Nepal. Comprehensive data protection. Act

Privacy ActIndividual Privacy Act, 2075 (2018)

In force

Partly verified

Medium confidence. Exact authentication/commencement dates and penalty amounts could not be verified (official PDF fetch failed).

§1Summary

Synopsis

Gives effect to the constitutional right to privacy, covering privacy of body, residence, property, documents, communications and personal data held by public and private bodies. Personal data may only be collected, processed or disclosed with consent or legal authority, and violations are state-party criminal offences.

Key themes

consent
personal information
confidentiality
communications privacy
criminal sanctions
CCTV

Unique features

No regulator; enforcement via police FIR and district courts, with offences prosecuted by the state.

SaaS relevance

Applies to SaaS processing personal information in Nepal; separate directives require cloud/data-centre providers to be listed with the Department of Information Technology.

§2Obligations

Breach notification: None
DPO: No
Cross-border transfers: No specific transfer rule in the Act; cloud/data-centre listing requirements apply domestically

§3Dates

Key dates

Adopted 2018
In force 2018
Implemented by Individual Privacy Regulation, 2077 (2020).

§4Text and authority

Text

Authoritative text lawcommission.gov.np

Authority

None designated

§5Where it applies

Domestic law of: Nepal

§6Sources and verification

Verification

Medium confidence.

Partly verified

Medium confidence. Exact authentication/commencement dates and penalty amounts could not be verified (official PDF fetch failed).