--- title: "Nepal Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/nepal-data-protection-privacy-regulation/ source_html: /jurisdictions/nepal/index.html description: "Nepal data protection and privacy regulation: 10 categories, 40 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: da179803b0ce2ecce864a7d57174650149fb7e4a3d6f8f88b8b4993cb3f294ad generator: "fe-fleet/md-twin@1.0" --- # Nepal Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap Last updated 2026-11-04 · 10 categories · 40 claims · 27 sources in the cumulative register Download report (PDF) Expand all Nepal's data-protection enforcement architecture remains a case of statutory framework without an operational enforcer. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: Lawful Processing & Special Data, Data Subject Rights, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework (2 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=NEPAL)[Build Report](/reports/?j=NEPAL)[Compare](/compare/?j=NEPAL) Framework posture Unregulated gap 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority No independent DPA; adjacent competence asserted for a communications/IT ministry (UR Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed 10 Categories 9 Red categories 57 Sub-modules 40 Claims 3 Tier-1 sources Traffic-light mix 9 red 1 n/a (sums to 10 rendered categories; click to filter) 9 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 913 Full executive summary 168 ###### Latest update · 4 November 2026 #### Lead Signal Nepal's Supreme Court has ordered the Government to draft a standalone Data Protection Act covering personal and biometric data collected under the National ID programme, ruling on a writ filed by advocate Sarita Adhikari on 8 June 2026. A bench of Justices Sapana Pradhan Malla and Meghraj Pokharel directed that the forthcoming legislation clearly define data collection purposes, usage limits, data-subject rights, and establish an independent oversight body along with penalties and remedies. No standalone data protection statute currently exists in Nepal, and the ruling marks a structural order to create one rather than a reform of an existing framework. In a related ruling, the same court process addressed biometric verification practice in the banking sector. The Court struck down the provision of Nepal Rastra Bank's Unified/Integrated Directive 2082 requiring the National ID card or its number to serve as the sole basis for customer identification and biometric verification when opening or renewing a bank account. The Court held that private-bank access to biometric data without a clear legal framework or explicit consent risks violating Article 28 of the Constitution, which protects the right to privacy. #### Other Developments National identity data now sits under explicit judicial scrutiny. The Court's order for a standalone Data Protection Act is framed specifically around data collected under the National ID programme, suggesting the forthcoming legislative requirement, whenever drafted, will need to address identity and biometric data handling as a central use case rather than as one example among others. Banks lose a compliance shortcut, not an identification option. The ruling does not prohibit banks from using the National ID card as one means of identification; it removes the requirement to treat it as the sole and mandatory basis for identity verification. Banks retain the ability to use the National ID card, but as of 9 October 2026 can no longer refuse banking services solely because a customer declines to use it for biometric verification. #### Cross-Monitor Connections The National ID biometric-verification ruling touches financial-sector customer-identification practice, a subject more fully addressed by financial-integrity monitoring; this brief surfaces the data-protection dimension of the ruling and does not reanalyse the know-your-customer implications in depth. #### Outlook The Government has not yet indicated a drafting timeline for the ordered standalone Data Protection Act, and no formal status is available on whether drafting has begun. Until such a law is enacted, Nepal continues to lack a dedicated data protection statute, leaving data collection purposes, usage limits, data-subject rights and independent oversight for the National ID programme without statutory definition. Separately, whether the removal of the NID-sole-basis rule extends beyond banks to non-bank payment-wallet providers remains unsettled as at mid-October 2026. 3 earlier updates not shown here. ###### Standing brief · as of 23 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Nepal's data-protection enforcement architecture remains a case of statutory framework without an operational enforcer. The Data Act, 2079 (2022) established both a National Data Council and a dedicated Data Protection Authority, but as of 2026, roughly four years after enactment, neither body is reported to be fully operational. The Data Act's regulatory stage is best read as enacted but not yet effective in practical terms: the instrument is in force as law, yet the institutional infrastructure it creates has not reached operational status, a distinction with real consequences for anyone assessing Nepal's practical data-protection risk exposure rather than its formal statutory position. This gap sits alongside a separate, in-force penalty structure under the Individual Privacy Act, 2075 (2018), which sets a penalty band of up to three years' imprisonment and a fine of NPR 30,000 for privacy breaches: the statutory sanction exists on paper, but with no functioning enforcement authority behind it, no enforcement track record has been identified this cycle. #### Other Developments Statutory foundation unchanged, operational gap persists. The Individual Privacy Act, 2075 (2018) remains Nepal's principal data-protection and privacy statute as of 2026. A comprehensive, GDPR-aligned Personal Data Protection Bill has reportedly been discussed for years but has not been enacted, leaving the 2018 Act as the operative framework notwithstanding its narrower scope relative to a comprehensive omnibus statute. Penalty structure without a functioning enforcer. The Individual Privacy Act's own enforcement provisions are already in force: sanctions running up to three years' imprisonment and a fine of NPR 30,000 apply to privacy breaches as a matter of enacted law. The practical significance of this is limited, however, precisely because the designated enforcing authority, the Data Protection Authority under the 2079 Act, has not been confirmed as operational, so the sanction's deterrent value in practice remains untested on the evidence available this cycle. #### Cross-Monitor Connections The pattern identified here, a statutory framework enacted in full but an enforcing authority left non-operational years afterward, is structurally similar to the pattern financial-integrity tracks in Nepal's anti-money-laundering posture, where legislative and ordinance-level output has similarly outpaced enforcement and prosecutorial follow-through. Readers tracking Nepal's regulatory-capacity trajectory across monitors may find this cross-domain pattern, rather than any single-sector development, the more durable signal. #### Outlook The central open question for the next cycle is whether the Data Protection Authority established under the Data Act, 2079 makes any operational appointments or issues any guidance, which would be the first concrete evidence of the enforcement body moving from statute to practice. Absent that, the penalty band under the Individual Privacy Act will remain a paper sanction rather than an enforced one. Read full brief · 913 words Standing brief, as of 25 October 2026. #### Regulatory Status Nepal has no independent statutory data-protection authority; adjacent competence over information-technology and privacy matters sits with the Ministry of Communication and Information Technology. The Individual Privacy Act 2075 remains the principal statute in force. Separately, sources conflict on whether the Information Technology and Cyber Security Bill 2082 has been enacted: one account has it passing the House of Representatives in August 2025 with full enactment unconfirmed as of mid-2026, while another, dated October 2026, describes it as still tabled and under active parliamentary review. That Bill, if and when fully enacted, would establish a Data Protection Board and introduce a mandatory breach-notification duty that does not presently exist in Nepali law. #### Outlook The enactment status of the IT and Cyber Security Bill 2082 is the development to watch, loosely expected to resolve within the fourth quarter of 2026, though the uncertainty band on that timing is wide. Until it resolves, the institutional and statutory position described above stands unchanged. Read full brief · 168 words Key regulatory facts for Nepal Regulatory Dimension Nepal Standing Position Jurisdiction Nepal (NP) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 40 sourced findings) Regulator & Framework No independent supervisory authority exists and the seed-anchor regulator URL does not resolve to the ministry it is labelled as; the only in-force instrument (Individual Privacy Act 2018) is explicitly narrower than... Lawful Processing & Special Data No comprehensive lawful-basis, consent, special-category, or pseudonymisation regime identified; jurisdiction_status is unregulated_gap for this domain. Data Subject Rights No confirmed statutory data-subject-rights framework; absence is treated as a genuine gap given jurisdiction_status=unregulated_gap. Controller/Processor Duties Confirmed absence of DPO/controller-processor definitions; all other accountability sub-modules unconfirmed and treated as gaps. Primary Instruments Cited OneTrust DataGuidance, OneTrust DataGuidance, OneTrust DataGuidance, Biometric Update, Worldwatch Global Last Confirmed / Updated 2026-11-04 (27 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Nepal: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No independent supervisory authority exists and the seed-anchor regulator URL does not resolve to the ministry it is labelled as; the only in-force instrument (Individual Privacy Act 2018) is explicitly narrower than a comprehensive data-protection statute. Primary framework Individual Privacy Act, 2075 (2018); Electronic Transactions Act, 2063 (2006) Supervisory authority [No independent DPA; adjacent competence asserted for a communications/IT ministry (URL verification mismatch found -- see narrative)](https://moics.gov.np/) Traffic-light rationale — Red No independent supervisory authority exists and the seed-anchor regulator URL does not resolve to the ministry it is labelled as; the only in-force instrument (Individual Privacy Act 2018) is explicitly narrower than a comprehensive data-protection statute. #### Sub-modules (5) #### Regulator And AuthorityRed No dedicated data protection authority exists in Nepal; the Individual Privacy Act 2018 does not establish or designate a supervisory body. Claims (3): - Nepal's Individual Privacy Act, 2075 (2018) does not establish or designate an independent data protection authority or regulatory authority. - Ministry of Communication and Information Technology (MoCIT) — No independent dedicated data-protection authority exists; the National Data Office under the Individual Privacy Act 2075 has not been empowered as a regulatory agency - No independent statutory data-protection authority exists in Nepal; adjacent competence over information-technology/privacy matters sits with the Ministry of Communication and Information Technology. #### Act And InstrumentsAmber The Individual Privacy Act, 2075 (2018) is the primary privacy-adjacent statute currently in force; the Electronic Transactions Act, 2063 (2006) contains separate confidentiality/non-disclosure obligations for electronic records. Claims (6): - The Individual Privacy Act, 2075 (2018) is Nepal's primary in-force privacy-related statute but is narrower in scope than a comprehensive GDPR-type data-protection law. - Nepal's Electronic Transactions Act, 2063 (2006) imposes confidentiality/non-disclosure duties on persons who obtain access to electronic records under statutory powers, functioning as an adjacent but non-comprehensive data-handling constraint. - Government of Nepal — Standalone Data Protection Act - Information Technology and Cyber Security Bill 2082 — Tabled May 2025, would replace the Electronic Transactions Act 2063 and add data-related provisions (Chapter 10); unauthenticated as of the most recent secondary reporting, no stage movement found this window - Government of Nepal — Standalone Data Protection Act defining data-collection purposes, use limits, data-subject rights, an independent oversight body, and penalties/remedies, for personal/biometric data under the National ID programme - Information Technology and Cyber Security Bill 2082 — One source states the Bill 'passed' the House of Representatives in August 2025 with full enactment unconfirmed as of mid-2026; another, dated October 2026, describes it as 'tabled' and 'under active parliamentary review'. #### Material ScopeRed The Act's material scope is narrower than a comprehensive personal-data regime and lacks core definitions found in GDPR-style statutes. Claims (2): - The Individual Privacy Act, 2075 (2018) does not define the terms 'data controller' or 'data processor', indicating a narrower material scope than comprehensive controller/processor-based regimes. - Individual Privacy Act 2075 s.27(2) — Sensitive personal information as caste/ethnicity/origin, political affiliation, religious faith, physical/mental health, sexual orientation and property details; public entities prohibited from processing absent diagnosis/treatment/emergency grounds or self-publication #### Territorial ScopeRed No provision establishing extraterritorial/territorial application to non-established controllers was identified in available sources. #### Regulator Registration And FilingRed No controller registration or filing regime exists in the absence of a supervisory authority. Claims (1): - No statutory controller registration or filing obligation exists in Nepal in the absence of a designated supervisory authority under the Individual Privacy Act. Nepal has no independent, dedicated data-protection authority. The Act does not provide for a data protection authority or regulatory authority. Adjacent regulatory competence is asserted by the seed to sit with a communications/IT ministry, but live verification of the seed-injected URL (https://moics.gov.np/) during this run resolved to the Ministry of Industry, Commerce and Supplies, not a Ministry of Communication and Information Technology -- this is flagged as a QA discrepancy requiring operator confirmation of the correct MoCIT-equivalent domain. The primary in-force instrument is the Individual Privacy Act, 2075 (2018), supplemented by confidentiality/disclosure