Privacy and Data Protection Law
As businesses collect and process more personal data than ever, privacy and data protection have moved from a technical concern to a core legal obligation. We advise companies, technology platforms, financial institutions, healthcare providers, employers and public bodies on how to handle personal information lawfully in Nepal and across borders.
The Legal Framework
The right to privacy is guaranteed by the Constitution of Nepal, and the Individual Privacy Act, 2075 (2018) together with the Individual Privacy Rules, 2077 (2020) set out the main statutory framework. The Act protects personal information, correspondence, residence, property and data held by public and private bodies, and requires consent for collection and use of personal information, with limits on disclosure and transfer. The Electronic Transactions Act, 2063 (2006) adds obligations around electronic records, unauthorised access and computer-related offences, and sector regulators, including Nepal Rastra Bank for payment and financial data, issue their own directives.
The framework is still developing, and enforcement practice is evolving. That makes a clear internal policy and documented consent practices the most reliable protection for an organisation handling personal data today.
What We Do
- Compliance assessments: reviewing how an organisation collects, stores, uses and shares personal data against Nepali law and international best practice.
- Policies and documentation: privacy policies, consent forms, data-processing agreements, employee data policies and retention schedules.
- Cross-border data transfers: advice where foreign tools, service providers, group companies or investors are involved.
- Cybersecurity and breach response: incident response protocols, regulatory notifications and managing the legal consequences of a breach.
- Sector-specific compliance: fintech, e-commerce, health data, HR data and marketing communications.
- Disputes and enforcement: representation in complaints, regulatory inquiries and litigation involving privacy or misuse of personal information.
Our Approach
We help clients build privacy into their operations rather than bolt it on afterwards, so that growth, new products and cross-border partnerships do not stall on a data protection issue nobody flagged early.
