Niti Partners & Associates  |  Series 1 of 2  |  Published 2 November 2026

Nepal does not have a comprehensive data protection law comparable to the EU General Data Protection Regulation (the "GDPR"). Its framework instead comprises the constitutional right to privacy, the Individual Privacy Act, 2075 (2018) (the "Privacy Act") and the Individual Privacy Rules, 2077 (the "Privacy Rules"), supplemented by legislation and regulatory requirements governing electronic transactions, telecommunications, banking and other regulated activities. For businesses operating in Nepal, the result is a framework that protects personal information but lacks several features of a modern data protection regime.

The Privacy Act is particularly important. It regulates the collection and use of personal information, requires consent in specified circumstances and restricts disclosure. However, its provisions do not form a fully integrated framework for commercial data processing.

There is no dedicated data protection authority, no general statutory breach-notification regime and no express, comprehensive framework for international data transfers. The Information Technology and Cyber Security Bill, 2082 (the "Bill"), which proposed a broader framework for the digital sector, lapsed following the dissolution of the House of Representatives in September 2025.

1. What is Nepal’s legal framework for personal data?

Article 28 of the Constitution of Nepal protects the privacy of a person’s body, residence, property, documents, data, correspondence and character. Article 27 separately protects the right of citizens to seek and receive information, subject to legally recognised restrictions. The latter is not equivalent to a data subject’s right of access under the GDPR.

The principal statute is the Privacy Act. Its Chapter 10, particularly sections 23 to 28, addresses the collection, use and protection of personal information. The Privacy Act defines personal information by reference to specified categories, including a person’s caste, ethnicity, religion, marital status, educational qualifications, address, contact details, identity-document information, correspondence, biometric information and criminal background.

The Privacy Act also protects information through provisions outside Chapter 10. Section 11, for example, treats medical records, bank-account details, financial transaction documents, biometric data, land ownership documents and securities information as personal documents. Section 12 protects personal data and restricts the disclosure of specified categories, including health, property and income, employment, family, biometric, signature, political affiliation, election, business and transaction information. Accordingly, the fact that a particular category is not expressly listed in the definition of personal information does not necessarily mean that it falls outside the protection of the Privacy Act.

The Privacy Rules supplement the Privacy Act. They address, among other matters, personal documents (Rule 3), electronic information (Rules 4 and 5), the collection and use of personal data (Rules 10 and 11) and correction (Rules 12 to 14).

Other legislation may also apply depending on the nature of the information and the business concerned. The National Penal Code, 2074 addresses certain forms of unauthorised access and misuse of electronic information; the Electronic Transactions Act, 2063 (the "ETA") regulates electronic transactions and computer-related offences; and the Right to Information Act, 2064 protects specified categories of personal information held by public bodies from disclosure.

The applicable framework is therefore not confined to one statute. A bank, telecommunications provider, insurer, technology company and ordinary commercial enterprise may face different additional obligations.

2. What does the Privacy Act require of a private business?

The application of the Privacy Act to private-sector processing requires careful analysis. Three provisions are particularly important.

First, section 12(2) requires consent when collecting a person’s personal or family data. Section 12(3) provides that data collected with consent by a public body or body corporate must be used only for the purpose for which it was collected. Its proviso recognises disclosure where data is demanded for national security or peace and order in accordance with prevailing law. Section 26(1) separately restricts a public body or body corporate from using or providing personal information held by it without the individual’s consent, subject to specified exceptions.

Second, section 23(1) is framed more broadly. It provides that no person, other than an official authorised by law or a person permitted by that official, may collect, store, protect, analyse, process or publish another person’s personal information. Section 23(2) contains a specific exception for information voluntarily provided with consent for study, research or public-opinion purposes. The following provisions impose requirements concerning notice and the collection of information under that exception.

The breadth of section 23(1) creates a significant interpretive question for ordinary commercial activity. Read literally, its restriction extends beyond public bodies and body corporates and is not expressly limited to disclosure or misuse. At the same time, sections 12 and 26 contemplate the collection and use of personal information by public bodies and body corporates, subject to consent and specified exceptions.

The relationship between these provisions is not entirely clear. A business should therefore not assume that obtaining consent alone resolves every issue under section 23, or that ordinary commercial processing is automatically prohibited. The statutory basis for the particular processing activity should be considered in context.

Third, the Privacy Rules add requirements concerning electronic information and the use of personal data. Rule 4(1) requires the consent of the individual before another person uses personal information held in electronic form, and Rule 4(2) requires any body or institution holding electronic information to keep it confidential and secure against unauthorised access.

Rule 5(1) restricts the use, without consent, of electronically held economic, social, religious, cultural, physical and mental details, and of numerical presentations compiled from them. Rule 10(1) repeats the prohibition in section 23(1), and Rule 10(3) requires the individual’s consent even where a government office has authorised collection.

Rule 11 requires the individual to be informed before collection of how the data will be used and, unless prevailing law provides otherwise, confines use to the purpose of collection. These provisions should be read alongside sections 12, 23 and 26 rather than treated as a separate, comprehensive code for private-sector processing.

The Privacy Act also places limits on the processing of sensitive information by public bodies. Section 27 identifies categories including caste, ethnicity or origin, political affiliation, religious belief, health, sexual orientation and property information. Its prohibition is directed at public bodies, with specified exceptions. It should not be presented as a general prohibition applying identically to all private businesses.

3. What rights do individuals have, and who enforces them?

The Privacy Act recognises rights to privacy and confidentiality, requires consent in specified circumstances and provides protection against unauthorised collection, use and disclosure. It does not, however, establish the full set of rights commonly associated with the GDPR. In particular, it does not create a general right of access, erasure, data portability or objection to processing, nor does it establish a framework for automated decision-making.

