Data Protection, Privacy and Cross-Border Data Transfer

Nepal has no comprehensive data protection act. It has no data protection authority, commissioner or supervisory body. There is no registration of controllers, no requirement to appoint a data protection officer, no breach notification duty of general application, no lawful-basis framework, and no restriction on transferring personal data out of the country. A due-diligence questionnaire asking a Nepali vendor to name its national data protection regulator has no correct answer.

What exists instead is a constitutional right, one narrowly drawn statute, a criminal confidentiality offence, and supervision in a small number of licensed sectors. Each of those is real. None does the work a data protection act does.

The constitutional layer

Article 28 of the Constitution of Nepal guarantees privacy in respect of a person’s body, residence, property, documents, data, correspondence and character, except as provided by law. The Individual Privacy Act 2075 was enacted to give that right statutory content, and its chapter structure follows the constitutional wording almost exactly.

A constitutional right is enforceable against the state through writ proceedings. Against a private company processing customer data it is a weaker tool, and it is no kind of compliance standard. It tells a controller nothing about retention periods, security measures or contractual flow-downs.

The Individual Privacy Act

The Act was authenticated on 18 September 2018 as Act no. 14 of 2075 and runs to twelve chapters: preliminary; privacy of body and family; residence; property; documents; data; correspondence; character; electronic means; collection and protection of personal information; offences and punishment; miscellaneous.

Section 2(c) defines personal information broadly, taking in caste, ethnicity, birth, origin, religion, colour and marital status, educational qualifications, contact details, identity documents, correspondence, biometric data, criminal background and professional opinions expressed in the course of a decision.

The operative restrictions sit in Chapter 10. Section 23 confines collection to officials authorised by law or persons permitted by them, requires consent where information is collected for study, research or opinion collection, and requires that the purpose be fully disclosed before collection. Section 26(1) prohibits use of collected information without the consent of the person concerned, subject to exceptions for lawful publication, written requests in criminal investigations, court orders, and requests by authorised officials. Section 27(1) restricts processing of sensitive categories, including caste, ethnicity, political affiliation, religion, health, sexual orientation and property details.

Chapter 9 addresses electronic means directly. Section 19(1) gives a person the right to keep private their personal information, documents, correspondence, data or character held in electronic form; section 19(2) prohibits obtaining such material without authorisation; section 19(3) prohibits listening to conversations by electronic means without consent or lawful order. Sections 9, 20 and 22 deal with closed-circuit cameras at residences, in public places and with drones.

Public bodies and private companies

Section 25 is the Act’s security provision. It requires personal information collected by a public body to be protected by that body, with appropriate arrangements against unauthorised access, use, alteration, disclosure, publication or transmission. The framing is around public bodies throughout.

A private company holding customer data in Nepal is therefore reached by the consent and disclosure restrictions in sections 23, 26 and 27, and by the criminal provisions. No general statutory duty to secure what it holds applies to it. Nepal has no equivalent of an “appropriate technical and organisational measures” obligation for private controllers, and so no domestic standard against which a company’s security posture can be assessed.

The penalties

Route	Instrument	Maximum sanction	Who initiates
Privacy offence	Individual Privacy Act 2075, s.29(2)	Up to 3 years’ imprisonment or a fine up to NPR 30,000, or both	Private complaint; Government of Nepal as plaintiff for certain offences under s.29(3)
Compensation	Individual Privacy Act 2075, s.31(2)	Reasonable compensation assessed by the District Court	Victim
Breach of confidentiality	Electronic Transactions Act 2063, s.48	Fine up to NPR 10,000 or imprisonment up to 2 years, or both	Prosecution
Unauthorised access to a computer system	Electronic Transactions Act 2063, s.45	Fine up to NPR 200,000 or imprisonment up to 3 years, or both	Prosecution
Public official misconduct	Individual Privacy Act 2075, s.32	Departmental punishment under service law	Employing body

A maximum fine of NPR 30,000 is the most informative number here. For a company of any size it deters nothing. What could actually discipline a Nepali data controller is the imprisonment term, which attaches to individuals, and the compensation route, which requires a victim to identify the breach, attribute it, and sue in the District Court within three months of the act complained of. Data breaches are discovered late. That limitation period will time-bar most of them before a claimant knows there is a claim.

