Yes, Nepal’s Privacy Act 2075 applies to ordinary businesses, not only to government offices. If you collect a guest’s passport, a patient’s test report or a customer’s phone number, the Act says you need that person’s consent, you should use the data only for the purpose you collected it for, and you should not pass certain details to anyone else without their consent.
We run businesses ourselves, so we know how this looks in real life: passport photos in a WhatsApp group, a register at the front desk, a spreadsheet nobody has checked in two years. This guide explains what the law actually says, in plain words, and what a hotel, clinic, school, shop or office in Nepal can do this month to handle customer data more safely.
All the legal points below come from the English text of the Privacy Act, 2075 (2018) published by the Nepal Law Commission (lawcommission.gov.np). The Act was authenticated on 2075.6.2 BS (18 September 2018), and there is also an Individual Privacy Regulation 2077. This is a practical guide, not legal advice. For your specific situation, check the current rules with a lawyer.
Does the Privacy Act apply to my private business?
Yes. Several key sections speak about any “person” or any “body corporate”, and the Act defines a body corporate as an organization, company, bank, committee, cooperative or similar body established under law. That covers most registered businesses in Nepal, from a Pokhara guesthouse to a Kathmandu software firm.
What counts as “personal information”?
More than most owners expect. Section 2 of the Act lists, among other things:
- caste, ethnicity, religion and marital status
- education and qualifications
- address, telephone number and email address
- passport, citizenship certificate, national identity card, driving licence and voter ID details
- fingerprints, thumb impressions, blood group and other biometric information
- criminal record details
So the guest register, the patient file, the student admission form and your customer WhatsApp list all hold personal information.
What does the law ask a business to do?
The core rules are short. In Section 12, the Act says:
- Ask for consent. When you collect personal or family data about someone, you must obtain their consent.
- Use it only for that purpose. Data a body corporate collects with consent must be used only for the purpose it was collected for. A guest’s passport copy taken for check-in is not a marketing list.
- Do not share sensitive details without consent. You must not give to anyone else, or publish, these details about a person without their consent: health examination details, property and income details, employment details, family matters, biometric details and thumb impressions, signatures or electronic signatures, political affiliation, and business or transaction details.
Section 26 repeats this from another angle: personal information held by a body corporate must not be used or given to anyone without the person’s consent, except in specific cases, for example when an authorised investigating official demands it in writing or a court orders it.
What about CCTV in my hotel, shop or restaurant?
CCTV is allowed in public areas, with limits. Section 20 says cameras at a public place may be installed anywhere except a toilet, bathroom or changing room, and that a notice must be placed so everyone can see the area is under camera.
For hotels this matters even more. The Act’s definition of “residence” includes a hotel, resort, lodge, guesthouse or camp room where someone stays the night, and Section 9 says no one may install CCTV in a person’s residence without their consent. In practice, keep cameras in lobbies, corridors, entrances and cash counters, never in guest rooms, bathrooms or changing areas.
What can happen if we get it wrong?
The penalties are real. Under Section 29, breaking certain provisions, including sharing the protected details listed above without consent, using personal information without consent against Section 26, or installing CCTV in a residence against Section 9, can lead to imprisonment of up to three years, a fine of up to thirty thousand rupees, or both. Section 30 lets an affected person complain to the District Court, and the complaint has to be made within three months of the act. Under Section 31 the court can also order the offender to pay reasonable compensation to the victim.
Beyond the law, a leak of guest passports or patient reports damages trust in a way that is hard to repair, especially in a small town where people talk.
A practical checklist for this month
Most of the risk is in everyday habits, not in big systems. Work through these steps:
- List what you collect. Write down every place you collect personal data: booking forms, the front-desk register, admission forms, patient files, delivery addresses, loyalty lists. Note where each one is stored.
- Collect less. If you do not need a full citizenship copy, do not take one. Less data means less to protect.
- Say why, in writing. Add one short, clear line to your forms and booking pages: what you collect, why, and who to contact. A simple privacy page on your website helps here.
- Get consent for marketing separately. Ask with its own tick box or question before adding someone to promotional SMS, Viber or WhatsApp lists.
- Stop sharing ID photos in chat groups. Move passport and ID copies out of personal phones and staff WhatsApp groups into one protected place with limited access.
- Limit who can see what. Reception does not need medical notes; a part-time helper does not need the full customer export. Give each person their own login, not one shared password.
- Turn on two-step login. Protect the email, cloud drive and software accounts that hold customer data. Our guide on protecting business Facebook and WhatsApp accounts walks through this.
- Back up and delete on a schedule. Keep backups of the records you need, and remove old files you no longer need, after checking with your accountant how long tax and billing records must be kept.
- Check your CCTV signs and placement. Make sure every camera area has a visible notice and no camera points into a room, bathroom or changing area.
- Write a short plan for a leak. Decide who checks what happened, who changes passwords, and who talks to affected customers.
If you sell online, the Electronic Commerce Act 2081 adds its own duties on top of this. See our e-commerce compliance guide.
How can software help instead of adding risk?
Good software makes the safe way the easy way. A booking system, clinic system or school system can store ID documents in one encrypted place, show each staff member only what their role needs, keep a record of who opened which file, and remove old records on a schedule. Our web application work is built around these habits, and our cloud operations service covers access control, backups and monitoring for the systems you already use.
FAQ
Do I need a customer’s consent just to save their phone number? The Act says consent must be obtained when collecting personal data, and a phone number is personal information. In practice, when a customer gives you their number for a booking, make the purpose clear and do not reuse it for something else without asking.
Can I share a guest’s passport copy with a trekking partner or airline? Only if it is needed for the service the guest asked for and they have agreed. Tell the guest who will receive it and why, and send it through a protected channel, not a public group.
Is there a separate data protection authority to register with? We could not confirm any registration requirement in the Act itself. Laws in this area can change, so check the current rules with a lawyer.
Can I put CCTV at my shop entrance? Yes, the Act allows cameras in public places except toilets, bathrooms and changing rooms, as long as a visible notice tells people the area is under camera.
Want a second pair of eyes on your customer data?
We can look at how your forms, files, software and accounts handle personal information, and show you practical steps that fit how your business actually runs. Contact us and tell us what kind of business you run.