cookies;
• payment-related data;
• third-party processors;
• retention;
• security;
• cross-border handling; and
• user contact channels.

Do not publish a privacy policy stating that your business never shares data with third parties if your product uses cloud hosting, analytics, payment gateways or other service providers.

As of August 2026, official Pakistani sources show continued work toward comprehensive personal-data legislation. The earlier Personal Data Protection Bill, 2023 remained draft legislation, and recent National Assembly material refers to a finalized data-protection bill rather than demonstrating an enacted general federal data-protection statute. Businesses should therefore monitor this area closely rather than claiming that a draft bill is already operative law.

Electronic Contracts

Technology businesses routinely contract electronically.

Pakistan’s Electronic Transactions Ordinance, 2002 gives legal recognition to electronic forms and states that a document, record, communication or transaction is not to be denied legal recognition merely because it is electronic. It also addresses statutory writing and original-form requirements in electronic transactions.

This is directly relevant to:

• clickwrap agreements;
• electronic signatures;
• email acceptance;
• digital onboarding;
• online subscriptions;
• electronic records; and
• platform contracts.

The startup should still preserve reliable evidence of what terms the user accepted and when.

Clickwrap and Online Acceptance

A startup should be able to prove contract formation.

Better implementation usually involves:

“I agree to the Terms” + visible link + timestamp + version record

rather than:

“By using this website you automatically agree to everything.”

The product and legal team should work together on how terms are presented and recorded.

Cybersecurity & PECA

Technology businesses also need to consider Pakistan’s cybercrime framework.

The Prevention of Electronic Crimes Act, 2016 remains a core federal statute governing electronic offences, and it was materially amended through the Prevention of Electronic Crimes (Amendment) Act, 2025, which received presidential assent on 29 January 2025.

A startup may need legal advice concerning:

• unauthorized access;
• misuse of systems;
• data incidents;
• online impersonation;
• unlawful content issues;
• internal misuse;
• cyber complaints;
• preservation of electronic evidence; or
• dealings with investigating/regulatory authorities.

For criminal cyber matters, internally link to Cybercrime & Digital Law.

Cybersecurity Clauses in Contracts

Enterprise customers increasingly ask technology vendors to commit to specific security standards.

Contracts may address:

• access controls;
• encryption;
• breach notification;
• vulnerability management;
• backups;
• subcontractors;
• incident response;
• audit rights;
• business continuity; and
• data deletion.

Do not sign security warranties that the startup cannot operationally meet.

Legal promises and technical reality should match.

AI Products and AI Contracts

Startups developing AI products should clarify:

• model ownership;
• training data;
• customer inputs;
• generated outputs;
• third-party models;
• API dependencies;
• confidentiality;
• accuracy limitations;
• prohibited uses;
• human review;
• indemnity; and
• intellectual-property risk.

The contract should not promise that an AI output is always accurate if the technology cannot guarantee that.

Where third-party foundation models are used, their provider terms should also be reviewed.

Open-Source Software

Open-source software can save development time but creates licence obligations.

A startup should know:

• what packages it uses;
• licence type;
• attribution requirements;
• modification obligations;
• distribution conditions;
• source-code obligations; and
• compatibility with commercial licensing.

This becomes especially important during investment or acquisition due diligence.

Investors may request an open-source software inventory.

E-Commerce Startups

Online businesses can require legal support concerning:

• platform terms;
• merchant agreements;
• payment processing;
• refunds;
• delivery;
• consumer complaints;
• advertising;
• product liability;
• data;
• marketplace roles; and
• third-party sellers.

For detailed online-selling issues, internally link to eCommerce & Online Business Law.

Marketplace Platforms

A marketplace should clearly identify whether it acts as:

• seller;
• marketplace intermediary;
• agent;
• payment facilitator;
• logistics coordinator; or
• another role.

This affects:

• customer expectations;
• seller obligations;
• refunds;
• complaints;
• taxes;
• product liability; and
• payment flows.

The platform should not claim to be “only a technology company” if it is operationally performing functions that create separate legal responsibilities.

Fintech Startups

Fintech requires specialized regulatory review.

A startup proposing:

• digital wallets;
• electronic money;
• payment aggregation;
• merchant payments;
• payment gateway services;
• account-information services;
• lending;
• investment;
• securities;
• crowdfunding; or
• another financial product

should determine whether the activity requires authorization from State Bank of Pakistan, SECP or another regulator.

SBP’s Regulations for Electronic Money Institutions, for example, specifically regulate e-money activities and permit defined functions such as electronic money issuance, payment aggregation and certain API services subject to the regulatory framework.

The current SBP list also shows EMIs at different stages such as commercial operation and in-principle approval, demonstrating that market entry is a regulated process rather than ordinary company registration.

Regulatory Perimeter Review

A startup should ask before launch:

Are we merely providing software, or are we performing a regulated activity?

This matters in sectors including:

• fintech;
• payments;
• lending;
• investment;
• securities;
• telecom;
• healthcare;
• insurance;
• education;
• transportation; and
• digital media.

The legal structure should follow the actual product flow.

A company cannot avoid licensing merely by calling a regulated activity a “technology solution.”

Startup Employment Agreements

Startups often hire quickly and document employment later.

That creates problems around:

• salary;
• probation;
• confidentiality;
• intellectual property;
• remote work;
• working hours;
• benefits;
• notice;
• termination; and
• equity.

The agreement should reflect the applicable provincial labour law and the employee’s actual status.

For broader employment work, link to Labour & Employment Law.

Consultants vs Employees

A person called a “consultant” may function operationally like an employee.

The legal relationship should be assessed from:

• control;
• working arrangement;
• exclusivity;
• payment;
• benefits;
• duration;
• integration into business; and
• applicable law.

A startup should not label every team member a contractor merely to reduce compliance obligations.

Confidentiality & NDAs

NDAs are useful, but not every startup conversation requires a 15-page agreement.

A good NDA should identify:

• confidential information;
• permitted purpose;
• recipients;
• exclusions;
• security;
• return/deletion;
• duration; and
• remedies.

For founder and developer relationships, confidentiality should also be coordinated with IP ownership.

Non-Compete and Non-Solicitation

Startups often want founders or employees to sign broad restrictions.

Such clauses should be drafted carefully under Pakistani contract law and should not simply copy unlimited restrictions from foreign templates.

A more focused clause may protect:

• confidential information;
• customer relationships;
• staff solicitation;
• proprietary technology; and
• specified competitive conduct

without pretending that every broad restraint will necessarily be enforceable.

Startup Customer Agreements

A startup selling B2B products should have a clear customer contract.

This may include:

• scope;
• implementation;
• fees;
• subscription;
• renewal;
• service levels;
• support;
• customer obligations;
• data;
• IP;
• confidentiality;
• security;
• warranties;
• liability;
• termination; and
• dispute resolution.

Large enterprise customers may negotiate heavily around liability, cybersecurity and data-processing obligations.

Those clauses should be assessed commercially, not accepted automatically.

Vendor & Cloud Agreements

Startups also depend on other technology businesses.

Key vendors can include:

• hosting providers;
• cloud platforms;
• payment processors;
• SMS providers;
• email platforms;
• analytics tools;
• AI services;
• cybersecurity providers;
• logistics platforms; and
• contractors.

A startup should understand:

• service continuity;
• data location;
• termination;
• export of data;
• pricing changes;
• third-party dependencies; and
• liability.

Vendor risk can become customer risk.

Cross-Border Technology Contracts

Pakistani startups often sell abroad before they have a physical presence overseas.

Cross-border contracts should address:

• governing law;
• dispute forum;
• payment currency;
• taxes;
• intellectual property;
• data transfers;
• sanctions/compliance;
• withholding;
• foreign customers;
• subcontractors; and
• international enforcement.

A contract with a US or UAE customer should not leave governing law blank simply because the commercial relationship seems friendly.

Foreign Investors

Foreign investment can introduce additional legal issues involving:

• investment vehicle;
• share subscription;
• company law;
• beneficial ownership;
• banking;
• foreign exchange;
• repatriation;
• tax;
• investor rights; and
• exit.

The corporate structure should be established before money is received.

For substantial investment rounds, internally link to Corporate & Commercial Law and Mergers & Acquisitions where appropriate.

Convertible Investment Instruments

Startup investors sometimes seek instruments where investment converts into equity later.

Before using a SAFE-style, convertible note or another imported instrument, the parties should examine:

• Pakistan corporate-law compatibility;
• conversion mechanism;
• valuation cap;
• discount;
• maturity;
• interest where relevant;
• trigger event;
• investor rights;
• share issuance;
• regulatory approvals; and
• tax/accounting treatment.

Do not simply download a Silicon Valley SAFE and replace “Delaware” with “Pakistan.”

The legal mechanics may not be equivalent.

Investor Rights

Investors may request rights such as:

• board seat;
• observer rights;
• information rights;
• veto/reserved matters;
• liquidation preference;
• anti-dilution;
• pre-emption;
• tag-along;
• drag-along;
• founder vesting;
• founder lock-in; and
• exit rights.

