Under Section 3.1 of the "Rules and Regulations on the ICT Type Approval", all ICT equipment intended for use in Bhutan must either obtain type approval from the Bhutan InfoComm and Media Authority (BICMA) or fall within the exemptions listed in Annexure C. To secure type approval, applicants must submit a valid business licence, a manufacturer-issued declaration of conformity for the radio and telecommunications terminal equipment (RTTE), and a test report from an internationally accredited laboratory recognised by the Authority. The report must demonstrate compliance with radio frequency usage, health and safety, and electromagnetic compatibility. International applicants are additionally required to provide proof of payment. Exempted equipment includes mobile and telephone handsets, data modems, RTTE embedded in personal computers, short-range wireless devices, amateur radios, broadcast receivers, vehicle components, infrared remote controls, and military equipment. Section 2.3 authorises the acceptance of test reports and data from laboratories accredited by bodies that are signatories to the International Laboratory Accreditation Cooperation (ILAC) Mutual Recognition Agreement. The Authority may also recognise compliance certificates and declarations issued under bilateral or multilateral MRAs concluded by the Authority or the government with other states or organisations. Annexure D lists recognised international standardisation bodies.

Section 5 of the Foreign Direct Investment Regulations 2025 distinguishes between: (1) “Priority Sector Activities” in the manufacturing and service sectors listed in Schedules I and II; and (2) “Other Activities” not listed in those Schedules. As the e-commerce sector is not explicitly included in the schedules, it falls under the “Other Activities” category, for which the maximum foreign investor shareholding is capped at 74% equity (section 7).

Sections 140–145 of the Trade and Industry Rules 2023 establish Bhutan’s e-commerce licensing framework. Section 140 provides that any organisation, agency, company, or Bhutanese person aged 18 or above may obtain a licence to operate an e-commerce business. Section 141 additionally requires prior approval from the Department of Trade to operate a national e-commerce portal or platform. Under Sections 142–143, e-commerce operators, including platform operators and sellers operating through platforms, must apply for and renew an e-commerce licence using the prescribed form, and existing licence holders must add e-commerce as an activity at renewal. Section 145 further imposes platform-specific obligations, including tax compliance, notifying the competent authorities when restricted or prohibited goods are identified, and publishing service agreements and trading rules on the platform’s website.

Pursuant to Art. 463 of Bhutan’s Customs Rules and Regulations 2023, the Department of Revenue and Customs must exempt customs duty on goods imported as gifts through foreign postal parcels up to an invoice value of Nu. 10,000 (approx. USD 110), provided that: (i) the parcel does not contain alcohol, alcoholic beverages, or any prohibited or restricted goods; and (ii) the parcel contains only goods for personal use and the quantity imported is not commercial in nature. Art. 486 further provides that the rules applicable to postal parcels and courier services apply mutatis mutandis to goods purchased through e-commerce, with the duty-free allowance likewise capped at Nu. 10,000 (approx. USD 110).
This threshold is below the USD 200 de minimis level recommended by the International Chamber of Commerce (ICC).

It is reported that domain registration in Bhutan requires a valid trade licence for individuals applying for domain names on behalf of their company. International companies may register a ".bt" domain in their company’s name by providing documentary proof of eligibility, such as a registered trade licence. These requirements are published on the official website of the Bhutan Network Information Centre, the agency designated under Sections 352 and 355 of the Information, Communications and Media Act of Bhutan to register domain names, act as registrar, and administer and manage the country code ".bt".

The Consumer Protection Act of Bhutan, together with the Consumer Protection Rules and Regulations and the Guidelines on E-commerce, establishes a comprehensive legal framework for safeguarding consumer rights, including transactions conducted through online platforms.

According to Section 2.1 of the Rules and Regulations for Publication, no person may publish books, newspapers, and periodicals, whether in physical form or as electronic publications, without holding a valid licence issued by the Bhutan InfoComm and Media Authority (BICMA). Section 2.4 sets out the eligibility criteria for applicants. A licence may be granted only to a person who:
(i) is a citizen of Bhutan;
(ii) is of sound mind;
(iii) is not a political party;
(iv) has not been declared insolvent or convicted of a criminal offence under Bhutanese law, unless their reputation has been restored through due process; and
(v) holds less than 5% of shares in any other media licence issued by the Authority.

