Data Privacy and Protection Laws in Nepal

An Overview of the Legal Framework and Challenges

Data privacy and protection is a crucial issue in the digital age, as personal information and data of individuals are increasingly collected, processed, stored, and shared by various public and private entities. Data privacy and protection refers to the right of individuals to control their personal information and data and to prevent unauthorized or unlawful access, use, or disclosure of their personal information and data.

Nepal is a country in South Asia with a population of about 29 million people. It is known for its rich and diverse culture, natural beauty, and historical heritage. However, it also faces many challenges in terms of development, governance, and security. As Nepal undergoes rapid digitization and adopts new technologies, the need for safeguarding the personal information and data of its citizens becomes more urgent. However, Nepal does not have a comprehensive and unified data protection legislation that can address the various aspects and challenges of data privacy and protection. Instead, it has a patchwork of laws that deal with different aspects of data privacy and protection, which are often inadequate, inconsistent, or outdated.

In this article, we will provide an overview of the existing legal framework and the main challenges of data privacy and protection in Nepal. We will also discuss the need for comprehensive and unified data protection legislation that can provide clear definitions, principles, standards, obligations, rights, remedies, and enforcement mechanisms for data privacy and protection in Nepal.

The Existing Legal Framework of Data Privacy and Protection

The existing legal framework of data privacy and protection in Nepal consists of the following main laws:

• The Constitution of Nepal guarantees the fundamental right to privacy of every person as a part of the right to dignity under Article 28. The Constitution also provides that the state shall make legal provisions to protect the privacy of the person, residence, property, document, data, correspondence, and character of every person under Article 31(3).
• The Privacy Act, of 2075 (2018) and the Privacy Regulation, 2077 (2020), are the major laws that deal with person's privacy. These laws implement and safeguard the fundamental right to privacy guaranteed by the Constitution of Nepal. Under these laws, Nepalese citizens have the following rights as it pertains to data protection and personal privacy:
  • The right to be informed about the collection, processing, storage, and publication of their personal information and data, and to receive a copy of such information and data upon request.
  • The right to access their personal information and data held by any public or private body and to request correction or deletion of any inaccurate or outdated information or data.
  • The right to the erasure of their personal information and data from any public or private body upon their request or upon the expiry of the purpose for which the information or data was collected, unless there is a legal obligation to retain such information or data.
  • The right not to have their sensitive personal data, such as their caste, ethnicity, religion, biometric information, or criminal background, processed without their consent or authorization, unless there is a legal basis to do so.
  • The right to file a complaint and seek compensation from any public or private body that violates their privacy rights or causes any damage or harm to them due to the misuse or leakage of their personal information and data.
• The Data Act, 2079 (2022), which came into force on 13 October 2022 aims to consolidate laws relating to data collection as well as to make the task of production, processing, storage, publication, and distribution of data more reliable, systematic, and in a timely fashion. This act applies to all types of data, such as statistical data, administrative data, geospatial data, big data, open data, etc. This act establishes a National Data Council as the apex body for formulating policies and guidelines on data management and governance. It also establishes a Data Protection Authority as the regulatory body for overseeing and enforcing data protection matters. However, this act does not provide clarity on data protection-related matters and does not include comprehensive provisions relating to data collection, processing, storage, and publication thereof as well as privacy-related issues. Moreover, this act does not define key terms and concepts related to data privacy and protection, such as personal data, sensitive personal data, data subject, data controller, data processor, consent, etc.
• Other general laws such as the National Civil Code, 2074 (2017) and the National Criminal Code, 2074 (2017) also contain general provisions relating to privacy and data protection. For example, these laws prohibit unauthorized access, interception, alteration, or destruction of any electronic record or communication. They also prescribe penalties for offenses such as defamation, blackmailing, fraud, identity theft, cybercrime, etc.