The correction right under section 28 of the Privacy Act, and Rules 12 to 14 of the Privacy Rules, is limited to information held by a public body. An individual who considers such information inaccurate or unsupported by facts may apply to the relevant public body for correction, subject to the statutory conditions. It is not a general correction right against every private-sector data holder.

Nepal has no dedicated data protection authority under the Privacy Act and no general data-controller or data-processor registration regime established by that Act. Enforcement instead operates through the courts and the ordinary criminal process. Section 29 provides for imprisonment of up to three years, a fine of up to NPR 30,000, or both, for the offences specified in that section.

The listed offences include contraventions of section 12(4) (disclosure without consent), section 23(1), (3) and (7), section 26(1) and section 27(1). For the offences identified in section 29(3), the Government of Nepal is the plaintiff. For other offences under the Privacy Act, the concerned person may complain to the District Court within three months under section 30. Section 31 also provides for compensation where damage, loss or injury results from an offence or other act under the Privacy Act.

The enforcement structure is therefore judicial and offence-based rather than administrative. The Privacy Act does not establish a specialist regulator with the supervisory, investigative and administrative penalty powers associated with data protection authorities in some other jurisdictions.

4. What happens in a data breach, or when authorities request information?

The Privacy Act and the Privacy Rules do not establish a general data-breach notification regime. They do not prescribe a general deadline for notifying a regulator or affected individuals following a breach. Rule 4 addresses the confidentiality and security of electronic information, but it does not create a general incident-reporting obligation.

The legal consequences of an incident will depend on the facts and the provisions engaged. Section 25 requires public bodies to protect personal information under their responsibility or control against unauthorised access, use, alteration, disclosure, publication or transmission. That specific security obligation is directed at public bodies. A contravention of section 25 is not separately listed as an offence under section 29. This does not, however, exclude other potential liability where the facts also involve an offence under the Privacy Act, unauthorised access under the ETA, or a breach of an applicable sectoral requirement.

The ETA is relevant where an incident involves unauthorised access to a computer system or damage to computer information or systems. Its provisions on computer-related offences should not be confused with a general statutory duty to notify data breaches. Section 37(2) of the ETA also addresses notification where a digital-signature key is compromised, but that is a specific requirement relating to digital signatures, not a general personal-data breach obligation.

Government access is similarly governed by specific statutory routes rather than a single consolidated procedure. Section 12(5) of the Privacy Act requires relevant personal data to be provided to a court or an authorised agency or official where necessary in the investigation or prosecution of a criminal offence.

Section 26(1) permits use or disclosure without consent in specified circumstances, including a written request from an authorised investigating or prosecuting official and an order of a court in a pending case. The proviso to section 12(3) also recognises disclosure demanded for national security or peace and order in accordance with prevailing law.

The Privacy Act separately protects correspondence and electronic communications. Sections 13 and 19 address privacy in correspondence and electronic communications, including circumstances in which access or recording may be authorised. The ETA also contains powers for the Controller in relation to computer systems where the statutory conditions are met.

For a business, the practical response should be to verify the legal authority for a request, identify the data and systems concerned, preserve the request and the response, and check whether sector-specific reporting or cooperation requirements apply. A request from a government agency should not be treated as sufficient authority merely because it has been made by an official.

5. What is changing, and what should international businesses do now?

The Bill was intended to provide a broader framework for Nepal’s digital sector. It proposed, among other matters, provisions concerning digital records, information technology businesses, data centres, cloud services, cybersecurity and cyber offences. The Bill lapsed following the dissolution of the House of Representatives on 12 September 2025 (27 Bhadra 2082). It did not become law, and the ETA remains in force.

A draft Personal Data Protection Policy, 2082 was also published for consultation. It contemplated institutional arrangements including a Data Protection Board and data protection officers, as well as measures concerning data classification, minimisation, access rights and consent. These proposals should be treated as policy proposals, not existing legal obligations. As at 2 November 2026, no successor IT Bill or comprehensive standalone Personal Data Protection Act had appeared on the House of Representatives’ registered bill list reviewed for this article.

For international businesses, the absence of a comprehensive statute should not be mistaken for an absence of legal obligations. A practical review should identify the personal information collected from employees, customers and other individuals in Nepal; record the purposes and consent relied upon; examine the legal basis for collection and processing under sections 12, 23 and 26; and review access by group companies, vendors and overseas service providers. Businesses in regulated sectors should separately check the requirements of the relevant regulator, including Nepal Rastra Bank, the Nepal Insurance Authority and the Nepal Telecommunications Authority, as applicable.

Four questions deserve particular attention in a Nepal compliance review:

1. whether the Nepal entity falls within the definition of a body corporate in the Privacy Act;
2. how sections 12, 23 and 26 apply to its particular processing activities;
3. which sector-specific rules govern its information systems and outsourcing arrangements; and
4. whether its use of overseas group systems or vendors is consistent with the Privacy Act and applicable regulatory requirements.

Nepal’s present framework is not equivalent to the GDPR, India’s Digital Personal Data Protection Act or Singapore’s Personal Data Protection Act. Those regimes have their own institutional structures, rights and compliance requirements. They should not be assumed to apply to a Nepal entity merely because it is part of a multinational group. Equally, a group-wide privacy policy designed for another jurisdiction may not address the particular statutory questions raised by the Privacy Act, and advice from a law firm in Nepal is recommended before any such policy is applied to a Nepal entity.

Part 2 of this series examines cross-border data transfers and data localisation in Nepal, including the legal position on transferring customer and employee information to regional headquarters, overseas cloud providers and group-wide HR platforms.