When must a company register its data‑processing activities with NTA?

Registration is mandatory for entities providing internet services, OTT platforms or any electronic communication that processes personal data of Nepali users under the Telecommunications Act 2053. Failure to register can result in service suspension.

How is consent obtained under Nepali law?

Consent must be a clear, affirmative act recorded in writing or electronically, stating the processing purpose, data categories and the right to withdraw. Implicit consent through silence is not acceptable under the ETA.

What penalties can arise from a data breach?

The ETA allows imprisonment up to three years and fines up to NPR 5 million for cyber‑crime offences. The Individual Privacy Act also permits civil claims for damages, and regulators may levy administrative penalties for non‑compliance.

Can foreign investors access Nepali personal data?

Foreign investors may process Nepali data only after obtaining clearance under the Foreign Investment and Technology Transfer Act and ensuring cross‑border transfers meet the Individual Privacy Act’s requirements. Without clearance, the transaction can be blocked.

Do I need to appoint a data‑protection officer in Nepal?

The law does not mandate a specific Data Protection Officer, but appointing a senior officer to oversee compliance is considered best practice and demonstrates accountability to regulators.

How long does the regulator review take for a privacy filing?

NTA typically responds within 30 days; however, if additional information such as a revised security audit or a notarized Nepali translation is requested, the process can extend to 60 days or more. Submitting a complete packet initially shortens the wait.

Can a breach be reported anonymously?

Yes. The Police Cyber Bureau accepts anonymous breach reports, although anonymity may limit the authority’s ability to enforce penalties or require the reporting entity to provide supporting evidence.

Data Protection Lawyer Nepal - Privacy Compliance Services

Q: Is there a specific data protection law in Nepal?

No. Nepal does not have a single comprehensive Data Protection Act; duties are derived from the Electronic Transactions Act 2063, the Individual Privacy Act 2075 and sector‑specific rules such as the Telecommunications Act 2053.

A data‑privacy lawyer in Nepal helps businesses meet obligations under the Electronic Transactions Act, Individual Privacy Act and sector rules by preparing policies, filing with NTA or MoCIT, and managing breach response. Our firm guides you through mapping, documentation and regulator approvals to avoid penalties and service interruptions

What is data privacy & protection compliance under Nepali law?
Data privacy and protection compliance in Nepal requires organisations that collect, store or process personal data to follow the privacy provisions of the Electronic Transactions Act 2063, the Individual Privacy Act 2075, the Telecommunications Act 2053, the Company Act 2063 and the Consumer Protection Act 2075. Regulators such as NTA, MoCIT and the Police Cyber Bureau assess compliance.

When do you need a data‑privacy lawyer in Nepal?

You receive a regulatory notice or investigation from NTA, the Police Cyber Bureau, or the Attorney General’s Office.
You must draft a privacy policy for a new digital platform, mobile app or fintech service that must satisfy the ETA and Individual Privacy Act.
You plan a cross‑border data transfer involving foreign investors; the Foreign Investment and Technology Transfer Act adds a clearance step.
You are undertaking a merger, acquisition or joint venture and discover missing consent records or undocumented processing activities.
A consumer files a complaint under the Consumer Protection Act alleging misleading data use.

How to navigate the data privacy compliance process in Nepal

Pre‑assessment & data mapping – Identify every type of personal data you collect, its storage location and processing purpose. This reveals which statutes apply and flags high‑risk flows regulators often examine.
Legal risk analysis – Compare existing contracts, consent forms and internal policies with statutory duties. Highlight gaps such as missing lawful basis, weak security controls or non‑compliant cross‑border clauses.
Policy drafting & stakeholder review – Prepare a privacy notice, data‑processing agreement and internal procedures tailored to your business model. Share drafts with senior management, IT and compliance officers before any filing.
Regulatory filing & approvals – Submit the required packet to NTA (for ISPs or OTT services) or MoCIT (for broadcasting platforms). Include data‑flow diagrams, a security audit report and, if requested, a certified Nepali translation of the policy. Regulators often seek clarification on encryption standards, adding two to four weeks to the timeline.
Implementation & training – After receiving an acceptance letter, embed the policies into your systems, run staff workshops on consent collection and breach response, and set up a log for future incident reporting.
Ongoing compliance monitoring – Conduct periodic reviews to stay aligned with amendments to the ETA, Individual Privacy Act or new guidance from NTA or MoCIT.
Incident response & remediation – If a breach occurs, manage notification to affected individuals, the Police Cyber Bureau and the Attorney General’s Office, and advise on steps that reduce penalties and protect reputation.

How our lawyers support your compliance journey

We perform a data‑mapping exercise that often uncovers hidden processing activities in legacy systems.
We draft and negotiate privacy clauses in commercial contracts, ensuring third‑party agreements meet Nepal’s consent and security expectations.
We act as the point of contact with NTA, MoCIT and the Police Cyber Bureau, answering queries, filing objections and securing the approvals your digital service needs.

Fees and timeline for data‑privacy services in Nepal

Start‑up package: NPR 150,000 – 250,000 for a basic privacy policy and filing.
Fintech platform: NPR 600,000 + depending on data volume and cross‑border elements.

Typical schedule: data‑mapping (2–3 weeks) → policy drafting (1–2 weeks) → regulator review (3–6 weeks, longer if additional security audit or certified Nepali translation is required). Delays often stem from incomplete consent records.

foreign investment approval process
company registration in Nepal

Typical mistakes and risks in Nepal’s data‑privacy landscape

Omitting “data‑processing” as a business activity in Company‑Act filings, triggering licensing queries.
Using outdated or missing consent for existing customers; the Individual Privacy Act treats this as a violation.
Failing to register OTT or VoIP services with NTA, leading to service‑blocking orders.
Mismatched filings between the Department of Industry and the Office of Company Registrar, causing verification conflicts.
Ignoring cross‑border transfer rules, exposing the firm to fines under the Foreign Investment and Technology Transfer Act.

Deliverables you receive from our data‑privacy engagement

A privacy notice and data‑processing agreement drafted in English and Nepali.
Complete filing packets submitted to NTA or MoCIT, together with acknowledgment receipts.
A compliance checklist and internal SOPs covering data handling, breach response and periodic audits.
Legal opinion letters confirming conformity with the Electronic Transactions Act and related statutes.

Data Privacy & Protection Compliance