The Consumer Protection Act and the Electronic Transactions Act provide a comprehensive framework for consumer protection that also applies to online transactions. The Law on Electronic Transactions regulates electronic communications and records and establishes legal provisions for authenticating and regulating electronic data. It also establishes a secure, authentic method of electronic communication while addressing regulatory issues related to electronic transactions.

Nepal has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Nepal has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Nepal has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

Under the Directives for Managing the Use of Social Networks, 2023, Nepal operates an authorisation regime based on registration for social network platform operators. Under Art. 3.1, any person, company, or institution intending to operate a social network platform must enlist the platform with the Ministry. The Ministry must issue a public notice for enlistment (Art. 3(2)), and existing platforms must enlist within 3 months of commencement (Art. 3(3)). Operators must apply using the prescribed format and supporting documents (Art. 3(4)–(6)), after which the Ministry issues an enlistment memorandum. Platforms that are not enlisted may be prohibited from operating in Nepal (Art. 3(7)).
In addition, Art. 6 requires the operator to arrange a point of contact in Nepal. Where a platform does not have an office in Nepal, it must establish an office or designate a local contact person.
Art. 2 of the Directive defines SNPs as Internet or information technology-based operating systems available to the public, such as Facebook, TikTok, Viber, Pinterest, WhatsApp, Messenger, Instagram, YouTube, LinkedIn, WeChat, and others, that facilitate the exchange of ideas or information among individuals or organisations and enable the dissemination of user-generated content.

Nepal allows foreign companies to self-certify compliance with radio transmission, electromagnetic interference (EMI), or electromagnetic compatibility (EMC) standards through a Supplier Declaration of Conformity (SDoC).
According to Arts. 13-14 of the Telecommunications Act, 2053, the Nepal Telecommunications Authority (NTA) oversees type approval in Nepal, and compliance with these regulations is mandatory before importing or selling any radio telecommunication Customer Premises Equipment (CPEs) in the country.
Decision No. 3,327 provides further information about the procedure.

Pursuant to Art. 3 of the Electronic Commerce Act, 2081 (2025), any firm, company, or institution that is duly registered and authorised under the prevailing law to trade in goods or services may engage in electronic commerce, subject to compliance with the Act.
Art. 4(1) further requires each business entity conducting electronic commerce to establish an electronic platform. Once the platform is established, Art. 5(1) obliges the business entity to submit an electronic application to be listed on the Department's electronic commerce portal. The application must include, inter alia, the business name and address, the registering authority, the registration certificate number, the VAT registration number or permanent account number, and contact details, including a telephone number, email address, social media link, and contact address.
In addition, Art. 1(3) provides that the Act applies throughout Nepal and also extends to persons residing or staying outside Nepal who supply goods or services within Nepal through electronic commerce.

In March 2021, Nepal’s central bank, the Nepal Rastra Bank (NRB), issued Forex Circular No. 10/2077-78 (dated 2077/12/08), amending the Unified Foreign Exchange Circular–2076 by introducing a new Clause 7 on foreign-currency prepaid cards for online purchases from abroad. This reform enabled licensed Class “A” commercial banks and national-level Class “B” development banks to issue foreign-currency prepaid cards, thereby opening access to international online payments that had previously been infeasible with cards issued by Nepali banks.
Clause 7 authorises the use of these cards for the purchase of goods and services online from overseas, but imposes an annual cap of USD 500 (or the equivalent in convertible currency). In practice, this cap limits the value of cross-border e-commerce transactions that individuals can conduct each year using such cards. This rule was subsequently incorporated into the Nepal Rastra Bank’s consolidated foreign-exchange unified circular framework, including Unified Circular-2079 (2022), which tightened the use of these USD 500 prepaid cards by restricting payments for specified merchant category codes, and later the Revised Unified Circular-2023.

