NepalPrivacy Act, 2075, enforcement and compensation
Privacy Act, 2075 (2018), Act Number 14 of 2075, ss.29-32
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- An app that violates Nepal's Privacy Act in handling personal information, including a biometric identifier, exposes itself to a District Court criminal complaint (imprisonment up to three years or a fine up to NPR 30,000, or both) and to a direct civil compensation claim a harmed person may bring themselves in the District Court; Nepal has no dedicated Data Protection Authority.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Committing an offence under section 29(1) (e.g. unauthorized collection, use, or disclosure of personal information, including a biometric identifier) is punishable by imprisonment up to three years, a fine up to NPR 30,000, or both (s.29(2)). For the most serious listed offences (clauses (c), (m), (p), (q), (r), (s) and (t) of s.29(1)), the Government of Nepal itself prosecutes as plaintiff (s.29(3)).
Penalty structure
Section 29(2) punishes an offence under section 29(1) with imprisonment of up to three years, a fine of up to thirty thousand rupees, or both.
- Rule
- Fixed only
- As of
- Currency
- NPR
- Fixed cap
- 30,000
Who enforces it
Enforcement body
The District Court system (judicial, complaint-driven); the Government of Nepal prosecutes as plaintiff for the most serious offences under s.29(3). No dedicated Data Protection Authority exists.
Settledness
Enforcement under these sections runs through complaints to the District Court.
- As of
- Open questions
- Does the "reasonable compensation" a District Court may order under section 31 also follow where the offence is one in which the Government of Nepal "shall become the plaintiff" under section 29(3), when section 31 speaks of a complaint by "the concerned person or victim"?
- Does the three-month period in section 30(2), counted "from the date of commission of such act", run from the day a person learns that collected information was misused?
What it makes you log
Logging duty
Sections 29 to 32 make listed breaches of the Act offences punishable by up to three years' imprisonment or a fine of 30,000 rupees, give the person a complaint to the District Court within three months, a compensation claim in that court, and departmental punishment of a public-post holder. They name no regulator with a power to demand records (the Act creates no data protection authority) and require no one to make, keep or produce a log or record.
- Kind
- None
- As of
What this law does
No Data Protection Authority or equivalent regulator is established by this Act; enforcement runs through the District Court. An aggrieved person may file a complaint within three months of the offending act, except for a defined subset of more serious offences, including a section 27(1) sensitive-information violation and a section 23 unauthorized-collection violation, where the Government of Nepal itself becomes the plaintiff.
Penalty is a single uniform band across every offence, imprisonment up to three years or a fine up to NPR 30,000, or both. Section 31 gives a genuine, court-mediated private right of action: a person harmed by an offence or other act under the Act may complain directly to the District Court for compensation, and the court shall order reasonable compensation paid by the offender if it finds compensation warranted.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .