Nepal Data Protection & Privacy Regulation

In a related ruling, the same court process addressed biometric verification practice in the banking sector. The Court struck down the provision of Nepal Rastra Bank's Unified/Integrated Directive 2082 requiring the National ID card or its number to serve as the sole basis for customer identification and biometric verification when opening or renewing a bank account. The Court held that private-bank access to biometric data without a clear legal framework or explicit consent risks violating Article 28 of the Constitution, which protects the right to privacy.

Other Developments

National identity data now sits under explicit judicial scrutiny. The Court's order for a standalone Data Protection Act is framed specifically around data collected under the National ID programme, suggesting the forthcoming legislative requirement, whenever drafted, will need to address identity and biometric data handling as a central use case rather than as one example among others.

Banks lose a compliance shortcut, not an identification option. The ruling does not prohibit banks from using the National ID card as one means of identification; it removes the requirement to treat it as the sole and mandatory basis for identity verification. Banks retain the ability to use the National ID card, but as of 9 October 2026 can no longer refuse banking services solely because a customer declines to use it for biometric verification.

Cross-Monitor Connections

The National ID biometric-verification ruling touches financial-sector customer-identification practice, a subject more fully addressed by financial-integrity monitoring; this brief surfaces the data-protection dimension of the ruling and does not reanalyse the know-your-customer implications in depth.

Outlook

The Government has not yet indicated a drafting timeline for the ordered standalone Data Protection Act, and no formal status is available on whether drafting has begun. Until such a law is enacted, Nepal continues to lack a dedicated data protection statute, leaving data collection purposes, usage limits, data-subject rights and independent oversight for the National ID programme without statutory definition. Separately, whether the removal of the NID-sole-basis rule extends beyond banks to non-bank payment-wallet providers remains unsettled as at mid-October 2026.

3 earlier updates not shown here.

Standing brief · as of 23 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Nepal's data-protection enforcement architecture remains a case of statutory framework without an operational enforcer. The Data Act, 2079 (2022) established both a National Data Council and a dedicated Data Protection Authority, but as of 2026, roughly four years after enactment, neither body is reported to be fully operational. The Data Act's regulatory stage is best read as enacted but not yet effective in practical terms: the instrument is in force as law, yet the institutional infrastructure it creates has not reached operational status, a distinction with real consequences for anyone assessing Nepal's practical data-protection risk exposure rather than its formal statutory position. This gap sits alongside a separate, in-force penalty structure under the Individual Privacy Act, 2075 (2018), which sets a penalty band of up to three years' imprisonment and a fine of NPR 30,000 for privacy breaches: the statutory sanction exists on paper, but with no functioning enforcement authority behind it, no enforcement track record has been identified this cycle.

Other Developments

Statutory foundation unchanged, operational gap persists. The Individual Privacy Act, 2075 (2018) remains Nepal's principal data-protection and privacy statute as of 2026. A comprehensive, GDPR-aligned Personal Data Protection Bill has reportedly been discussed for years but has not been enacted, leaving the 2018 Act as the operative framework notwithstanding its narrower scope relative to a comprehensive omnibus statute.

Penalty structure without a functioning enforcer. The Individual Privacy Act's own enforcement provisions are already in force: sanctions running up to three years' imprisonment and a fine of NPR 30,000 apply to privacy breaches as a matter of enacted law. The practical significance of this is limited, however, precisely because the designated enforcing authority, the Data Protection Authority under the 2079 Act, has not been confirmed as operational, so the sanction's deterrent value in practice remains untested on the evidence available this cycle.

Cross-Monitor Connections

The pattern identified here, a statutory framework enacted in full but an enforcing authority left non-operational years afterward, is structurally similar to the pattern financial-integrity tracks in Nepal's anti-money-laundering posture, where legislative and ordinance-level output has similarly outpaced enforcement and prosecutorial follow-through. Readers tracking Nepal's regulatory-capacity trajectory across monitors may find this cross-domain pattern, rather than any single-sector development, the more durable signal.

Outlook

The central open question for the next cycle is whether the Data Protection Authority established under the Data Act, 2079 makes any operational appointments or issues any guidance, which would be the first concrete evidence of the enforcement body moving from statute to practice. Absent that, the penalty band under the Individual Privacy Act will remain a paper sanction rather than an enforced one.

Outlook

The enactment status of the IT and Cyber Security Bill 2082 is the development to watch, loosely expected to resolve within the fourth quarter of 2026, though the uncertainty band on that timing is wide. Until it resolves, the institutional and statutory position described above stands unchanged.