The Main Challenges of Data Privacy and Protection

The existing legal framework of data privacy and protection in Nepal faces the following main challenges:

• Lack of a comprehensive and unified data protection legislation that can provide clear definitions, principles, standards, obligations, rights, remedies, and enforcement mechanisms for data privacy and protection in Nepal. The current laws are fragmented, overlapping, or conflicting, and do not cover all aspects and challenges of data privacy and protection in the digital age.
• Lack of awareness and compliance among the public and private entities that collect, process, store, and share personal information and data of individuals. Many entities do not have adequate policies, procedures, or safeguards to protect the personal information and data of individuals and do not inform or obtain consent from the individuals before collecting, processing, storing, or sharing their personal information and data.
• Lack of capacity and resources among the authorities and institutions that are responsible for overseeing and enforcing data privacy and protection matters. The National Data Council and the Data Protection Authority, which are established by the Data Act, 2079 (2022), are yet to be fully operational and functional. The Privacy Act, 2075 (2018) and the Privacy Regulation, 2077 (2020) do not specify the roles and responsibilities of the authorities and institutions that are responsible for overseeing and enforcing data privacy and protection matters.
• Lack of awareness and education among individuals about their rights and responsibilities regarding data privacy and protection. Many individuals do not know or understand their rights and responsibilities regarding data privacy and protection and do not exercise or claim their rights or remedies when their privacy rights are violated or when their personal information and data are misused or leaked.

The Need for a Comprehensive and Unified Data Protection Legislation

There is a need for comprehensive and unified data protection legislation that can provide clear definitions, principles, standards, obligations, rights, remedies, and enforcement mechanisms for data privacy and protection in Nepal. Such legislation would not only protect the privacy rights of Nepalese citizens but also promote trust, transparency, accountability, innovation, and development in the digital era.

A comprehensive and unified data protection legislation in Nepal should:

• Be based on the international best practices and standards of data privacy and protection, such as the General Data Protection Regulation (GDPR) of the European Union, the Personal Data Protection Act (PDPA) of Singapore, or the Personal Data Protection Bill (PDPB) of India.
• Be consistent with the fundamental right to privacy guaranteed by the Constitution of Nepal and the Privacy Act, 2075 (2018), and the Privacy Regulation, 2077 (2020).
• Apply to all types of personal information and data, regardless of the format, medium, or source of the personal information and data, and to all public and private entities that collect, process, store, or share personal information and data of individuals, regardless of the location, sector, or purpose of the collection, processing, storage, or sharing of the personal information and data.
• Provide clear and precise definitions of the key terms and concepts related to data privacy and protection, such as personal information, personal data, sensitive personal data, data subject, data controller, data processor, data fiduciary, data principal, consent, collection, processing, storage, publication, distribution, etc.
• Establish the principles and standards of data privacy and protection, such as lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, accountability, etc.
• Impose the obligations and duties of data controllers and processors, such as obtaining consent, providing notice, ensuring security, conducting impact assessment, maintaining records, appointing data protection officers, reporting breaches, etc.
• Recognize and protect the rights and interests of data subjects, such as access, rectification, erasure, restriction, objection, portability, non-discrimination, etc.
• Provide the remedies and redress mechanisms for data subjects, such as complaints, appeals, compensation, injunctions, etc.
• Establish the enforcement and oversight mechanisms for data privacy and protection, such as data protection authority, data protection tribunal, data protection audit, data protection certification, data protection code of conduct, etc.
• Prescribe the sanctions and penalties for data privacy and protection violations, such as fines, imprisonment, suspension, revocation, etc.

Conclusion

Data privacy and protection is a vital issue for Nepal, as it affects the rights, interests, and welfare of its citizens, as well as the trust, reputation, and competitiveness of its public and private entities. However, the current legal framework of data privacy and protection in Nepal is inadequate, inconsistent, and outdated, and does not meet the international standards and expectations of data privacy and protection. Therefore, there is an urgent need for comprehensive and unified data protection legislation that can provide a clear, coherent, and effective framework for data privacy and protection in Nepal. Such legislation would not only safeguard the privacy rights of Nepalese citizens but also foster trust, transparency, accountability, innovation, and development in the digital era.

If you are looking for legal assistance or guidance on data privacy and protection matters in Nepal, you can contact Nepal Divorce Services, a leading law firm that provides legal services and advice on divorce, family, and matrimonial matters in Nepal. We have a team of experienced and qualified lawyers who can help you with any legal issues related to divorce, separation, child custody, alimony, property division, domestic violence, etc. We also offer online consultation and representation for clients who are living abroad or cannot visit our office. We are here to help you with your legal needs and to protect your privacy and data rights.