Nepal

Nepal's Privacy Act, 2075 (2018) was authenticated 18 September 2018 and came into force immediately under its own section 1(2). It is a privacy tort and confidentiality code, not a General Data Protection Regulation (GDPR)-shaped comprehensive regime: twelve chapters each protect privacy of a distinct subject matter, backed by a single uniform criminal penalty and court-based compensation rather than administrative fines.

Scope varies provision by provision between duties running to "a public body," "a public body or body corporate," and "no one"; the private-sector reach must be read clause by clause rather than assumed uniform. Biometric information is protected as ordinary personal information and, separately, as a non-disclosure-without-consent category, but section 27 affirmatively excludes it from the Act's one heightened "sensitive information" tier, a deliberate omission rather than an absent concept.

The Data Act, 2079 (2022), reported by secondary sources to be a separate data-governance statute establishing a National Data Council and a not-yet-fully-operational Data Protection Authority, is not obtained in primary text and is not catalogued here; its cross-border and other posture remains unconfirmed.

Nepal has no scraping-specific statute; general computer-misuse and copyright law govern each dimension separately.

The Electronic Transactions Act, 2063 (2008) criminalises accessing a computer, programme, information, or data without the authorisation of its owner or operator, or contrary to the terms of an authorisation given (s. 45); the offence turns on the absence of authorisation rather than on how a page was reached, so a plain reading does not resolve whether reading a public, unauthenticated page without defeating any access control falls inside or outside it, and no reported Nepali case has tested the point either way.

A neighbouring section penalises damaging or diminishing the value of a computer system or its information with a wrongful intent to cause loss (s. 46), and a separate morality-based offence bars publishing material online that is contrary to public morality or decent behaviour or that spreads hatred among communities (s. 47), neither keyed to data collection. No Nepali court has ruled on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper.

The Copyright Act, 2059 (2002) permits citing a small portion of a published work, and reproducing or broadcasting portions of a newspaper or journal to disseminate current information, without the author's authorisation, so long as the source and author are named and the use is not prejudicial to the author's economic right (ss. 17, 20); Nepal has not enacted a text-and-data-mining exception, so training a model on scraped copyrighted text rests only on this general citation ground.

The Act separately protects a compilation, arrangement, or database, machine-readable or not, that is original in its presentation or selection, as a work in its own right independent of any sui generis regime (s. 3(2)), and bars reproducing a significant portion of a database through digital transmission where doing so would be prejudicial to the economic right of the author or database owner (s. 16(2)).

No Nepali statute or reported case establishes a scraping-specific unfair-competition, misappropriation, or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule. Personal data scraped from a public Nepali website is governed by the Privacy Act, 2075 (2018), catalogued under this jurisdiction's privacy topic.

Nepal has not enacted a general cybersecurity or incident-reporting statute reaching a private-sector operator outside the financial sector, distinct from the Electronic Transactions Act's intrusion offences.

The Nepal Telecommunications Authority's own cyber-security page lists a Cyber Security Policy and a Cyber Crime Bill among its published documents, both labelled draft (masyauda), alongside a 2015 Cyber Security Awareness Report and a 2017 ITU-assisted draft structure for a cybercrime law; no enacted cybersecurity act or cybercrime-specific code beyond the Electronic Transactions Act's own offences appears anywhere on that page, which is otherwise actively maintained with notices dated as recently as fiscal year 2082/83 (2025/26).

Secondary commentary reports that the Council of Ministers approved a National Cyber Security Policy, 2080 in 2023; that approval is not corroborated by any primary source read here, and the Telecommunications Authority's own current policy listing still names a Cyber Security Policy among its drafts rather than its enacted policies, so the claim is treated as unconfirmed rather than adopted into this finding.

The Telecommunications Act, 2053 (1997), the founding statute of the telecommunications regulator, imposes no product-security, vulnerability-handling, or incident-reporting duty on a licensee; its one use of the word security is section 19's grant to the Government of Nepal of emergency powers to seize a licensee's telecommunications line and system, or to intercept and stop transmissions, during a state of emergency or for national security, a power exercised against a licensee's infrastructure rather than a duty imposed on it.

Separately, the Telecommunications Authority has required, since at least fiscal year 2077/78 (2020/21), that a subset of its licensees submit annual internal and external IS and Cloud Audit reports, and it maintains a standing roster of enlisted IS and Cloud auditors and periodically solicits cyber security consulting firms to join that roster for the coming fiscal year; a 2079 (2023) notice on the same page records a Detailed Project Report for establishing a Computer Emergency Response Team for the telecom and ICT industry, indicating that body did not yet exist at that date.

