A critical assessment of Nepal's digital data protection framework: Legal gaps and reform directions

Abstract

Nepal has taken up digital technologies, e-governance systems, and digital financial services at speed, and social, economic, and administrative life has changed with them. Services are faster now, and easier to reach. They have also brought new trouble over personal data, privacy, and digital security. This article looks at the legal and institutional framework governing digital data protection in Nepal and sets out where the regulatory gaps leave individual privacy poorly protected. The article uses a qualitative doctrinal method, supported by Key Informant Interviews (KIIs) with legal practitioners, cyber law experts, academics, and technology policy professionals. It looks at the constitutional guarantee of privacy under the Constitution of Nepal (2015), the Individual Privacy Act (2018), the Electronic Transactions Act (2006), and related policy documents. It also draws lessons from data protection systems abroad, above all the European Union’s General Data Protection Regulation (GDPR). The findings show that Nepal’s framework is scattered across different laws and is too weak for present-day problems such as large-scale data processing, artificial intelligence, cloud computing, and the transfer of data across borders. The main shortcomings are the lack of an independent Data Protection Authority, thin regulatory duties for private sector data controllers, limited enforcement, and weak accountability structures. The article argues that Nepal needs a comprehensive Digital Data Protection Act, along with institutional reform, stronger compliance rules, and enforcement that works. A sound data governance framework matters for protecting citizens’ informational privacy, and it also builds public trust and keeps digital transformation sustainable.