Privacy Act, 2075 (2018)
No dedicated data protection authority; District Court enforcement
No dedicated data protection authority; District Court enforcement
The Privacy Act, 2075 (2018), Act No. 14, was authenticated on 18 September 2018 and commenced immediately. It protects privacy of the body, residence, property, documents, data, correspondence, character and electronic communications, and contains a chapter on collection and protection of personal information. The official Nepali Privacy Rules, 2077 provide implementing detail under section 36.
The Act does not create a dedicated data-protection authority or a general DPO, DPIA, breach-notification or international-transfer framework. Offences and compensation claims are handled through the criminal process and the concerned District Court, subject to the Act.
Use controls that match Nepal's actual statute: authority and consent for collection, clear notices, security of public-body records, permitted use and disclosure, sensitive information, correction, minors and complaint readiness. Do not copy in GDPR obligations that the Act does not contain.