Founders should model how these rights affect later fundraising.

A provision that looks harmless at seed stage can block a future round.

Startup Board Governance

Board governance becomes more important as outside investment arrives.

The company should know:

• who appoints directors;
• voting threshold;
• quorum;
• reserved matters;
• conflicts;
• meeting procedure;
• authority to sign;
• investor consent rights; and
• information rights.

Founder control and investor protection should be documented rather than assumed.

Founder Exit

A founder may:

• resign;
• stop working;
• sell shares;
• be removed from management;
• become disabled;
• die; or
• enter a dispute with co-founders.

The documents should answer:

Does the founder keep all shares?

Can the company or other founders buy them?

What happens to unvested equity?

What happens to IP and confidential information?

Can the founder compete?

A startup should answer these questions while the founders still have a good relationship.

Startup Disputes

Common startup disputes include:

• founder ownership;
• dilution;
• undocumented investment;
• promised equity;
• source-code ownership;
• employee departure;
• customer non-payment;
• investor rights;
• director control;
• misuse of company funds;
• shareholder deadlock; and
• breach of confidentiality.

The first step is usually to reconstruct the legal record.

That includes:

• incorporation documents;
• shareholder records;
• founder messages;
• board decisions;
• investment transfers;
• source-code history;
• agreements;
• cap tables; and
• corporate filings.

Startup disputes are often evidence-heavy because early decisions were made informally.

Startup Acquisition or Exit

A successful startup may eventually be:

• acquired;
• merged;
• partially sold;
• bought by a strategic investor; or
• reorganized.

A buyer will usually investigate:

• ownership;
• IP;
• employees;
• customers;
• regulatory compliance;
• data;
• litigation;
• tax;
• contracts; and
• founder obligations.

Good legal housekeeping from day one can materially improve exit readiness.

For an acquisition, link to Mergers & Acquisitions.

Documents for a Startup Legal Review

For an early-stage startup, provide:

• founder names;
• ownership split;
• incorporation documents, if formed;
• cap table;
• product description;
• source-code ownership information;
• existing founder agreement;
• employee/contractor agreements;
• trademarks/domains;
• major customer contracts;
• investment documents;
• investor term sheets;
• privacy policy;
• terms of service; and
• details of any regulated activity.

For fundraising, also provide:

• statutory share record;
• board/shareholder resolutions;
• previous investment documentation;
• ESOP documents;
• material contracts;
• IP assignments; and
• regulatory licences.

Pakistan Legal Framework for Startups & Technology Companies

There is no single “Startup Act” governing every technology company in Pakistan.

A startup may instead fall within several legal regimes.

Company Law

The Companies Act, 2017 and Companies Regulations, 2024 regulate company incorporation, ownership, governance, share issuance and corporate compliance. SECP continues to update this framework; for example, the Companies Regulations were amended again in June 2026.

Electronic Transactions

The Electronic Transactions Ordinance, 2002 provides legal recognition for electronic documents, records and transactions and remains highly relevant to digital contracting.

Cybercrime

The Prevention of Electronic Crimes Act, 2016, as amended in 2025, governs important electronic and cyber offences.

Intellectual Property

Technology companies may rely on Pakistan’s copyright, trademark, patent and related intellectual-property regimes depending on the product.

Data & Privacy

Pakistan’s comprehensive federal personal-data regime remains an evolving legislative area. Startups should therefore monitor current legislation and also consider contractual, cybersecurity, sector-specific and foreign-law obligations where they handle customer data or serve foreign markets.

Regulated Technology

Fintech and payment products can require SBP authorization, while securities, investment and other financial products can involve SECP regulation. Telecom or other technology sectors can require separate regulatory analysis.

The correct startup-law question is therefore not:

“Are we a technology company?”

It is:

“What does the product actually do, who does it for, what data or money moves through it, and which regulated activity—if any—is being performed?”

Build the Legal Foundation Before the Funding Round

Early-stage companies often postpone legal work because everything feels temporary.

But startup documents become historical evidence.

The 10% founder equity promised today may be questioned in three years.

The contractor who wrote the first version of the product may become an IP due-diligence issue.

The customer contract signed to close the first major enterprise deal may establish a liability standard the startup later struggles to meet.

The privacy policy copied from another website may not describe the actual product.

Sindh Lawyer approaches startup work around four assets:

ownership

technology

contracts

regulatory permission

If those are clear, fundraising and scaling become much easier to manage.