Under Directive No. 5/2081 of the Unified Directives Related to Payment Systems 2081, specific transaction limits apply to electronic transactions, including those conducted via mobile banking, internet banking, and e-wallets.
Pursuant to Sections 2–3 of the Directive on transactions conducted through mobile banking and web applications, daily transaction limits apply depending on the channel and instrument used. Transactions carried out through a mobile application, including QR-code payments, are capped at NPR 300,000 (approx. USD 2,000) per day, while transactions conducted through a web application are capped at NPR 2,000,000 (approx. USD 13,000) per day. For electronic wallets, transfers from a bank account to a wallet are limited to NPR 200,000 (approx. USD 1,300) per day and NPR 1,000,000 (approx. USD 6,600) per month. Transfers from a wallet to a bank account, including QR-code payments, are subject to the same daily and monthly caps. Wallet-to-wallet transfers are subject to lower limits of NPR 50,000 (approx. USD 330) per day and NPR 500,000 (approx. USD 3,300) per month, regardless of whether funding is derived from multiple bank accounts or wallets. In addition, a natural person’s wallet may be loaded no more than 10 times per day, and an electronic wallet may not hold an overnight balance exceeding NPR 50,000 (approx. USD 330), with any excess required to be transferred to the customer’s linked bank account.
The Nepal Rastra Bank, serving as Nepal's Central Bank, has established these ceilings on maximum daily and monthly electronic transaction amounts through various directives, starting with one issued in 2018.

Nepal does not implement any de minimis threshold, which is the minimum value of goods below which customs do not charge duties.

Pursuant to Art. 3 of the Data Center and Cloud Service (Operation and Management) Directives, data centre operators and cloud service providers must be listed with the Department of Information Technology before providing services. Any organisation intending to operate a data centre or provide cloud services must submit an application in the format prescribed by the Department. Existing data centre operators at the time the Directive enters into force must apply for mandatory registration in accordance with subsection (2), and existing cloud service providers must apply in accordance with subsection (3), in both cases within six months of commencement and accompanied by the documents specified in the relevant subsection.

Pursuant to Rule 7A of the National Broadcasting Regulation, licensed over-the-top (OTT) operators offering services to customers or generating revenue within Nepal are obligated to establish a cache server in Nepal. These operators are required to register customers on a server located in Nepal before granting access to their content and must retain detailed customer information. Additionally, all transaction records must be securely stored on a Customer Management System Server. However, the regulation does not clearly define the term "Customer Management System Server" or specify whether such a server must be physically situated within Nepal and directly managed by the OTT service providers. The regulation defines OTT as the broadcasting of content on demand via the internet, encompassing media streaming services delivered through various platforms utilising internet connectivity

Section 3.7 of the "Data Center and Cloud Service (Operation and Management) Directives, 2081 (2025)" provides that, in the context of government data centres and cloud service provision, the security agencies of the government of Nepal are mandatorily required to use data centre and cloud services operated by the Integrated Data Management Center. According to its official website, the Integrated Data Management Centre operates under the Department of Information Technology and serves as the government of Nepal's implementing agency. Furthermore, Section 3.9 stipulates that, upon the commencement of the Directives, government bodies operating data centres and cloud services on a departmental or agency basis shall transfer such facilities to the government data centre within the timeframe specified by the steering committee; however, where a government body submits a request, supported by sufficient justification, to operate a primary or secondary site, the steering committee may grant consent for the operation of such a site based on its suitability.

Section 12.4 of the Privacy Act requires the consent of the data subject for the disclosing, making public, or transferring of the following data: details relating to a medical examination; details relating to property and income; further information relating to employment; details relating to family matters; biometric data and fingerprints; signatures or electronic signatures; further information concerning the political affiliation and voting; and further information about profession and business. The term 'transfer' may signify the transfer of personal data outside Nepal, thereby requiring specific consent from the individual. However, there is no clear evidence about the applicability of this requirement to cross-border data transfers.

Nepal has not joined any agreement with binding commitments to open transfers of data across borders.