Information and Communications Technology (ICT) Law

Information Technology, Data Infrastructure & Artificial Intelligence (AI) Law in Nepal

In today’s hyper-connected economy, digital infrastructure, cloud computing, and Artificial Intelligence (AI) are fundamentally reshaping how businesses operate. From training Large Language Models (LLMs) to deploying enterprise cloud solutions and navigating strict cross-border privacy regimes, technological innovation requires proactive legal compliance.

At Vidhijnya Lawyers, we operate at the intersection of technology, commerce, and regulation. We advise technology startups, data center operators, multinational tech companies, and traditional enterprises on managing legal risk, protecting digital assets, and staying compliant with domestic and international tech laws.

1. The Core Framework of ICT Law in Nepal

Operating a digital or technology-enabled business in Nepal requires adherence to several interconnected statutes and regulatory directives:

Electronic Transactions Act (ETA), 2063 (2006)

The ETA serves as the foundational cyber statute in Nepal:

• Legal Recognition: Accords legal validity to electronic records, data messages, and digital signatures.

• E-Contracts: Enforces digital agreements, terms of service, and click-wrap licenses provided standard contract formation criteria are satisfied.

• Cybercrime Sanctions: Imposes civil liability and criminal penalties (up to 5 years imprisonment) for unauthorized access, hacking, data theft, and digital alteration.

Data Privacy & Governance Frameworks

• The Individual Privacy Act, 2075 (2018): Enforces constitutional privacy rights by restricting how personal data is collected, stored, processed, and transferred. Explicit consent, purpose limitation, and data security are mandatory.

• The Data Act, 2079 (2022): Sets institutional benchmarks for data governance, integrity, and cross-entity sharing across public and private systems.

The Draft Information Technology & Cyber Security Bill, 2080

Once enacted, this legislation will overhaul Nepal’s cyber regime by:

• Mandating formal licensing for Information Technology (IT) service providers, cloud platforms, and data centers through the Department of Information Technology (DOIT).

• Introducing statutory cybersecurity standards, breach notification rules, and penalties of up to NPR 10,00,000 for complex cyber offenses like ransomware, phishing, and automated fraud.

2. Data Centers and Cloud Infrastructure Regulation

As Nepal modernizes its digital infrastructure, cloud providers and data center operators must navigate strict operational and physical compliance mandates:

• Data Centre and Cloud Services Directive, 2081 (2025): Enacted under the ETA framework, this directive mandates that all commercial Data Centers and Cloud Service Providers (CSPs) register with the Department of Information Technology (DOIT) prior to commencing operations.

• Tier 3 Mandate for Critical Data: Facilities hosting government or critical institutional data must maintain at least a Tier 3 certification.

• Audit & Physical Security Standards: Operators must conduct mandatory annual third-party security audits, retain uninterrupted Closed-Circuit Television (CCTV) records for a minimum of three months, and follow certified electronic media sanitization and degaussing procedures for hardware disposal.

3. Artificial Intelligence (AI) & LLM Regulatory Landscape

While Nepal has not yet passed a dedicated Artificial Intelligence statute, AI platforms and machine learning operations are governed by targeted policies, privacy laws, and judicial directives:

National Artificial Intelligence Policy, 2025

Approved by the Government of Nepal in August 2025, this policy lays the groundwork for national AI governance:

• Ethical, Human-Centered AI: Establishes core requirements for non-discrimination, transparency, algorithmic explainability, and human oversight.

• Regulatory Institutions: Proposes an AI Regulation Council chaired by the ICT Ministry to set technical standards, alongside a National AI Centre for research and monitoring.

• Sandboxes & Nepali Language AI: Encourages controlled regulatory sandboxes to test high-risk AI applications and prioritizes the development of localized AI models optimized for the Nepali language.

Legal Risks in Training Large Language Models (LLMs)

Developing, fine-tuning, or fine-tuning foundation models in Nepal involves significant legal considerations:

• Data Scraping & Privacy Liability: Training LLMs on datasets containing personally identifiable information (PII) without verified consent triggers liabilities under the Individual Privacy Act, 2075.

• Copyright & Source Code Infringement: Ingesting proprietary text, creative assets, or proprietary codebases without express commercial licenses raises copyright infringement claims under Nepal's Copyright Act, 2059.

• Output Liability & Defamation: Companies deploying generative conversational agents remain exposed to tort and cyber law claims if models hallucinate defamatory statements or leak trade secrets.

The Supreme Court's Judiciary ICT Policy, 2083 (2026)

In July 2026, the Supreme Court of Nepal established an institutional framework for technology within the justice system:

• Permitted Legal Tech Uses: Courts may utilize AI for case scheduling, translation, non-decisional drafting, legal research, and organizing digital dockets into machine-readable formats.

• Strict Prohibition on AI Judgments: AI is explicitly barred from drafting judgments, preparing writ decisions, or replacing human judicial discretion.

• E-Judiciary Integration: Establishes a unified "e-justice portal" for online filing, virtual court appearances, and dedicated online dispute resolution for commercial and small claims.

4. Strategic Compliance Action Plan for Tech Enterprises

To manage regulatory exposure across ICT, cloud, and AI operations, enterprises should implement four core compliance steps:

1. Conduct Data & Model Audits: Trace the provenance of all training datasets, web-scraped corpora, and customer inputs to eliminate unlicensed IP and unconsented personal data.

2. Standardize Infrastructure Compliance: Ensure data hosting facilities meet DOIT registration requirements, Tier certification thresholds, and physical access security standards.

3. Deploy Enterprise AI & Acceptable Use Policies: Issue binding internal rules governing how employees, developers, and contractors utilize public and enterprise LLMs to protect confidential corporate assets.

4. Structure Robust Tech Contracts: Update software licenses, SaaS terms, vendor Service Level Agreements (SLAs), and cross-border data transfer agreements with clear allocation of IP ownership and liability.

5. Regional & Global Comparative Frameworks

AI and digital commerce operate across borders. Businesses must align local operations with global compliance benchmarks: