Law note · Nepal
Privacy Act, 2075, enforcement and compensation
What it requires
- An app that violates Nepal's Privacy Act in handling personal information, including a biometric identifier, exposes itself to a District Court criminal complaint (imprisonment up to three years or a fine up to NPR 30,000, or both) and to a direct civil compensation claim a harmed person may bring themselves in the District Court; Nepal has no dedicated Data Protection Authority.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
- Private right of action
- Yes
What we found
No Data Protection Authority or equivalent regulator is established by this Act; enforcement runs through the District Court. An aggrieved person may file a complaint within three months of the offending act, except for a defined subset of more serious offences, including a section 27(1) sensitive-information violation and a section 23 unauthorized-collection violation, where the Government of Nepal itself becomes the plaintiff.
Penalty is a single uniform band across every offence, imprisonment up to three years or a fine up to NPR 30,000, or both. Section 31 gives a genuine, court-mediated private right of action: a person harmed by an offence or other act under the Act may complain directly to the District Court for compensation, and the court shall order reasonable compensation paid by the offender if it finds compensation warranted.