Method

Every score on this site comes from one equation. Here it is, with what goes into it.

TSI = 100 \times \sqrt{(\frac{1}{3} \sum_{k \in T} D_{k}) \times (\frac{1}{3} \sum_{k \in S} D_{k})}

D_{k} = \frac{1}{n_{k}} \sum_{i \in k} x_{i}

x: one answer: 1 if disclosed, ½ if partly disclosed, 0 if not found
D: the average answer in one of the six groups of questions
n: the number of questions in that group
T, S: the three Transparency groups and the three Safeguards groups

Answers are averaged within each of the six groups. The three group scores in each half are averaged to give Transparency and Safeguards. The TSI is one hundred times the square root of the two multiplied together.

What it measures

What an agency has published about its system, on a stated date. Every answer links to its source or lists where the search went.

What it does not measure

Whether a safeguard works, or whether one exists. An agency with good practice and a silent website scores low, and its record says "not found", which is accurate.

The nineteen questions

Transparency

10 questions

System disclosure

T1.1 Does the agency say what this system is for and what it is used to decide?
T1.2 Does the agency cite the law, rule or notification this system runs under?
T1.3 Does the agency list the kinds of personal data this system holds?
T1.4 Is there a named office or officer responsible for the data in this system, with contact details?

Flows and sharing

T2.1 Does the agency say which other public bodies receive or can query this data?
T2.2 Does the agency name the companies or outside bodies that build or run this system?
T2.3 Does the agency say where the data is stored and whether any of it leaves Pakistan?

Accountability records

T3.1 Has the agency named an official who answers information requests, and said how to file one?
T3.2 Are audit, evaluation or performance reports that cover this system published?
T3.3 Has a privacy or data protection impact assessment of this system been published?

Safeguards

9 questions

Rules on use

S1.1 Is there a privacy notice or data policy that covers this system?
S1.2 Does the agency say how long records in this system are kept?
S1.3 Does the agency state limits on using this data for anything beyond its stated purpose?

Individual rights

S2.1 Does the agency explain how a person can see their own record?
S2.2 Does the agency explain how a person can get an error in their record corrected?
S2.3 Is there a complaint route for misuse of this data, with a stated response time?
S2.4 Can a person find out who has accessed their record?

Security and oversight

S3.1 Has the agency committed to telling people about data breaches, or published a record of past ones?
S3.2 Does the agency say who independently audits the security or data handling of this system, and how often?

Why it is built this way

Three possible answers

Disclosed, partly disclosed, not found. It is the scale used by the Ranking Digital Rights index, and it asks no more of the evidence than the evidence can carry.

Equal weights

Nothing shows that one group of questions matters more than another, so none counts for more. Every score is also recomputed under ten thousand other weightings. That is the range shown beside it.

Groups first

Answers are averaged inside their group before the groups are averaged, so a group does not count for more because it has more questions.

Multiplied, not added

The two halves are multiplied together. An agency that describes its system in full and says nothing about protection cannot land in the middle. T of 0.80 and S of 0.10 gives 28.3, not 45.

The full method

Coding rules for all nineteen questions, a worked example, the robustness checks, the systems that were considered and left out, and the legal setting.

Download the full method (PDF)

References

Munda, G. and Nardo, M. (2009). Noncompensatory/nonlinear composite indicators for ranking countries: a defensible setting. Applied Economics, 41(12), 1513–1523.

Nardo, M., Saisana, M., Saltelli, A., Tarantola, S., Hoffmann, A. and Giovannini, E. (2008). Handbook on Constructing Composite Indicators: Methodology and User Guide. OECD Publishing.

OECD (2013). Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data.

Ranking Digital Rights (2017). 2017 Corporate Accountability Index.

Saisana, M., Saltelli, A. and Tarantola, S. (2005). Uncertainty and sensitivity analysis techniques as tools for the quality assessment of composite indicators. Journal of the Royal Statistical Society: Series A, 168(2), 307–323.

UNDP (2010). Human Development Report 2010, technical notes.

Government of Pakistan. Right of Access to Information Act, 2017 (Act No. XXXIV of 2017).

Ministry of Information Technology and Telecommunication (2026). National Data Governance Policy, consultation draft, June 2026.