Collect and use personal information only with consent and for the stated purpose
Under Nepal Privacy Act 2075, Chapter on collection and protection of personal information (reviewer to cite sections)
What does it require?
Personal information may be collected only by authorised persons for a lawful purpose with the individual's consent, and must not be used or disclosed for other purposes without consent, subject to statutory exceptions. AI systems trained on or processing personal data of people in Nepal must respect these limits.
Practical action
Document consent and purpose for any Nepal personal data used in AI training or inference.
Who does it apply to?
All public bodies and private entities processing personal information in Nepal.
- Sectors
- Cross-sector / all sectors
Evidence examples
- Consent and purpose records (record)
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| ISO/IEC 42001:2023 | Annex A controls on data for AI systems | Original editorial mapping. | low |
Similar obligations in other instruments
- Process personal data only with valid consent or a legitimate use, after notice — India DPDP Act, India
- Identify consent or an applicable PDPA exception before using personal data in AI — PDPC AI advisory guidelines, Singapore
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.