restrictions in the Electronic Transactions Act, 2063 (2006); neither constitutes a comprehensive GDPR-type statute. Periodic update · new data 2026-11-04 #### Regulator & Framework Nepal's Supreme Court has ordered the Government to enact a standalone Data Protection Act, ruling on a writ filed by advocate Sarita Adhikari on 8 June 2026 before a bench of Justices Sapana Pradhan Malla and Meghraj Pokharel. The order is directed specifically at data collected and processed under the National ID programme, and it is understood to require the forthcoming legislation to clearly define data collection purposes, set usage limits, articulate data-subject rights, establish an independent oversight body, and provide for penalties and remedies for non-compliance. This is a structural development: Nepal currently has no standalone data protection statute, and the ruling does not amend an existing framework but orders the creation of one. The breadth of elements the Court specified, covering purpose limitation, use restriction, enforceable individual rights, an independent regulator, and a penalty regime, maps closely onto the core architecture found in comprehensive data protection statutes elsewhere, suggesting the Court intends a comprehensive instrument rather than a narrow sectoral rule confined to identity documents. The order's framing around the National ID programme specifically means the first test of any resulting legislation is likely to be how it governs a large-scale government biometric identity system, rather than commercial data processing generally. This sequencing, regulation emerging first in response to a state identity programme rather than commercial adtech or cross-border transfer pressure, differs from the path many frameworks have followed elsewhere and may shape which provisions are prioritised and drafted first. #### Outlook No formal status is available on whether the Government has begun drafting the ordered Data Protection Act, or on what timeline it intends to bring legislation forward. Until such a law is enacted, data collection purposes, usage limits, data-subject rights and independent oversight for the National ID programme remain without statutory definition in Nepal, and the practical content of the ordered framework depends entirely on how the Government chooses to draft it. 1 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework Nepal has no independent statutory data-protection authority. Adjacent competence over information-technology and privacy matters currently sits with the Ministry of Communication and Information Technology, a general-purpose ministry rather than a body constituted to supervise data protection as such. This institutional gap is the structural backdrop against which the rest of the framework must be read: there is no regulator positioned to issue guidance, receive complaints at the administrative level, or enforce the Individual Privacy Act 2075 outside the court system. The clearest open question in the framework is the status of the Information Technology and Cyber Security Bill 2082, which would, if and when fully enacted, establish a Data Protection Board and introduce a mandatory breach-notification duty that does not presently exist. The record is genuinely split on where that Bill stands: one account describes it as having passed the House of Representatives in August 2025, with full enactment unconfirmed as of mid-2026, while another account, dated October 2026, describes the Bill as still tabled and under active parliamentary review. These are not two framings of the same fact but a direct conflict between sources on whether a specific legislative step has occurred, and it is reported here as such rather than resolved in either direction. #### Outlook Resolution of the Bill's enactment status is the single development most likely to change this picture, with a loosely expected window in the fourth quarter of 2026 and a wide uncertainty band around that timing. Until the conflict in reporting is resolved, Nepal's data-protection framework continues to rest on the Individual Privacy Act 2075, administered without a dedicated regulator. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (13) - [OneTrust DataGuidance](https://www.dataguidance.com/notes/nepal-data-protection-officer-appointment) — Nepal's Individual Privacy Act, 2075 (2018) does not establish or designate an independent data protection authority or regulatory authority. - [OneTrust DataGuidance](https://www.dataguidance.com/legal-research/individual-privacy-act-2075-2018) — The Individual Privacy Act, 2075 (2018) is Nepal's primary in-force privacy-related statute but is narrower in scope than a comprehensive GDPR-type data-protection law. - [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/The_Electronic_Transactions_Act.pdf) — Nepal's Electronic Transactions Act, 2063 (2006) imposes confidentiality/non-disclosure duties on persons who obtain access to electronic records under statutory powers, functioning as an adjacent but non-comprehensive data-handling constraint. - [OneTrust DataGuidance](https://www.dataguidance.com/notes/nepal-data-protection-officer-appointment) — The Individual Privacy Act, 2075 (2018) does not define the terms 'data controller' or 'data processor', indicating a narrower material scope than comprehensive controller/processor-based regimes. - [OneTrust DataGuidance](https://www.dataguidance.com/notes/nepal-data-protection-officer-appointment) — No statutory controller registration or filing obligation exists in Nepal in the absence of a designated supervisory authority under the Individual Privacy Act. - [Biometric Update](https://www.biometricupdate.com/202610/nepal-supreme-court-orders-dedicated-data-protection-law-for-national-id) — Government of Nepal — Standalone Data Protection Act - Primary statutory record — Data Act 2079 establishes a National Data Council and DPA, neither fully operational as of 2026. - [Worldwatch Global](https://worldwatch.global/nepal/cybersecurity) — Ministry of Communication and Information Technology (MoCIT) — No independent dedicated data-protection authority exists; the National Data Office under the Individual Privacy Act 2075 has not been empowered as a regulatory agency - [Attorney Nepal](https://www.attorneynepal.com/blog/cybersecurity-laws-nepal) — Information Technology and Cyber Security Bill 2082 — Tabled May 2025, would replace the Electronic Transactions Act 2063 and add data-related provisions (Chapter 10); unauthenticated as of the most recent secondary reporting, no stage movement found this window - [The Farsight Nepal](https://farsightnepal.com/news/how-privacy-act-covers-you/) — Individual Privacy Act 2075 s.27(2) — Sensitive personal information as caste/ethnicity/origin, political affiliation, religious faith, physical/mental health, sexual orientation and property details; public entities prohibited from processing absent diagnosis/treatment/emergency grounds or self-publication - [Biometric Update](https://www.biometricupdate.com/202610/nepal-supreme-court-orders-dedicated-data-protection-law-for-national-id) — Government of Nepal — Standalone Data Protection Act defining data-collection purposes, use limits, data-subject rights, an independent oversight body, and penalties/remedies, for personal/biometric data under the National ID programme - [Worldwatch Global](https://worldwatch.global/nepal/cybersecurity) — Information Technology and Cyber Security Bill 2082 — One source states the Bill 'passed' the House of Representatives in August 2025 with full enactment unconfirmed as of mid-2026; another, dated October 2026, describes it as 'tabled' and 'under active parliamentary review'. - [Law Alpine](https://lawalpine.com/blog/data-protection-bill-nepal-business-impact) — No independent statutory data-protection authority exists in Nepal; adjacent competence over information-technology/privacy matters sits with the Ministry of Communication and Information Technology. ### Nepal: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ No comprehensive lawful-basis, consent, special-category, or pseudonymisation regime identified; jurisdiction_status is unregulated_gap for this domain. Primary framework Individual Privacy Act, 2075 (2018) (narrow scope only) Traffic-light rationale — Red No comprehensive lawful-basis, consent, special-category, or pseudonymisation regime identified; jurisdiction_status is unregulated_gap for this domain. D2 · Lawful Processing — Full Module Record 4 sub-modules · 69 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Nepal: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No confirmed statutory data-subject-rights framework; absence is treated as a genuine gap given jurisdiction_status=unregulated_gap. Primary framework Individual Privacy Act, 2075 (2018) (narrow scope only) Traffic-light rationale — Red No confirmed statutory data-subject-rights framework; absence is treated as a genuine gap given jurisdiction_status=unregulated_gap. #### Sub-modules (5) #### Access RightRed No confirmed statutory subject-access-request mechanism located. Claims (1): - Nepal Individual Privacy Act, 2075 (2018) — a right to be informed and a right of access to one's own personal data #### Rectification And ErasureRed No confirmed statutory rectification or erasure ('right to be forgotten') mechanism located. Claims (3): - Nepal Individual Privacy Act, 2075 (2018) — a right to rectification and a right to erasure of inaccurate or unlawfully held personal data, together with a right to file a complaint and seek compensation via the District Court - Individual Privacy Act 2075 s.28 — Right to rectification of inaccurate personal data, enforceable to the District Court within a 3-month limitation period; no general access, erasure, objection or portability right exists - Individual Privacy Act 2075 — s.28 gives data subjects the right to request correction of inaccurate personal data on supporting evidence; the data handler must process the