NepalPrivacy Act, 2075, sensitive information and biometric data
Privacy Act, 2075 (2018), Act Number 14 of 2075, ss.2(c)(6), 11(2)(f), 12(4)(e), 19(3), 27
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that holds a voiceprint, faceprint, or other biometric identifier of a person in Nepal must have the person's consent before disclosing or publishing it to a third party, and must have consent or lawful authorization before recording a private conversation to derive it in the first place, though Nepal's Privacy Act does not treat biometric data as a heightened "sensitive information" category the way it treats caste, political affiliation, religion, health, or sexual orientation.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does section 27(1), which bars a public body from processing "sensitive personal information", leave biometric data outside it, given that the section 27(2) list omits biometric data while section 3(3) protects "biological or biometric identity"?
- Does section 19(3), which bars listening to "dialogue or talks held between two or more than two persons through electronic means", reach an app that records the voice of its own user speaking to the app?
What it makes you log
Logging duty
Section 12(4) bars providing or publishing listed data, including biometric details, without the person's consent, section 11(2)(f) lists biological or biometric data as a personal document, section 19(3) bars listening to or recording a conversation without consent or an official order, and section 27 bars a public body from processing sensitive information. Each is a prohibition or a condition of processing; the recording that section 19(3) mentions is an act the Act forbids, not a record it requires. None requires anyone to make, keep or produce a log or record, and the cited sections state no territorial clause.
- Kind
- None
- As of
What this law does
Section 2(c)(6) defines "personal information" to include a person's thumb impressions, fingerprints, retina of eye, blood group, or other biometric information. Section 11(2)(f) lists biological or biometric data and thumb impression as a protected "personal document" category, and section 12(4)(e) separately bars a third party from disclosing or publishing another person's biometric details without consent once held.
Section 19(3) restricts the act of recording a private conversation without consent or lawful authorization, with an express carve-out for a speech or statement made publicly; it does not itself govern what may be done with a recording once lawfully obtained.
Section 27's "sensitive information" list, the Act's one heightened-protection category, excludes biometric data entirely: caste/ethnicity/origin, political affiliation, religious faith, health, sexual orientation, and property details are listed, but biometric data is not among them. No dedicated biometric consent form, retention ceiling, or destruction-duty timeline exists.
When LexLint raises it
When your app profile says your app processes biometric data or processes voice recordings.
Back to the example · Lint your app
Page updated .