The directive, bylaw, or licence condition that creates the audit-submission duty, its precise scope among the Authority's licensee classes, and any penalty for a licensee that does not submit are not stated in the sources read; the finding here rests on the Authority's own published rosters and notices rather than on the instrument that creates the duty, so it is named as an unconfirmed sectoral practice rather than filed as an instrument.

Nepal Rastra Bank, the central bank, issued Cyber Resilience Guidelines in August 2023 under its monetary policy for fiscal year 2022/23 (policy number 128, directing that a Cyber and Information Security Guideline would be issued for institutions licensed to carry out payment-related transactions).

The Guidelines bind every Licensed Institution of the Bank's Payment Systems Department, namely A, B, C and D class banks and financial institutions together with Payment System Operators and Payment System Providers, and any financial market infrastructure the Bank separately designates.

They set out a principles-based cyber-resilience framework across governance, identification, protection, detection, and response and recovery, built on the CPMI-IOSCO Guidance on Cyber Resilience for Financial Market Infrastructures, including a two-hour resumption-time objective for critical operations after a disruption.

The Bank states that it anticipates every Licensed Institution will adhere strictly to the Guidelines and will assess each one's compliance against its own risk-based methodology and criticality to the financial system, but the Guidelines themselves set no fixed reporting clock to the Bank and no written penalty scale of their own, leaving enforcement to the Bank's ordinary supervisory and licensing powers over the class of institution it regulates.

The Nepal Rastra Bank's Information Technology Guidelines for banks are filed as rows of their own.

Nepal's Privacy Act, 2075 (2018), this jurisdiction's privacy-topic instrument, contains no security-of-processing or reasonable-safeguards article of the kind General Data Protection Regulation (GDPR) Article 32 or Korea's PIPA Article 29 supply; its scope is a consent-based catalogue of subject-matter-specific prohibitions with no general data-security duty, so there is no comprehensive-regime safeguards clause to leave with that topic rather than record here.

The Electronic Transactions Act, 2063 (2008) section 45 unauthorised-access offence, and its neighbouring sections 46 and 47, bind the person who intrudes on or misuses a computer system rather than the system's operator or manufacturer, and are this jurisdiction's scraping-topic finding rather than a security-topic one. No product-security or connected-device statute reaching a manufacturer or software distributor was found.

A Data Act, 2079 (2022) is reported by secondary sources, and recorded without primary text in this jurisdiction's own privacy-topic finding, to establish a National Data Council and a not-yet-fully-operational Data Protection Authority; because it has not been confirmed in primary text there either, no claim is made here about whether it reaches this topic's product-security, incident-reporting, sector, or baseline dimensions.

Nepal Rastra Bank’s Information Technology Guidelines of August 2012 state that commercial banks should compulsorily comply with them. The same Guidelines call for a bank to report its electronic attacks and suspected electronic attacks to Nepal Rastra Bank monthly.

Nepal has no press-publisher neighbouring right and no mandatory platform-to-publisher bargaining code; the general copyright framework of the Copyright Act, 2059 (2002) is the only law reaching an aggregator's reproduction of news content.

Section 20 permits, without the author's or copyright owner's authorisation and by naming the source and author, printing or broadcasting a newspaper or journal article, reproducing or broadcasting an event to inform the general public about a current event, and reproducing or communicating some portions of a regular newspaper or journal for the purpose of disseminating current information; the provision carries no headline-length or short-extract cap distinct from a requirement that the act not be prejudicial to the author's economic right, and it is unavailable where the author has indicated the work is not to be reproduced.

No reported Nepali decision applies section 20 to a systematic news aggregator rather than a single act of reporting. The National Broadcasting Act, 2049 (1993) licenses the operation of a broadcasting station and sets programme and advertising standards for radio and television broadcasters; its licensing and standards regime does not reach the online republication of another outlet's text or a hyperlink to it, so it is not catalogued here.

The Government of Nepal's Online Media Operation Directive, 2073 (2016) sets registration and content standards for online news portals but is a directive rather than a statute passed by Parliament, so it is described here rather than catalogued as an instrument.

No statute or case law addresses whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer, and no hot-news or misappropriation doctrine distinct from ordinary copyright law exists. The Copyright Act predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists.