NepalPrivacy Act, 2075, general privacy and collection regime
Privacy Act, 2075 (2018), Act Number 14 of 2075, ss.1(2), 12(3), 23, 24, 26(1)
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal information of an individual in Nepal, including a voiceprint, faceprint, or other biometric identifier, must have the person's consent or fall within a statutory exception before collecting it, and a body corporate must limit use to its stated purpose and obtain consent before using the information for another purpose.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does section 23(1), which bars anyone except "the person permitted by such official" from collecting personal information, reach a private app that collects information only with the consent of the person concerned, a route the section 23(2) text confines to "study, research or collection of public opinion"?
- Does "body corporate" in section 26(1), defined as an entity "established under the prevailing law", reach a foreign company that has no Nepali establishment but collects information about people in Nepal?
What it makes you log
Logging duty
Section 23 limits who may collect, store and process personal information and, for study or research, requires the collector to tell the person the time, content, nature and objective of the collection; section 12(3) limits use of consented data to the purpose of collection; section 26(1) bars use or disclosure without consent; section 24 lists public-post details that are not personal information. Each is a limit on collection or use or a notice to the person, and none requires anyone to make, keep or produce a log or record. The cited sections state no territorial clause, so no jurisdiction hook is stated.
- Kind
- None
- As of
What this law does
The Act sets no General Data Protection Regulation (GDPR)-style enumerated lawful-basis list; each chapter instead states a "no one shall do X without consent" rule for its own subject matter, with scattered exceptions (court order, authorized-official demand, criminal investigation, public-interest research). Section 23(1) restricts collection to an official authorized under law or a person that official permits, a public-sector-centric default.
Section 12(3) (purpose limitation) and section 26(1) (consent to use) both expressly name "a public body or body corporate," so those two duties bind private entities directly. There is no formal controller/processor allocation and no registration regime. In force immediately from authentication.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .