Nepal Privacy Act compliance and requirements, so your data handling holds up when someone asks.

What it is

What is Nepal's Privacy Act and what is it used for?

The Privacy Act, 2075 (2018) is Nepal's general privacy law, authenticated on 18 September 2018 and in force immediately. It protects privacy of body, residence, property, documents, data, correspondence, character and electronic means. It requires consent when personal or family data is collected, limits bodies corporate and public bodies to using data for the purpose of collection, bars passing on or publishing health, property and income, employment, family, biometric, signature, political or business transaction details without consent, prohibits unauthorised access to and recording of electronic communications, and sets conditions for CCTV.

The Individual Privacy Regulations, 2077, made under section 36, add consent before electronic personal information is used by another person, confidentiality and security for electronic records, notice of how data will be used before it is collected, and a permission regime for CCTV at business premises run by the District Administration Office. The Act creates no data protection authority: a concerned person may complain to the District Court and seek compensation, and the Government of Nepal is plaintiff for the offences the Act lists. The practical test: for any personal data you hold, could you show the consent, the notice, the purpose and how it is protected?

Current law. The Privacy Act, 2075 (2018), Act No. 14 of 2075, was authenticated on 18 September 2018 (2075.6.2) and provides that it comes into force immediately. The Individual Privacy Regulations, 2077 were published in the Nepal Gazette and state that they commence immediately. The Nepal Law Commission publishes an English translation of the Act. Confirm current wording with your legal advisers.

Who it is for

Who needs to comply with the Nepal Privacy Act?

The Act protects every person's privacy, and its duties fall on bodies corporate and public bodies that collect, hold or use personal information, and on businesses that run CCTV. Organisations usually come to Sterling for a structured programme from one of four directions:

• You collect personal or family data. The Act requires consent at collection and limits a body corporate to using the data for the purpose it was collected for, and the 2077 Regulations require people to be told how their data will be used before it is gathered.
• You hold sensitive personal details. Employers, insurers and lenders must not pass on or publish health, income, employment, family, biometric or transaction details without the person's consent.
• You keep records electronically. The 2077 Regulations require electronic information to be kept confidential and secure against unauthorised access, use, change or disclosure.
• You run CCTV at business premises. Banks, financial institutions, shopping malls, hotels, industries and similar premises apply to the District Administration Office for permission, post visible notices and keep footage confidential, secure and out of commercial use.

The aim is handling of personal information that you control and can evidence. Compliance depends on how the rules are applied every day, not on a policy document alone.

Requirements

What are the main Nepal Privacy Act requirements?

Strip away the vocabulary and Nepal's Privacy Act requires a business to respect privacy in six practical areas of data and surveillance. The list below puts each one in business terms; the Act and the 2077 Regulations give the full wording and exceptions.

• Consent before collecting personal data: obtain the person's consent when collecting personal or family data, and use data a business collects only for the purpose it was collected for.
• Tell people how data will be used: explain the purpose, content and protection of the information before collecting it, and give notice of how collected personal data will be used.
• Keep listed details confidential: do not pass on or publish health, income, employment, family, biometric, signature, political or business transaction details about a person without their consent.
• Secure information held electronically: keep electronic records confidential and protected against unauthorised access, use, change or disclosure, so only people entitled by law can reach them.
• No unauthorised interception or recording: do not access, listen to or record someone's electronic communications or conversations without their consent or an authorised official's lawful order.
• Run CCTV with permission and notice: never place cameras in toilets, bathrooms or changing rooms, post visible notices, obtain permission for business premises, and keep footage secure and out of commercial use.

Compliance route

How do you achieve Nepal Privacy Act compliance?

There is no certificate at the end of this route. Compliance is something your organisation demonstrates, to a court if a complaint arises, and to customers who ask. Sterling helps you build and run the programme; interpretation of the law in contested cases remains with your legal advisers and, ultimately, the courts.

1. 01
   Map the personal information you handle.Customers, staff, patients, users and suppliers: what is collected, for which purpose, with what consent, where it is stored, who can reach it, which listed details it includes and where cameras record.
2. 02
   Gap analysis: compare current practice with the Act.Each area of the Act reviewed against what actually happens, with actions, owners and dates agreed.
3. 03
   Put the controls and routines in place.Rewrite notices and consent wording, set purpose and disclosure controls for the listed details, secure electronic records, apply for or confirm CCTV permission with signage and footage rules, and agree how complaints are handled.
4. 04
   Test the programme and review the results.Internal review of samples, a simulated incident or data-subject request, and a management review that closes findings with evidence.
5. 05
   Operate, demonstrate and keep it current.Record consents and complaints, review access to electronic records, keep CCTV permissions and notices current, refresh training and track any new Rules the Government of Nepal frames under the Act.

Check the route before you sign. The Act and the 2077 Regulations create no certificate of compliance, so treat any offer of a "Privacy Act certificate" with suspicion. If a customer wants independent assurance, ISO/IEC 27701 or ISO/IEC 27001 is certifiable by an accredited certification body; confirm the body's accreditation scope directly with the accreditation body concerned.

Cost

How much does Nepal Privacy Act compliance cost?

The cost of a Nepal Privacy Act programme is driven by how much personal information you hold, how many systems and suppliers touch it, and how much already works. Your proposal shows each component, with what is included and what remains for your legal advisers.

Timeline

How long does Nepal Privacy Act compliance take?

Timing depends on how scattered your personal information is, how quickly system owners respond and how much has to change. Your proposal sets out the phases for your scope, long enough to map the information, fix the gaps and show that requests and incidents are handled the way the procedures say.

If a customer or contract has set a date, tell us at the outset and we will say plainly what can be in place by then and what should follow.

Your engagement

What your Nepal Privacy Act engagement includes

Your scope covers the full programme, from the information map to evidence that runs. Sterling does not certify, attest or validate compliance with the Act, and the Act creates no certificate of compliance; complaints under it go to the District Court, and we work alongside your legal advisers.

• Information map, gap analysis and plan

  Sources, systems, suppliers and overseas flows, with actions and owners agreed.

• Policies, notices and procedures

  Notices, consent wording, disclosure, security and CCTV procedures, complaint handling and supplier terms, drafted from Sterling's own templates with your teams.

• Effivity ISO & GRC software

  Registers, requests and incidents managed in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal review and management review

  Sample testing, an incident exercise and findings closed with evidence.

• Consent and CCTV support

  Help preparing consent and notice wording and CCTV permission applications to the District Administration Office, with findings closed with evidence.

Sterling OS™ sets how we deliver. Design™ is guided support, where your team builds the programme with our consultants' direction; Drive™ is managed support, where our consultants do most of the work with your input. You choose one of the two, not both in sequence. Once the programme is operating, Sustain™ keeps reviews, training and updates on schedule, and Automate™ is Effivity, where the records live.

The Act creates no data protection authority. A concerned person may complain to the District Court and seek compensation, the Government of Nepal is plaintiff for the offences the Act lists, and the District Administration Office grants permission for CCTV at business premises.

Often combined with

Standards organisations pair with Privacy Act (Nepal)

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.