Nepal

The Privacy Act 2075, sections 23 and 26, place duties on a 'public body or body corporate'. Neither section says which countries it covers. The Electronic Transactions Act 2063, section 55, expressly applies to computer offences committed outside Nepal. The Nepal Rastra Bank licensing policy for payment institutions, 2079 (first amendment 2080), says at clause 1(2) who it covers. It covers institutions set up in Nepal that operate outside Nepal. It also covers institutions set up outside Nepal that do payment work inside Nepal. Separately, the Ministry of Communication and Information Technology has published notices calling on social media platforms to register with it. Those notices rely on the Social Networking Operation Directive 2080. That is a ministerial directive, not a statute.

Sector by sector. All industries. The Data Center and Cloud Service (Operation and Management) Directives 2081, section 8(1), cover this. They say that before using data centre and cloud services, any client shall only obtain services from providers listed in the department's published list. Government and public sector: section 3(7) makes use of the Integrated Data Management Centre compulsory for Government of Nepal security agencies. Section 3(9) requires other government bodies to move departmental data centres into the government data centre, on a timetable set by a steering committee. Section 6(3) requires any data centre holding government data to be Tier 3 or better. Payments: the Nepal Rastra Bank Unified Directive on Payment Systems 2082 covers card transactions. Transactions in Nepali rupees, made in Nepal on payment cards issued by licensed institutions, must be settled within Nepal. Any bond or guarantee issued to an international switch for that purpose must be in Nepali rupees. Telecoms: the Cyber Security Byelaw 2077 imposes encryption, audit and log duties, but says nothing about where data must sit. Securities, insurance and health: we found no rule about storage or location on the regulators' own sites, checked 18 August 2026, confidence medium.

So the data itself can move freely, while the hosting must come from an approved list. Providers already operating when the directive started had six months to apply for listing. Listing requires a company or firm registration certificate, a building completion certificate, a map of the site, an internet protocol address pool in the provider's own name, and an information security standard certificate. A provider with no physical presence in Nepal cannot realistically meet those requirements. The Department can strike a provider off the list, and the customer must then move its systems immediately.

The Privacy Act 2075, sections 29 to 31, sets out how breaches are punished. Offences are prosecuted under the National Criminal Procedure Code 2074, with the Government of Nepal as plaintiff for a defined subset. Otherwise a person complains privately to the district court within three months. Punishment is up to three years in prison, or a fine of up to thirty thousand rupees, or both. Compensation and departmental discipline for public officials can be added. We found no published privacy enforcement decision from any Nepali body. So enforcement for personal data is rated dormant, even though several sector regulators are clearly working.

Minimum keeping periods. The Income Tax Act 2058, section 81: five years from the end of the income year. The Cyber Security Byelaw 2077, rules 47 and 48: security logs six months, network address translation logs three months, or as the telecoms authority directs. The Data Center and Cloud Service Directives 2081, section 7(13)(s): closed-circuit television footage kept at least three months. On the other side, the Privacy Act sets no maximum keeping period at all. The 2077 telecom bylaw on destroying customer documents requires identity documents collected at sign-up to be scanned, and the paper then destroyed. Nepal has no published rule for resolving a clash between a duty to keep and a duty to delete. The duty to keep tends to win, because it carries a tax or licence penalty and the duty to delete does not.

The Data Center and Cloud Service Directives 2081, section 7(5), cover unauthorised access. They require immediate notice to the regulatory body and to the National Cyber Security Center. Section 8(3) requires a customer that spots unauthorised access to tell its provider. The customer must also notify the Center in writing if a forensic investigation is needed, and the Center must report back within one month. The Cyber Security Byelaw 2077, rules 58 to 60, require licensees to have an incident response team and a plan. They must work with a named task force chaired by the Director of the Monitoring Division of the telecoms authority. The central bank's Cyber Resilience Guidelines of August 2023 set a two-hour target for resuming critical operations after a disruption. That is a recovery target, not a reporting deadline. So there is really one clock, and it says 'immediately' rather than a number.

(1) Privacy Act 2075, section 29(2): prison up to three years, or a fine up to thirty thousand rupees (about 215 US dollars), or both. The fine is trivial. The prison term is not, and it attaches to people. (2) Section 30(2): complain to the district court within three months of the act. (3) Data Center and Cloud Service Directives 2081, section 8. (4) Section 33: only a guardian or curator can consent for anyone under eighteen, of unsound mind, or with an intellectual disability. Consent works only where publication benefits that person. (5) Electronic Transactions Act 2063, section 47: up to five years in prison, or a fine up to one hundred thousand rupees (about 720 US dollars), or both. That covers publishing material online that is contrary to public morality or decent behaviour. It also covers material that spreads hatred between communities. Section 48 adds up to two years for divulging information obtained under that Act. Also worth knowing: the Privacy Act bans a public body from handling sensitive information about caste, ethnicity, political affiliation, religion, health, sexual life or property at all. There are only narrow exceptions for health and for self-publication.

Powers that can be used without warning matter more here than pending legislation. Most of Nepal's data rules are ministerial directives made under section 79 of the Electronic Transactions Act 2063. They can be rewritten without going near parliament. Four to watch. First, the Department of Information Technology can remove a data centre or cloud provider from its list, after a fifteen-day show-cause and a seven-day decision. That forces every customer of that provider to migrate. Second, the steering committee chaired by the ministry secretary can order any government body into the state data centre at a time of its choosing. Third, the ministry can issue new directives under section 79 at will. That is exactly how the 2025 data centre rule appeared. Fourth, the telecoms authority can amend the Cyber Security Byelaw 2077 by board decision. Treat the current permissive position as revocable rather than settled.