According to Section 1 of the Rules and Procedures for Imports from Third Countries, imports from third countries require import licenses issued by the Department of Revenue and Customs.

According to Art. 27 of the Customs Act of Bhutan, the government may impose restrictions or prohibitions on the import of goods. Section 6.1.3 of the Bhutan Customs Manual 2024 further clarifies that the import of restricted goods requires a permit or licence issued by the competent authority. Section 6.2 provides a list of such restricted goods, including wireless and remote-sensing telecommunication and broadcasting equipment.

Annex I, point (p) of the "Payment Aggregators and Payment Gateways Guidelines 2020" stipulates that entities must adopt preventive measures to ensure that data is not stored on infrastructure subject to external jurisdictions. This requirement is mandatory for payment aggregators and recommended for payment gateways. Under Section 3, payment aggregators are defined as entities that enable e-commerce platforms and merchants to accept various payment instruments from customers, thereby facilitating the completion of payment obligations without necessitating merchants to develop their own payment integration systems. On the other hand, payment gateways are entities that provide the technological infrastructure to route and facilitate the processing of online payment transactions, without engaging in the handling of funds.
Section 10 of the "Data Residency Policy for Payment Systems Data 2021" provides that a payment service provider may store its payment data either on‑premises or in the cloud, provided that any transfer of payment data outside the country is subject to the prior written approval of the Authority. The Authority shall prescribe the specific terms and conditions for such approval.

Bhutan has not joined any agreement with binding commitments to open transfers of data across borders.

Bhutan does not currently implement a comprehensive legal framework governing the protection of personal data. Instead, it relies on sector-specific laws. The Information, Communications and Media Act provides a rudimentary basis for data privacy; however, its scope remains markedly limited in addressing broader privacy concerns.

The Information, Communications and Media Act of Bhutan 2018 imposes sector-specific data retention obligations on broadcasting licensees through Section 188, which mandates that licensees retain recordings of every programme broadcast for a minimum of six months and produce them upon request for regulatory scrutiny. This duty applies to broadcasting companies that obtained a valid licence from the Bhutan InfoComm and Media Authority (Section 178). Section 464.8 defines a “broadcasting service” as “an ICT service for providing broadcasting to persons having appropriate equipment, including broadcasting receiving apparatus, for receiving that service regardless of the means of delivery of that service, but does not include: a service (including a teletext service) that provides only data, or text (with or without associated still images); or a service that makes programmes available on demand on a point-to-point basis, including a dial-up service; or a service, or a class of services, that the Authority may determine and notify as not being a broadcasting service.”

Pursuant to Section 363 of the Information, Communications and Media Act, an internet service provider (ISP) shall not incur liability for merely storing content generated by third parties and made publicly accessible, provided that: (i) the ISP has no actual knowledge of any illegality associated with such content; (ii) it is not aware of facts or circumstances from which such illegality may reasonably be inferred; (iii) upon acquiring such knowledge or awareness, it acts expeditiously to remove or disable access to the content; or (iv) it lacks the technical capacity or cannot reasonably be expected, in the circumstances, to prevent public access. Section 364 further states that an ISP shall not be held liable for third-party content that is merely transmitted or routed through its systems to facilitate public access, provided it does not initiate the transmission, select the recipient, or alter the information transmitted. In addition, Section 368 permits any party who believes that material is being used without the authorisation of the copyright owner or their agent to notify the ISP of the alleged infringement.
Section 464.63 defines an ISP as any natural or legal person, or association thereof, that provides individuals and businesses with internet access and may also offer other internet-based services.

Pursuant to Section 363 of the Information, Communications and Media Act, an internet service provider (ISP) shall not incur liability for merely storing content generated by third parties and made publicly accessible, provided that: (i) the ISP has no actual knowledge of any illegality associated with such content; (ii) it is not aware of facts or circumstances from which such illegality may reasonably be inferred; (iii) upon acquiring such knowledge or awareness, it acts expeditiously to remove or disable access to the content; or (iv) it lacks the technical capacity or cannot reasonably be expected, in the circumstances, to prevent public access. Section 364 further states that an ISP shall not be held liable for third-party content that is merely transmitted or routed through its systems to facilitate public access, provided it does not initiate the transmission, select the recipient, or alter the information transmitted.
Section 464.63 defines an ISP as any natural or legal person, or association thereof, that provides individuals and businesses with internet access and may also offer other internet-based services.