Annex I, point (p) of the "Payment Aggregators and Payment Gateways Guidelines 2020" stipulates that entities must adopt preventive measures to ensure that data is not stored on infrastructure subject to external jurisdictions. This requirement is mandatory for payment aggregators and recommended for payment gateways. Under Section 3, payment aggregators are defined as entities that enable e-commerce platforms and merchants to accept various payment instruments from customers, thereby facilitating the completion of payment obligations without necessitating merchants to develop their own payment integration systems. On the other hand, payment gateways are entities that provide the technological infrastructure to route and facilitate the processing of online payment transactions, without engaging in the handling of funds.
Section 10 of the "Data Residency Policy for Payment Systems Data 2021" provides that a payment service provider may store its payment data either on‑premises or in the cloud, provided that any transfer of payment data outside the country is subject to the prior written approval of the Authority. The Authority shall prescribe the specific terms and conditions for such approval.

Bhutan has not joined any agreement with binding commitments to open transfers of data across borders.

Bhutan does not currently implement a comprehensive legal framework governing the protection of personal data. Instead, it relies on sector-specific laws. The Information, Communications and Media Act provides a rudimentary basis for data privacy; however, its scope remains markedly limited in addressing broader privacy concerns.

The Information, Communications and Media Act of Bhutan 2018 imposes sector-specific data retention obligations on broadcasting licensees through Section 188, which mandates that licensees retain recordings of every programme broadcast for a minimum of six months and produce them upon request for regulatory scrutiny. This duty applies to broadcasting companies that obtained a valid licence from the Bhutan InfoComm and Media Authority (Section 178). Section 464.8 defines a “broadcasting service” as “an ICT service for providing broadcasting to persons having appropriate equipment, including broadcasting receiving apparatus, for receiving that service regardless of the means of delivery of that service, but does not include: a service (including a teletext service) that provides only data, or text (with or without associated still images); or a service that makes programmes available on demand on a point-to-point basis, including a dial-up service; or a service, or a class of services, that the Authority may determine and notify as not being a broadcasting service.”

Bhutan maintains a copyright framework under the Copyright Act of the Kingdom of Bhutan of 2001. The Act does not adopt an open-ended fair use or fair dealing model; instead, it establishes a closed list of narrowly defined exceptions, which restricts lawful use to specific, enumerated purposes. Several of these exceptions, such as those relating to quotation and reproduction for teaching, are expressly conditioned on compliance with the principle of fair practice, requiring that the use be compatible with fair practice and limited to what is justified by the purpose. Arts. 10-17 set out these exceptions, which include private reproduction for personal purposes; quotation; reproduction for teaching; reprographic reproduction by libraries and archives; reproduction, broadcasting and other communication to the public for informational purposes; reproduction and adaptation of computer programs; importation for personal purposes; and the display of works.

It is reported that the enforcement of intellectual property (IP) rights in Bhutan faces persistent constraints, including limited institutional infrastructure, low legal awareness, and resource limitations. The Department of Media, Creative Industry, and Intellectual Property under the Ministry of Industry, Commerce and Employment (MoICE) is responsible for IP registration and enforcement functions, but public awareness and enforcement capacity are still developing. Copyright infringement is also reported to be widespread. For example, Samuh, an over-the-top (OTT) video streaming platform serving Bhutanese audiences domestically and abroad, has reported extensive unauthorised redistribution of its content via social media platforms such as Telegram, WeChat, Facebook, and TikTok, resulting in substantial economic losses.

Bhutan has not signed the World Intellectual Property Organization (WIPO) Copyright Treaty.

Bhutan is not a signatory of the 1996 World Trade Organization (WTO) Information Technology Agreement (ITA) nor the 2015 expansion (ITA II). In fact, the country is not a member of the WTO.

Bhutan has not signed the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

According to Section 18, of the Procurement Rules and Regulations 2025, a procuring agency may conduct tendering from foreign bidders only under the following circumstances: (i) when certain goods, domestic contractors with the required capacity to undertake specific works, or service providers are not available in the country; or (ii) in donor-funded projects, where the funding agreement requires the procuring agency to approach the international market.

Pursuant to Section 64 of the Procurement Rules and Regulations 2025, bidding documents must expressly provide for a 20% margin of preference for: (i) goods of Bhutanese origin, in accordance with the Domestic Preference Guideline 2020 issued by the Ministry of Finance; or (ii) national bidders, where the procurement involves foreign bidders.
In addition, Section 54 requires goods, equipment, materials, and workmanship to comply with applicable standards. Procuring agencies are encouraged to prioritise nationally recognised standards when defining technical requirements. Where national standards are unavailable, unsuitable, or inadequate, international standards may be used.

Reports highlight persistent challenges within Bhutan’s public procurement system, notably the need for timely invoice payments via the electronic government procurement (e-GP) platform, comprehensive record-keeping, adequate resourcing and staffing, and improved inter-institutional coordination. Despite an established legal and regulatory framework, practical implementation issues persist. In 2024, controversy arose when the government awarded direct contracts for laptops and desktops to the State Trading Corporation of Bhutan Limited (STCBL), prompting objections from private IT firms on grounds of unfairness, non-compliance with the Procurement Rules and Regulations (PRR) 2023, and insufficient stakeholder consultation. The government subsequently annulled the STCBL contract.

Bhutan is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA). In fact, the country is not a member of the WTO.

Pursuant to Section 4 of the Foreign Direct Investment Regulations 2025, foreign direct investment is permitted in all sectors except those enumerated in Schedule III. This schedule encompasses, inter alia, news media and “activities included in the Prohibited List of the Royal Government.” The latter list could not be found online, and therefore, it remains uncertain whether the activities specified in Schedule IV extend to the digital domain.