# Individual Privacy Act, 2075 (2018) — Nepal

- **Record type**: Policy instrument
- **Jurisdiction**: Nepal
- **Instrument type**: Act / statute
- **Status**: In force
- **Binding**: Yes
- **Issuing body**: Federal Parliament of Nepal
- **Adopted**: 2018-09-18
- **In force**: 2018-09-18

## In brief

The Nepal Privacy Act 2075 is a binding act of Nepal, issued by the Federal Parliament of Nepal. It has been in force since 18 September 2018. Public bodies and private entities in Nepal that collect or process personal information, including through electronic means. 1 obligation is recorded against it, each with its source reference.

## Summary

The Individual Privacy Act 2075 gives effect to the constitutional right to privacy in Nepal. It regulates the collection, storage, processing, use and disclosure of personal information by public bodies and private entities, requires consent for collection and use of personal data subject to exceptions, restricts sensitive data, and provides remedies and penalties. It is the main binding law affecting AI systems that process personal data in Nepal. The Individual Privacy Regulation 2077 (2020) provides implementing rules.

## Scope

Public bodies and private entities in Nepal that collect or process personal information, including through electronic means. It does not address AI specifically.

## Who it applies to

Any organisation collecting or processing personal information of individuals in Nepal.

## What organisations must do

Obtain consent before collecting personal information, use it only for the stated purpose, keep it secure, and respect restrictions on sensitive data and on disclosure.

## Key dates

Enacted 2018 (2075 BS); Individual Privacy Regulation 2077 adopted in 2020.

## Penalties

The Act provides for fines and imprisonment for violations, with amounts set in the Act (reviewer to confirm).

## Notes on dates

Dates converted from Bikram Sambat; reviewer to confirm.

## Obligations recorded against this instrument (1)

- **Collect and use personal information only with consent and for the stated purpose** (Chapter on collection and protection of personal information (reviewer to cite sections)) — Personal information may be collected only by authorised persons for a lawful purpose with the individual's consent, and must not be used or disclosed for other purposes without consent, subject to statutory exceptions. AI systems trained on or processing personal data of people in Nepal must respect these limits.
  - Binding: yes
  - Record: https://aipolicytracker.org/obligations/nepal-privacy-act-consent-and-purpose

## Provenance

- **Permanent id**: AIPT-POL-0139 (https://aipolicytracker.org/id/AIPT-POL-0139; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/policies/nepal-individual-privacy-act
- **Official source**: https://lawcommission.gov.np/
- **Source document**: Individual Privacy Act, 2075 (2018)
- **Published by**: Nepal Law Commission
- **Provision**: Document-level URL and section references to be added by reviewer
- **Review status**: verified
- **Confidence**: medium
- **Facts last confirmed**: 2026-09-26
- **Confirmed by**: Bhaskar Bhatt (see https://aipolicytracker.org/reviewers)
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Individual Privacy Act, 2075 (2018) — Nepal" [AIPT-POL-0139, record version 1, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-POL-0139 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.