Nepal

Privacy Act 2075 sections 23 and 26 impose duties on a 'public body or body corporate' without a territorial clause. Electronic Transactions Act 2063 section 55 is expressly extraterritorial for computer offences. The Nepal Rastra Bank licensing policy for payment institutions, 2079 (first amendment 2080), states at clause 1(2) that its provisions apply to institutions established in Nepal operating outside Nepal and to institutions established outside Nepal carrying out payment work inside Nepal. Separately, the Ministry of Communication and Information Technology has published notices calling on social media platforms to register with it under the Social Networking Operation Directive 2080; that is a ministerial directive rather than a statute.

Sector by sector. All industries: Data Center and Cloud Service (Operation and Management) Directives 2081, section 8(1) — 'Before using data center and cloud services, any client shall only obtain services from providers listed in the department's published list.' Government and public sector: section 3(7) makes use of the Integrated Data Management Centre mandatory for Government of Nepal security agencies, and section 3(9) requires other government bodies to move departmental data centres into the government data centre on a timetable set by a steering committee; section 6(3) requires any data centre holding government data to be Tier 3 or better. Payments: the Nepal Rastra Bank Unified Directive on Payment Systems 2082 requires that transactions in Nepali rupees made in Nepal on payment cards issued by licensed institutions be settled within Nepal, and that any bond or guarantee issued to an international switch for that purpose be denominated in Nepali rupees. Telecoms: the Cyber Security Byelaw 2077 imposes encryption, audit and log duties but no localisation. Securities, insurance and health: no storage or localisation rule found on the regulators' own sites, checked 18 August 2026, confidence medium.

So the transfer model is best described as unrestricted for the data itself and an allowlist for the infrastructure. Providers already operating when the directive commenced had six months to apply for listing. Listing requires a company or firm registration certificate, a building completion certificate, a map of the site, an internet protocol address pool in the provider's own name and an information security standard certificate — requirements a provider with no physical presence in Nepal cannot realistically meet. The Department can strike a provider off the list, and the customer must then move its systems immediately.

Privacy Act 2075 sections 29 to 31: offences are prosecuted under the National Criminal Procedure Code 2074 with the Government of Nepal as plaintiff for a defined subset, and otherwise by private complaint to the district court within three months. Punishment is up to three years' imprisonment or a fine of up to thirty thousand rupees or both, plus compensation and departmental discipline for public officials. We found no published privacy enforcement decision from any Nepali body. Enforcement is therefore rated dormant for personal data even though several sector regulators are demonstrably operational.

Floor: Income Tax Act 2058 section 81 (five years from the end of the income year); Cyber Security Byelaw 2077 rules 47 and 48 (security logs six months, network address translation logs three months, or as directed by the telecoms authority); Data Center and Cloud Service Directives 2081 section 7(13)(s) (closed-circuit television storage of at least three months). Ceiling: the Privacy Act contains no storage limitation principle. The 2077 telecom bylaw on destruction of customer documents requires that identity documents collected when signing up a customer be digitised and the paper then destroyed. Nepal has no published rule for resolving a clash between a keep-it duty and a delete-it duty; in practice the keep-it duty wins because it carries a tax or licence penalty and the delete-it duty does not.

Data Center and Cloud Service Directives 2081 section 7(5) requires immediate notification of unauthorised access to the regulatory body and to the National Cyber Security Center; section 8(3) requires a customer that spots unauthorised access to tell its provider and to notify the Center in writing if a forensic investigation is needed, and the Center must report back within one month. Cyber Security Byelaw 2077 rules 58 to 60 require licensees to have an incident response team and a plan and to work with a named task force chaired by the Director of the Monitoring Division of the telecoms authority. The central bank's Cyber Resilience Guidelines of August 2023 set a two-hour target for resuming critical operations after a disruption, which is a recovery objective rather than a reporting deadline. So there is effectively one clock, and it says 'immediately' rather than a number.

(1) Privacy Act 2075 section 29(2): imprisonment up to three years or a fine up to thirty thousand rupees (about 215 US dollars) or both. The fine is trivial; the prison term is not, and it attaches to people. (2) Section 30(2): complaint to the district court within three months of the act. (3) Data Center and Cloud Service Directives 2081 section 8. (4) Section 33: for anyone under eighteen, or of unsound mind, or with an intellectual disability, only a guardian or curator can consent, and only where publication benefits that person. (5) Electronic Transactions Act 2063 section 47: up to five years' imprisonment or a fine up to one hundred thousand rupees (about 720 US dollars) or both for publishing material online that is contrary to public morality or decent behaviour, or that spreads hatred between communities. Section 48 adds up to two years for divulging information obtained under that Act. Also worth knowing: the Privacy Act bans a public body from processing sensitive information about caste, ethnicity, political affiliation, religion, health, sexual life or property at all, with only narrow health and self-publication exceptions.

Dormant switches matter more here than pending legislation, because most of Nepal's data rules are ministerial directives made under section 79 of the Electronic Transactions Act 2063 and can be rewritten without going near parliament. Four to watch. First, the Department of Information Technology can remove a data centre or cloud provider from its list after a fifteen-day show-cause and seven-day decision, which forces every customer of that provider to migrate. Second, the steering committee chaired by the ministry secretary can order any government body into the state data centre at a time of its choosing. Third, the ministry can issue new directives under section 79 at will, which is exactly how the 2025 data centre rule appeared. Fourth, the telecoms authority can amend the Cyber Security Byelaw 2077 by board decision. Treat the current permissive position as revocable rather than settled.