Nepal

The Act sets no General Data Protection Regulation (GDPR)-style enumerated lawful-basis list; each chapter instead states a "no one shall do X without consent" rule for its own subject matter, with scattered exceptions (court order, authorized-official demand, criminal investigation, public-interest research). Section 23(1) restricts collection to an official authorized under law or a person that official permits, a public-sector-centric default.

Section 12(3) (purpose limitation) and section 26(1) (consent to use) both expressly name "a public body or body corporate," so those two duties bind private entities directly. There is no formal controller/processor allocation and no registration regime. In force immediately from authentication.

Section 28 is the sole rights-like provision located: a right to apply to the concerned public body to correct information the person believes is wrong or not fact-based, with the public body deciding after inquiry whether to correct it. The right does not run against a private body corporate on its face. No express right of access, erasure, portability, or objection was found anywhere in the sections read, a materially thinner rights catalog than this batch's other South Asian jurisdictions.

No Data Protection Authority or equivalent regulator is established by this Act; enforcement runs through the District Court. An aggrieved person may file a complaint within three months of the offending act, except for a defined subset of more serious offences, including a section 27(1) sensitive-information violation and a section 23 unauthorized-collection violation, where the Government of Nepal itself becomes the plaintiff.

Penalty is a single uniform band across every offence, imprisonment up to three years or a fine up to NPR 30,000, or both. Section 31 gives a genuine, court-mediated private right of action: a person harmed by an offence or other act under the Act may complain directly to the District Court for compensation, and the court shall order reasonable compensation paid by the offender if it finds compensation warranted.

Section 2(c)(6) defines "personal information" to include a person's thumb impressions, fingerprints, retina of eye, blood group, or other biometric information. Section 11(2)(f) lists biological or biometric data and thumb impression as a protected "personal document" category, and section 12(4)(e) separately bars a third party from disclosing or publishing another person's biometric details without consent once held.

Section 19(3) restricts the act of recording a private conversation without consent or lawful authorization, with an express carve-out for a speech or statement made publicly; it does not itself govern what may be done with a recording once lawfully obtained.

Section 27's "sensitive information" list, the Act's one heightened-protection category, excludes biometric data entirely: caste/ethnicity/origin, political affiliation, religious faith, health, sexual orientation, and property details are listed, but biometric data is not among them. No dedicated biometric consent form, retention ceiling, or destruction-duty timeline exists.

Section 45 makes it an offence for a person, with intent to access a programme, information, or data of a computer, to use that computer without the authorisation of its owner or the person responsible for it, or, even holding authorisation, to act contrary to the terms of that authorisation with intent to access a programme, information, or data.

The offence is defined by the absence or excess of authorisation, not by the technical method of access, so it does not on its face distinguish a public, unauthenticated page from one behind a login. Section 1(3) extends the Act throughout Nepal and to any person committing an offence against it from anywhere.

Section 17 permits citing some portions of a published work for fair use, without the author's or copyright owner's authorisation, provided the source and author's name are mentioned and the citation is not prejudicial to the author's economic right.

Section 20 separately permits reproducing, broadcasting, or communicating some portions of a regular newspaper or journal for the purpose of disseminating current information, and reproducing or broadcasting an event to inform the general public, again without authorisation and subject to naming the source, unless the author has indicated the work is not to be reproduced.

Neither provision is framed as a text-and-data-mining exception, and no such exception exists in Nepali copyright law; training a model on scraped copyrighted text has no dedicated statutory shelter beyond these general citation and current-information grounds.

Section 3(2) protects, as an original work independent of the copyright in its underlying contents, any collection of works or any data or database readable with or without the support of a machine that is presented as original from the viewpoint of its presentation, collection, or expression. Nepal has no separate sui generis database right of the European kind; protection is compilation-based and turns on originality of selection or arrangement.

Section 16(2) separately bars reproducing a significant portion of a database through digital transmission, as an exception to the personal-use allowance, where doing so would be prejudicial to the economic right of the author or the copyright owner.

Section 20(1) permits, without the author's or copyright owner's authorisation and by mentioning the source and the author's name, three acts: (a) printing in a newspaper or journal, or broadcasting or otherwise communicating to the public, an article, including a political or religious article, published in a newspaper or journal, provided this is not prejudicial to the author's economic right; (b) reproducing, broadcasting, or otherwise communicating or reporting an event to inform the general public about a current event; and (c) reproducing, broadcasting, or communicating to the public some portions of a regular newspaper or journal that regularly publishes information for communication to the general public, or pleadings made in court proceedings, for the purpose of disseminating current information.

Section 20(2) makes the whole exception unavailable where the author has indicated that the work is prohibited from being reproduced, broadcast, or otherwise communicated. The provision carries no distinct headline-length or short-extract cap, no restriction naming an aggregator as opposed to a single publisher, and no reported Nepali decision has applied it to a systematic aggregator.