Nepal has not joined any agreement with binding commitments to open transfers of data across borders.

Nepal lacks a comprehensive data protection regime. Nevertheless, the Individual Privacy Act 2075 (वैयक्तिक गोपनीयता सम्बन्धी ऐन, २०७५ ) enforces the constitutional right to privacy, incorporating provisions on the collection, storage, and disclosure of data, and mandates individual consent before the collection of personal information. Privacy in Nepal is further governed by the Individual Privacy Regulation 2077 (2020), which regulates the implementation of the Privacy Act, and the Data Act 2079 (2022), which regulates the generation, management, storage, and publication of data, delineating the responsibilities of data controllers, producers, and users.

Rule 8 of the National Broadcasting Regulation stipulates that over-the-top (OTT) service providers must maintain a record of the programmes they transmit for a minimum of 60 days. In addition, these records must be made accessible to the Ministry of Communications and Information Technology and other governmental authorities for investigations. The term "OTT" refers to the broadcasting of content on demand via the internet, encompassing media streaming services delivered through various platforms that utilise internet connectivity.

The Electronic Transactions Act establishes a safe harbour regime for intermediaries for copyright infringements. According to Art. 43, network service providers are not subject to criminal or civil liability arising from third-party content. The only exception is if the network service provider publishes the content, knowing it contravenes the law.

The Electronic Transactions Act establishes a safe harbour regime beyond intermediaries for copyright infringements. According to Art. 43 of the Act, network service providers are not subject to criminal or civil liability arising from third-party content. The only exception is if the network service provider publishes the content knowing it contravenes the law.

It is reported that Nepal imposes an identity requirement for SIM registration. Anyone wanting to purchase a SIM card has to provide their national ID card or a passport in case of foreigners to activate a new prepaid SIM card.

Pursuant to Arts. 6 and 7 of the "Directives on the Operation of Social Networking 2023", operators of social network platforms (SNPs) are required to establish a point of contact within Nepal to handle grievances related to platform usage. This designated contact must identify and address content disseminated on social networks that violates the law. Additionally, under Art. 8, SNPs must develop algorithms and implement measures to prevent the dissemination of information that contradicts prevailing laws. According to Art. 3.7, the Ministry of Communications and Information Technology may ban any SNP from operating in Nepal if it does not comply with these requirements.
Art. 2 of the Directive defines SNPs as Internet or information technology-based operating systems available to the public, such as Facebook, TikTok, Viber, Pinterest, WhatsApp, Messenger, Instagram, YouTube, LinkedIn, WeChat, and others, that allow individuals or organisations to exchange ideas or information with each other or to disseminate user-created content.

It is reported that Nepal blocked Telegram in July 2025 due to government concerns about online fraud. It is further reported that, in September 2025, Nepal directed the blocking of 26 social media platforms, including Facebook, Instagram, WhatsApp, YouTube, X, LinkedIn, Reddit, Signal, and Snapchat, on the grounds that they had not enlisted with the Ministry as required under the Directives for Managing the Use of Social Networks, 2023. Reports indicate that, except for Telegram, these platform restrictions were subsequently lifted within the same year.

The indicator "7.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 3 in Nepal for the year 2025. This corresponds to "Rarely but there have been a few occasions throughout the year when the government shut down domestic access to Internet."

According to Section 3 of the Online Media Operation Directive, online news companies are required to be registered with the Department of Information and Broadcasting to operate.

The National Broadcasting Regulation was amended in 2022 to incorporate over-the-top (OTT) services and internet television within the definition of "other means of communications." With this inclusion, the amended Regulation mandates that OTT and internet television providers obtain licences to operate their services in Nepal. The term "OTT" refers to the broadcasting of content on demand via the internet, encompassing media streaming services delivered through various platforms that utilise internet connectivity. In addition, "internet television" is defined as the regular transmission of self-produced audiovisual programmes via the internet.

It is reported that the Nepal Telecommunications Authority (NTA), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

Pursuant to Art. 27 of the Foreign Investment and Technology Transfer Act, 2019 (FITTA), an enterprise with foreign investment must fill expert positions in top-level management, as well as high-level technical, managerial, and technical roles, with Nepali citizens. Where the enterprise is unable to fill such expert positions domestically and it is necessary to secure the transfer of technical knowledge or skills, it may employ foreign nationals in accordance with the applicable law.

Section 9.4 of the IoT/M2M Regulatory Framework stipulates that personally‑indefinable information (that is, data that cannot be used to identify a specific individual) must be stored exclusively within Nepal. Moreover, at least one copy of all relevant data must be stored within Nepal. However, the provision does not specify what 'relevant data' is. Furthermore, the same provision encourages 'complete data localisation', which is also not clarified.

Nepal operates a prior-approval screening regime for foreign direct investment and certain foreign acquisitions under the Foreign Investment and Technology Transfer Act, 2019 (FITTA). Under Section 15(1), a foreign investor must apply to the competent approving authority before making an investment, and, upon completion of the prescribed documentation, approval must be issued within seven days (Section 15(2)). The Act allocates approval competence by investment size, with the Department of Industry (DOI) responsible for investments up to NPR 6 billion (approx. USD 39.6 million) and the Investment Board Nepal responsible for investments above that threshold (Section 17).
Amendments adopted in March 2025 further introduced a requirement for prior approval before a foreign investor may sell or transfer, in whole or in part, its equity to domestic parties.
In addition, Section 3(3) of the FITTA also prohibits foreign investment below a minimum amount to be set by Government notice. The minimum FDI threshold is reported to have been set at NPR 20 million (approx. USD 132,000) under the FY 2079/80 (2022) budget framework, replacing the previously applied NPR 50 million threshold.
However, it is reported that, for foreign investment below NPR 500 million in designated sectors, an online “automatic route” has operated since 2019 for the submission and approval of projects, and that no minimum threshold applies to IT-sector projects processed through this automatic route.