Duty LXD-1370
Processes biometric data, in Nepal
Privacy Act, 2075, general privacy and collection regimesince 1 line
Privacy Act, 2075 (2018), Act Number 14 of 2075, ss.1(2), 12(3), 23, 24, 26(1) · Read the law's page
- An app that collects, uses, or discloses the personal information of an individual in Nepal, including a voiceprint, faceprint, or other biometric identifier, must have the person's consent or fall within a statutory exception before collecting it, and a body corporate must limit use to its stated purpose and obtain consent before using the information for another purpose.
Privacy Act, 2075, sensitive information and biometric datasince 1 line
Privacy Act, 2075 (2018), Act Number 14 of 2075, ss.2(c)(6), 11(2)(f), 12(4)(e), 19(3), 27 · Read the law's page
- An app that holds a voiceprint, faceprint, or other biometric identifier of a person in Nepal must have the person's consent before disclosing or publishing it to a third party, and must have consent or lawful authorization before recording a private conversation to derive it in the first place, though Nepal's Privacy Act does not treat biometric data as a heightened "sensitive information" category the way it treats caste, political affiliation, religion, health, or sexual orientation.
Privacy Act, 2075, enforcement and compensationsince 1 line
Privacy Act, 2075 (2018), Act Number 14 of 2075, ss.29-32 · Read the law's page
- An app that violates Nepal's Privacy Act in handling personal information, including a biometric identifier, exposes itself to a District Court criminal complaint (imprisonment up to three years or a fine up to NPR 30,000, or both) and to a direct civil compensation claim a harmed person may bring themselves in the District Court; Nepal has no dedicated Data Protection Authority.