Collect and use personal information only with consent and for the stated purpose

Practical action

Document consent and purpose for any Nepal personal data used in AI training or inference.

Who does it apply to?

All public bodies and private entities processing personal information in Nepal.

Actors

Provider / developerDeployer / user organisationPublic authority / government body

Sectors

Cross-sector / all sectors

Use cases

Biometrics and facial recognitionAI in finance, credit and insurance

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesProcessData protection officer · once per ai system
  Privacy and data-protection controls for AI

  Serves 13 recorded duties · evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use

  Consent and purpose documentation for Nepal personal data.

• supportsProcessModel development lead · at launch and on material change
  Training-data provenance and copyright register

  Serves 4 recorded duties · evidence: Training source register, Copyright and rights-reservation policy, Public summary of training content

  Source register records the basis for each training source.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

• NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk

  Crosswalk · XLSX · v3

• AI Data Governance Register

  Register · XLSX and DOCX · v3

• AI Audit Evidence Tracker

  Register · XLSX · v1

All 5 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every Nepal duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Collect and use personal information only with consent and for the stated purpose (Nepal Privacy Act 2075)” [AIPT-OBL-0052, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0052 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0052: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Individual Privacy Act, 2075 (2018), Nepal Law Commission, https://lawcommission.gov.np/.

@misc{aipolicytracker2026_collectandusepersonalinf,
  author       = {{AIPolicyTracker}},
  title        = {{Collect and use personal information only with consent and for the stated purpose (Nepal Privacy Act 2075)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/nepal-privacy-act-consent-and-purpose}},
  url          = {https://aipolicytracker.org/obligations/nepal-privacy-act-consent-and-purpose},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

Similar obligations in other instruments

• Deployers must use the provider's transparency information in their data protection impact assessment — EU AI Act, European Union
• Process personal data only with valid consent or a legitimate use, after notice — India DPDP Act, India
• Identify consent or an applicable PDPA exception before using personal data in AI — PDPC AI advisory guidelines, Singapore
• Employers and employment agencies must disclose the data collected and their retention policy for the tool — NYC Local Law 144 (automated employment decision tools), New York (United States)