The numbers are low for a second reason. The Act was drafted as a privacy statute in the older sense, concerned with intrusion into a person’s home, body, correspondence and reputation. Its penalties are calibrated to a person photographing a neighbour or opening someone’s letters. Bulk processing of customer records by a company was never the mischief it addressed, and the sanctions were never scaled to it. Reading the Act as Nepal’s data protection law asks it to serve a purpose it was not built for.

Sectoral supervision

Where a business is licensed, its regulator’s rules do some of the work. Nepal Rastra Bank’s Cyber Resilience Guidelines apply to A, B, C and D class banks and financial institutions and to licensed payment system operators and providers, and impose board-level accountability, a designated senior executive for cyber resilience, backup separation and incident reporting. Those are information security obligations rather than data protection obligations, and they reach only licensed entities.

The E-Commerce Act 2081 imposes disclosure and grievance-handling duties on platforms, and no data protection duties at all. A platform must publish its contact details and answer complaints within fifteen days. It need not tell a customer what it does with their data.

Selling to foreign clients

For a Nepali company processing personal data on behalf of a European, British or other foreign client, the compliance obligation is entirely contractual. The client’s processor terms, security schedule, sub-processor list, audit rights and breach notification timetable are the standard the Nepali vendor is held to, because no domestic floor sits beneath them and no domestic regulator has to be satisfied. Nepal has no adequacy determination to invoke, so the transfer mechanism will be standard contractual clauses or their equivalent, and the transfer impact assessment will rest on facts about Nepali law generally rather than on Nepali data protection law.

The absence of a cross-border transfer restriction cuts both ways. It removes a friction many comparable jurisdictions impose, so data leaves Nepal freely. It also leaves a Nepali data subject with no statutory protection once their data has gone, and a Nepali company’s own data held with a foreign cloud provider governed only by the provider’s contract. The one place a residency constraint might genuinely bind is prudential regulation of banks and payment institutions. What could and could not be verified about that is set out in the article on cloud, data centres and AI.

Sources

1. वैयक्तिक गोपनीयता सम्बन्धी ऐन, २०७५ — The Privacy Act, 2075 (2018)

   Government of Nepal · Authenticated 2075.6.2 (18 September 2018); Act no. 14 of 2075 · Tier 1 — Primary legal instrument

   Supports: Chapter structure; definition of personal information (s.2(c)); collection and consent (s.23); protection duty on public bodies (s.25); restriction on use and disclosure (s.26); sensitive personal information (s.27); penalties (s.29(2)); complaint to District Court within three months (s.30); compensation (s.31(2)); departmental punishment (s.32); absence of any cross-border transfer provision.

   Accessed 26 August 2026

2. The Privacy Act 2075 — prevailing laws index entry, Volume 4

   Nepal Law Commission · Listed as a prevailing law; published Asoj 2, 2075 · Tier 1 — Primary legal instrument

   Supports: That the Privacy Act 2075 is in force and remains listed among prevailing laws.

   Accessed 26 August 2026

3. Electronic Transactions Act, 2063 — English text

   Government of Nepal; published by the Information Technology and Digital Governance Office · Authenticated 22 Mansir 2063 (8 December 2006) · Tier 1 — Primary legal instrument

   Supports: Section 48, divulging confidentiality, punishable by a fine up to NPR 10,000 or imprisonment up to two years or both; section 45, unauthorised access to a computer system.

   Accessed 26 August 2026

4. Cyber Resilience Guidelines

   Nepal Rastra Bank, Payment Systems Department · Issued August 2023; notified 27 August 2023 · Tier 1 — Primary legal instrument

   Supports: Applicability to A, B, C and D class banks and financial institutions and to licensed payment system operators and providers; board and CISO responsibilities; backup separation; incident reporting.

   Accessed 26 August 2026

5. विद्युतीय व्यापार (इ-कमर्स) ऐन, २०८१ — E-Commerce Act, 2081

   Government of Nepal · Authenticated 16 March 2025 · Tier 1 — Primary legal instrument

   Supports: Platform disclosure and grievance handling duties; that the Act imposes no data protection obligations on platforms beyond disclosure and complaint handling.

   Accessed 26 August 2026