request 'within a reasonable time', with no fixed statutory deadline figure stated. #### Restriction And ObjectionRed No confirmed restriction-of-processing or objection/profiling opt-out right located. #### Data PortabilityRed No confirmed data-portability right located. #### Deadlines And Response WindowsRed No confirmed statutory controller response-window/deadline regime located. Claims (1): - Individual Privacy Act 2075 — A Privacy Act complaint must be filed at the District Court within 3 months of the incident. No statutory subject-access, rectification/erasure, restriction/objection, portability, or defined response-window framework equivalent to a comprehensive DP statute was located for Nepal. The Individual Privacy Act 2018's rights architecture (per available secondary analysis) does not extend to a full GDPR-style data-subject-rights suite. Sources and claims (5) - [CaseGuard](https://caseguard.com/articles/new-legislation-for-data-privacy-protection-in-nepal/) — Nepal Individual Privacy Act, 2075 (2018) — a right to be informed and a right of access to one's own personal data - [LawAlpine](https://lawalpine.com/blog/privacy-laws-in-nepal) — Nepal Individual Privacy Act, 2075 (2018) — a right to rectification and a right to erasure of inaccurate or unlawfully held personal data, together with a right to file a complaint and seek compensation via the District Court - [Worldwatch Global](https://worldwatch.global/nepal/cybersecurity) — Individual Privacy Act 2075 s.28 — Right to rectification of inaccurate personal data, enforceable to the District Court within a 3-month limitation period; no general access, erasure, objection or portability right exists - [https://lawalpine.com/blog/privacy-laws-in-nepal](https://lawalpine.com/blog/privacy-laws-in-nepal) — Individual Privacy Act 2075 — A Privacy Act complaint must be filed at the District Court within 3 months of the incident. - [LawAlpine](https://lawalpine.com/blog/privacy-laws-in-nepal) — Individual Privacy Act 2075 — s.28 gives data subjects the right to request correction of inaccurate personal data on supporting evidence; the data handler must process the request 'within a reasonable time', with no fixed statutory deadline figure stated. ### Nepal: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Confirmed absence of DPO/controller-processor definitions; all other accountability sub-modules unconfirmed and treated as gaps. Primary framework Individual Privacy Act, 2075 (2018) (narrow scope only) Traffic-light rationale — Red Confirmed absence of DPO/controller-processor definitions; all other accountability sub-modules unconfirmed and treated as gaps. D4 · Controller & Processor — Full Module Record 7 sub-modules · 56 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Nepal: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Complete absence of confirmed cross-border transfer regulation; treated as a genuine gap consistent with jurisdiction_status=unregulated_gap. Traffic-light rationale — Red Complete absence of confirmed cross-border transfer regulation; treated as a genuine gap consistent with jurisdiction_status=unregulated_gap. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 27 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Nepal: D6 Sectoral Watch7 sub-modulesRedEnacted in forceModule confidence: Probable▾ No sector-specific DP overlays confirmed across financial, health, telecoms, employment, credit, education, or insurance sectors. Traffic-light rationale — Red No sector-specific DP overlays confirmed across financial, health, telecoms, employment, credit, education, or insurance sectors. Periodic update · new data 2026-10-11 #### Sectoral Watch Nepal Rastra Bank's 15th Amendment to the Integrated Payment Systems Directive, 2082 introduces a financial-sector identity-verification overlay onto the country's general data-handling environment. Licensed payment service providers must verify a digital-wallet applicant's National Identity Card details before opening a wallet; for existing users, the same verification must be completed by 17 October 2026. This is a payments-regulatory instrument rather than a data-protection statute, but it has direct consequences for how personal identity data is collected, matched against a government register, and held by private payment service providers as a condition of continued service. The amendment sits alongside Nepal's existing general-law position: there is no independent data-protection authority to oversee how the collected National ID data is secured or retained, and no statutory breach-notification duty applies if the resulting identity-linked wallet records are compromised. The overlay therefore expands the volume and sensitivity of personal data held by a regulated private sector at the same time the general protective architecture around that data remains unchanged. #### Outlook The 17 October 2026 update deadline for existing wallet holders is the operative date to watch; it will show whether enforcement reaches the installed base of users as firmly as it reaches new applicants. No indication has surfaced of a parallel identity-verification mandate being extended to other financial products or non-banking payment channels at this stage. