🇳🇵Privacy Act, 2075 (2018)
The Privacy Act, 2075 (2018)
The Act is a broad privacy and personal-information law rather than a comprehensive controller-accountability regime. Its personal-information provisions are concentrated in Chapter 10, while earlier chapters protect physical, residential, property, documentary, communications, image and electronic privacy. The Privacy Rules, 2077 should be used for the prescribed procedural and form detail; the Act controls the obligations summarised here.
Operational requirements
Collection authority and notice: Section 23 generally restricts collection, storage, protection, analysis, processing or publication to legally authorised persons. Research or public-opinion collection based on consent requires full purpose information and the specified collection and protection details.
Security: Section 25 requires a public body to protect information under its responsibility and arrange against unauthorised access, use, alteration, disclosure, publication or transmission.
Use and disclosure: Section 26 generally prohibits a public body or body corporate from using or disclosing information without consent, subject to listed legal, investigative, court and public-interest exceptions.
Sensitive information and correction: Section 27 restricts public-body processing of listed sensitive information. Section 28 provides a correction application for inaccurate public-body information.
Children and enforcement: Sections 23(6) and 33 address guardian or curator involvement for persons under 18 and other protected persons. Sections 29-31 provide offences, a three-month complaint period for specified complaints, District Court jurisdiction and compensation.
Several Chapter 10 duties are expressly framed for public bodies, and some also cover bodies corporate. Apply each control only to the entities and activity stated in the relevant section.