Nepal Privacy Act 2075: requirements, deadlines and compliance actions
Individual Privacy Act, 2075 (2018) — Nepal
What is the Nepal Privacy Act 2075?
The Individual Privacy Act 2075 gives effect to the constitutional right to privacy in Nepal. It regulates the collection, storage, processing, use and disclosure of personal information by public bodies and private entities, requires consent for collection and use of personal data subject to exceptions, restricts sensitive data, and provides remedies and penalties. It is the main binding law affecting AI systems that process personal data in Nepal. The Individual Privacy Regulation 2077 (2020) provides implementing rules.
Who does it apply to?
Public bodies and private entities in Nepal that collect or process personal information, including through electronic means. It does not address AI specifically.
Any organisation collecting or processing personal information of individuals in Nepal.
When do the requirements apply?
Enacted 2018 (2075 BS); Individual Privacy Regulation 2077 adopted in 2020.
Dates converted from Bikram Sambat; reviewer to confirm.
What must organisations do?
Obtain consent before collecting personal information, use it only for the stated purpose, keep it secure, and respect restrictions on sensitive data and on disclosure.
Legal requirement Collect and use personal information only with consent and for the stated purpose Chapter on collection and protection of personal information (reviewer to cite sections)
Personal information may be collected only by authorised persons for a lawful purpose with the individual's consent, and must not be used or disclosed for other purposes without consent, subject to statutory exceptions. AI systems trained on or processing personal data of people in Nepal must respect these limits.
Practical action: Document consent and purpose for any Nepal personal data used in AI training or inference.
Evidence examples: Consent and purpose records
Framework mapping (original, editorial): ISO/IEC 42001:2023 Annex A controls on data for AI systems
Obligation page Source-linked
Penalties
The Act provides for fines and imprisonment for violations, with amounts set in the Act (reviewer to confirm).
Official sources
-
Individual Privacy Act, 2075 (2018)
Nepal Law Commission · 18 Sep 2018 · Tier 1 source
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.