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 43 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Nepal: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No adtech/commercial-privacy regulation confirmed across any sub-module. Traffic-light rationale — Red No adtech/commercial-privacy regulation confirmed across any sub-module. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 21 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Nepal: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No algorithmic/biometric/surveillance-governance regime confirmed despite targeted searches on national ID and SIM-registration biometric contexts. Traffic-light rationale — Red No algorithmic/biometric/surveillance-governance regime confirmed despite targeted searches on national ID and SIM-registration biometric contexts. Periodic update · new data 2026-11-04 #### Algorithmic, Biometric & Surveillance Governance Nepal's Supreme Court has struck down a provision of Nepal Rastra Bank's Unified/Integrated Directive 2082 that required the National ID card or its number to serve as the sole basis for verifying a customer's identity, including biometric verification, when opening or renewing a bank account. The ruling, handed down on 9 October 2026, holds that private-bank access to biometric data without a clear legal framework or explicit consent risks violating Article 28 of the Constitution, which protects the right to privacy. The ruling draws a distinction between use of the National ID card as one available means of identification, which remains permissible, and its imposition as the sole mandatory basis for identity and biometric verification, which the Court found constitutionally problematic absent a clear legal framework and explicit consent. The practical effect is that banks can no longer refuse services solely because a customer declines biometric verification tied to the National ID card; customers retain other means of identification. The decision is significant because it addresses biometric data processing in the banking sector specifically through a constitutional privacy lens, rather than through banking-regulation or consumer-protection doctrine alone, and it does so in the absence of any standalone data protection statute. This leaves the ruling operating as a freestanding constitutional check on biometric data practice pending the separate order for a standalone Data Protection Act addressed elsewhere in this review. Whether this reasoning extends beyond banks to other sectors that have adopted similar National-ID-based biometric verification requirements, such as non-bank payment-wallet providers, is not yet settled. The ruling as reported is confined to the banking directive at issue, and no parallel finding concerning other regulated sectors has been identified. #### Outlook Whether the quashing of the National-ID-sole-basis rule extends to non-bank payment wallets, or remains confined to banks regulated under Nepal Rastra Bank's directive, remains unsettled as at mid-October 2026. The broader question of how biometric data processing will be governed once the ordered standalone Data Protection Act is drafted, including whether it will codify the Article 28 consent standard the Court applied here, is also open. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 25 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Nepal: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No children/vulnerable-groups-specific data-protection regime confirmed. Traffic-light rationale — Not assessed No children/vulnerable-groups-specific data-protection regime confirmed. #### Sub-modules (5) #### Age VerificationRed No statutory age-of-consent-for-data-processing threshold identified. #### Parental ConsentRed No parental-consent mechanism (COPPA/Art.8-equivalent) identified. #### Minor Profiling BansRed No minor-specific profiling ban identified. #### Education SettingsRed No education-settings-specific data rule identified. #### Dependent AdultsRed No dependent-adult (elderly/incapacitated) data-protection regime identified. No age-of-consent-for-processing rule, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adult protection regime was located for Nepal. ### Nepal: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No DP-specific enforcement architecture exists absent a designated regulator; recent-developments search returned no Nepal-specific comprehensive-DP-law activity. Traffic-light rationale — Red No DP-specific enforcement architecture exists absent a designated regulator; recent-developments search returned no Nepal-specific comprehensive-DP-law activity. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 57 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties