NepalElectronic Transactions Act, 2063, unauthorised access to computer materials
Electronic Transactions Act, 2063 (2008), s. 45
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://www.lawcommission.gov.np/en/wp-content/uploads/2018/10/electronic-transaction-act-2063-2008.pdfIn force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not use a computer to access a programme, information, or data without the authorisation of its owner or the person responsible for it, or in a manner contrary to the terms of an authorisation given.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
A fine not exceeding NPR 200,000, or imprisonment not exceeding three years, or both, depending on the seriousness of the offence (s. 45).
Penalty structure
Fine only under section 45; the same subsection also permits imprisonment of up to three years instead of or in addition to the fine, depending on the seriousness of the offence.
- Rule
- Fixed only
- As of
- Currency
- NPR
- Fixed cap
- 200,000
What it makes you log
Logging duty
Section 45 makes it an offence to use a computer without the owner's authorization, or contrary to an authorization, with intent to access a programme, information or data in it. It imposes no duty to create, keep, produce or review a log or record. Section 55 reaches an offence committed from outside Nepal only where it involves a computer, computer system or network located in Nepal, a location-of-the-system test, so no hook value is set.
- Kind
- None
- As of
What this law does
Section 45 makes it an offence for a person, with intent to access a programme, information, or data of a computer, to use that computer without the authorisation of its owner or the person responsible for it, or, even holding authorisation, to act contrary to the terms of that authorisation with intent to access a programme, information, or data.
The offence is defined by the absence or excess of authorisation, not by the technical method of access, so it does not on its face distinguish a public, unauthenticated page from one behind a login. Section 1(3) extends the Act throughout Nepal and to any person committing an offence against it from anywhere.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .