As of 17 October 2026 (31 Asoj 2083). Based on the Act’s Nepali text, वैयक्तिक गोपनीयता सम्बन्धी ऐन, २०७५, and the Nepal Law Commission’s English translation. Where the two differ, the Nepali text prevails. This is general information, not legal advice.
The Privacy Act 2075 is Nepal’s main law on personal privacy. Its official Nepali name is the Individual Privacy Act, 2075 (वैयक्तिक गोपनीयता सम्बन्धी ऐन, २०७५). It was authenticated on 2 Asoj 2075 (18 September 2018) as Act No. 14 of 2075, the same day as the Consumer Protection Act, and it puts into practice the right to privacy in Article 28 of the Constitution.
In one sentence: your body, home, property, documents, data, letters and messages, and your character are private, and nobody may expose them without your consent or a legal order. Breaking that rule can mean up to three years in prison, a fine of up to Rs 30,000, or both, plus compensation to you.
This guide explains the Act section by section, with charts for the parts people find confusing: what counts as personal information, when consent is needed, the CCTV and drone rules, and which complaints go to the police and which you file yourself.
The Privacy Act 2075 at a glance
| Question | Answer |
|---|---|
| Name of the law | Individual Privacy Act, 2075, Act No. 14 of 2075 |
| In force since | 2 Asoj 2075 (18 September 2018), immediately |
| What it protects | Body, family, residence, property, documents, data, correspondence, character, and all of these in electronic form |
| Core rule | No disclosure without consent, except where the law or an authorised official allows it |
| Penalty | Up to 3 years’ imprisonment, up to Rs 30,000 fine, or both |
| Who prosecutes | The government, for seven listed offences. The victim complains for the rest |
| Deadline to complain | Within 3 months of the act |
| Compensation | Claimed in the District Court |
| Rules | The Individual Privacy Regulation, 2077, made under section 36 |
The nine areas of privacy the Act protects
The Act is arranged by what it protects. Each area has its own chapter.
Body and personal life
Sections 3, 5, 6
Health, sexuality, biometrics, pregnancy. No body search without consent.
Family
Section 4
Family life and confidences between husband and wife.
Residence
Sections 7 to 9
Home, rented room, even a hotel room. No entry or search without legal order. No CCTV without consent.
Property
Section 10
Property and its details, including bank records.
Documents
Section 11
Citizenship, passport, certificates, bank statements, lalpurja, bluebook.
Data
Section 12
Consent to collect. Use only for the stated purpose.
Correspondence
Sections 13, 14
Letters, emails, messages. No reading, opening or forwarding.
Character
Sections 15 to 18
Reputation, conduct. No defamatory or morphed photos.
Electronic means
Sections 19 to 22
Everything above, online. No call recording, spying or drone snooping.
Chart: the nine areas of privacy in the Individual Privacy Act, 2075, by chapter.
Body and personal life (sections 3 to 6)
Your physical and mental condition is private. Without your consent, nobody may touch on the privacy of your body, except for a health check, treatment or emergency relief.
Section 3 lists especially private matters: biometric identity, gender identity, sexuality, sexual relations, conception or abortion, virginity, potency or impotency, and physical illness. Publishing any of these to hurt or insult someone, in writing, speech, print or online, is an offence.
Three more rules sit here:
- Body search needs consent (section 5), except a security check or a criminal investigation under the law. A security officer must carry the authority for the check and show it if asked. A uniformed officer on duty at a public place is treated as authorised.
- Reproductive health and pregnancy are private (section 6). A woman’s information may not be shared without her consent. Doctors may discuss it during treatment, and information may go to the family or guardian of someone under 18 or of unsound mind.
- Marital confidences (section 4) are protected, except where needed in a case between the husband and wife.
Residence (sections 7 to 9)
The Act’s definition of residence is wide. It covers a house, rented room, apartment or any place you live, and also a hotel, resort, lodge, guesthouse or camp room where you spend a night.
- Nobody may enter or search your residence except an authorised official, or someone acting on that official’s order, under the law.
- Being arrested outside your home does not by itself allow your home to be searched. A separate order is needed.
- In a criminal case, a written notice stating the purpose must be given before entry, unless the accused may flee or evidence may be destroyed. Then the reason must be recorded.
- Entry is allowed for disaster management or emergency rescue.
- No CCTV camera may be installed at anyone’s residence without their consent (section 9).
Property (section 10)
You have the right to keep your property and its details confidential. Nobody may enter your house, land or vehicle without permission. A public body, company or bank that holds your property details may not share or publish them without your consent, except when demanded in an investigation or by a court.
Documents (section 11)
The Act lists what counts as a personal document:
| Personal documents under section 11 |
|---|
| Educational certificates |
| Medical history, certificates and health reports |
| Citizenship certificate, passport, voter ID, driving licence and other identity documents |
| Bank accounts and their balances |
| Cheques, drafts, debit and credit cards, bank statements |
| Biometric data and thumbprints |
| Land ownership certificate (lalpurja) and other land documents |
| Vehicle bluebook and other property ownership documents |
| Securities and their details |
| Employee Provident Fund identity card, pension card and similar documents |
Nobody may publish your personal document held by a public body. The exceptions are your consent, use of an ID card to get a public service, and an order from a court or an authorised official in a case or a criminal investigation.
Data (section 12)
This is the section most relevant to apps, banks, schools and offices.
- Your consent is needed to collect your personal or family data.
- Data collected with consent may be used only for the purpose it was collected for. National security and public order requests under the law are an exception.
- Without your consent, nobody may share or publish data on your health checks, property and income, employment, family matters, biometrics and thumbprints, signature or e-signature, political affiliation and voting, or business transactions.
- Data must be given to a court or an authorised investigating official in a criminal case. If a question arises about your age, qualification, character, sexuality or disability, you must give the details an authorised official asks for.
Correspondence (sections 13 and 14)
Your letters, emails and conversations sent electronically are private. Nobody may, without authorisation, read, see, pass on, publish or broadcast them. Nobody may open your personal letters, and nobody may open, see or forward another person’s email. The exceptions are your consent and an investigating official’s order in a criminal case.
Character (sections 15 to 18)
You have the right to privacy of your character, conduct and behaviour. Nobody may comment on your character except in an inquiry under the law, or act to defame you, insult you or damage your self-esteem or family life.
Section 16 deals with photographs. It is an offence to take someone’s photo without consent in order to damage their character or reputation, to combine or morph pictures to defame someone, or to publish, sell or use a non-consensual photo to annoy, distress or profit from it. Appearing in the background of a photo taken in a public place is not an offence, but that photo may not be used to defame.
Two duties apply to officials and professionals:
- A person under investigation may not be paraded in public until a charge sheet is filed, although the name and the charge may be published (section 17).
- A professional who learns something about a person’s conduct in the course of duty must keep it confidential, unless the person consents or an official orders otherwise (section 18).
Electronic means (sections 19 to 22)
Every protection above also applies when the information sits in a phone, computer or online account.
- Nobody may obtain your electronic information or correspondence without authorisation.
- Nobody may listen to or record a conversation between two or more people through electronic means without consent or a legal order. Public speeches are exempt.
- No electronic means, photography or method may be used for surveillance or espionage of a home or an office.
- CCTV in public places is allowed, but never in a toilet, bathroom or changing room, and a visible notice must say the camera is there.
- Drones may not be used to obtain secret information about public bodies, archaeological sites, security buildings, protected or mining areas, or anyone’s residence without permission, except in border areas or public places.
When can your information be shared?
Almost every section follows the same pattern: a rule, then a short list of exceptions. This chart shows the questions to ask, in order.
Can my information be shared? Ask in this order
Did the person consent?
If yes: Sharing is allowed, within what they agreed to.
Did the person make it public themselves?
If yes: For body and personal life matters, already-public information may be disclosed.
Is there a court order, or a written order of an authorised official in a criminal investigation?
If yes: It must be provided to that court or official.
Is it needed to get a public service, facility or concession the person is seeking?
If yes: Only the details needed for that purpose.
Is it a medical emergency, treatment or public health task by a licensed doctor?
If yes: Health information may be used for that, without insulting the person.
If every answer is no: do not share. Sharing may be an offence under section 29, up to 3 years or Rs 30,000.
Our summary of the exceptions that recur in sections 3, 10, 11, 12, 13, 26 and 27. Each section has its own exact list.
Consent for a child under 18, or a person of unsound mind or with an intellectual disability, must come from the guardian or curator, and only where disclosure benefits that person (section 33).
Rules for collecting personal information
Chapter 10 governs anyone who collects, stores or processes personal information.
| Rule | Section |
|---|---|
| Only an official authorised by law, or someone that official permits, may collect, store, analyse, process or publish personal information | 23(1) |
| For study, research or opinion polls, information may be collected with consent, after fully explaining the purpose | 23(2) and (3) |
| The collector must state the time, content, nature and purpose of collection, how it will be checked, and how privacy and protection will be ensured | 23(4) |
| Public bodies must protect collected information against unauthorised access, use, change, disclosure or transmission | 25 |
| Public bodies and companies may not use or give out personal information without consent, outside the listed exceptions | 26 |
| Public bodies may not process sensitive information | 27 |
| You can apply to a public body to correct wrong information about you | 28 |
Section 27 defines sensitive information as caste, ethnicity or origin, political affiliation, religious belief, physical or mental health, sexual orientation or sexual life, and property details. Licensed doctors and health workers under them may process health information for treatment and public health, without insulting the person.
Under section 28, a correction request needs the reason the record is wrong and evidence for the correct fact. A request cannot be made if you have already taken a benefit on the basis of that information.
What public figures cannot keep private
Section 24 says some details of a person holding a public post are not personal information: which body they serve, their post, official address, phone and email, their name and post on official letters, their job description and their service conditions.
Section 34 goes further for public officials, candidates, retired officials, public figures and people whose acts are of public concern. The Act does not stop:
- information gathered in court proceedings or criminal investigations;
- publishing their property details where the law requires it;
- publishing identity details such as qualifications, citizenship, passport and licence by the body concerned;
- investigative journalism in the public interest, within press law and the basic norms of privacy;
- publishing their public statements and recordings of public events;
- fair comment with a basis, reason or evidence.
Offences, punishment and how to complain
Section 29 lists twenty offences, one for nearly every rule above. All carry the same punishment: up to three years’ imprisonment, a fine of up to Rs 30,000, or both. What differs is who takes the case forward.
Route A: Government case
- Body search without consent
- Defamatory or non-consensual photos
- Surveillance or espionage
- Drone misuse
- Unlawful collection of personal information
- Using information without consent
- Processing sensitive information
Report to the police. The government is plaintiff.
Route B: Your own complaint
- Private health or sexual matters published
- Unlawful entry or search of a home
- CCTV in a home without consent
- Personal documents or protected data shared
- Emails opened or forwarded, calls recorded
- Attacks on character, breach of professional confidence
File at the District Court within 3 months.
Chart: the two routes under sections 29 to 31. Examples are shortened; see the table below for the full list.
| Route | Offences | What you do |
|---|---|---|
| Government case | Searching a body without consent; defamatory or non-consensual photos; surveillance or espionage; misuse of drones; unlawful collection of personal information; using information without consent; processing sensitive information | Report to the police. These offences are treated as Schedule 1 offences of the National Criminal Procedure Code, 2074, with the government as plaintiff |
| Your own complaint | Everything else, such as publishing private health or sexual matters, unlawful entry of a residence, CCTV in a home, sharing property details, publishing personal documents, sharing protected data, reading or forwarding emails, attacks on character, a professional’s breach of confidence, recording calls | File a complaint at the District Court within three months of the act |
On top of the punishment, section 31 lets the victim claim compensation from the offender in the District Court for any damage, loss or pain. Public officials who break the Act also face departmental action under their service rules (section 32).
For online harassment, hacked accounts and leaked photos, Nepal Police’s Cyber Bureau is the usual first stop. Our guide to filing a Cyber Bureau complaint explains the forms and evidence.
Common situations and what the Act says
These are our readings of how the sections apply to everyday cases. Facts matter, so treat this as a starting point and take legal advice for a real dispute.
| Situation | Relevant section | Route |
|---|---|---|
| Someone posts a morphed or private photo of you to shame you | 16 | Government case |
| A neighbour or landlord puts a CCTV camera inside your home without consent | 9 | Your complaint |
| A shop or office has a camera in a changing room or toilet | 20(1) | Not allowed. Section 29 does not list it as a separate offence, so take legal advice on section 21 |
| Someone records your phone call and circulates it | 19(3) | Your complaint |
| A company shares your customer data with another firm | 26(1) | Government case |
| A hospital reveals a woman’s pregnancy to others | 6 | Your complaint |
| Someone logs in to your email and forwards your messages | 14(2) and 19(2) | Your complaint |
| A drone hovers over your house to film inside | 22 | Government case |
| A public official’s salary scale and office phone are published | 24 | Not personal information |
How to protect your own privacy
The law gives you remedies after a breach. These habits reduce the chance of one.
- Share copies of your citizenship and passport only for a stated purpose, and write that purpose across the copy.
- Read what an app asks for before you accept, and remove permissions it does not need.
- Never share an OTP or PIN. Our OTP, PIN and password safety guide covers the common tricks.
- Think before uploading documents and photos to AI tools. Our note on what never to upload to AI explains the risks.
- Keep evidence of any breach: screenshots with dates, links, and the names of witnesses. The three-month deadline is short.
If your bank data has appeared in a leak, our report on Nepal bank data on the dark web explains what to check.
Worried your privacy has been breached?
We help prepare complaint documents, evidence screenshots and online submissions. गोपनीयता उल्लंघनको उजुरी तयार गर्न सम्पर्क गर्नुहोस्।
Frequently asked questions
What is the Privacy Act 2075?
The Individual Privacy Act, 2075 is Nepal’s law protecting the privacy of a person’s body, family, residence, property, documents, data, correspondence and character, including in electronic form. It came into force on 18 September 2018.
What is the punishment for violating privacy in Nepal?
Up to three years’ imprisonment, a fine of up to Rs 30,000, or both, under section 29. The victim can also claim compensation in the District Court.
Is it illegal to record a phone call in Nepal?
Section 19 says nobody may listen to or record a conversation between two or more people through electronic means without consent or a legal order. Public speeches and statements are exempt.
Can I install CCTV at my home or shop?
At a residence, a camera needs the consent of the people living there. In a public place, a camera is allowed except in a toilet, bathroom or changing room, and a visible notice must be displayed.
How long do I have to file a privacy complaint?
Three months from the date of the act, at the District Court, for offences that are not government cases. For government cases, such as photo misuse or unlawful data use, report to the police.
Does the Privacy Act apply to companies and apps?
Yes. Sections 12 and 26 apply to public bodies and to bodies corporate, which include companies and banks. They need consent to collect personal data and may use it only for the purpose it was collected for.
Conclusion
The Privacy Act 2075 draws a clear line: what is yours stays yours unless you agree, the law requires it, or an authorised official orders it. It covers your body, home, documents, data, messages and reputation, offline and online, with up to three years in prison or a Rs 30,000 fine for breaches and compensation for victims.
Know which route your case takes, keep evidence, and act within three months. For public figures, remember that the Act protects privacy, not secrecy about public duties.
Sources
- वैयक्तिक गोपनीयता सम्बन्धी ऐन, २०७५ (Individual Privacy Act, 2075), Nepali text as published by the Nepal Law Commission: https://lawcommission.gov.np/content/12261/12261-the-privacy-act-2075/
- The Privacy Act, 2075 (2018), English translation by the Nepal Law Commission
- वैयक्तिक गोपनीयता सम्बन्धी नियमावली, २०७७ (Individual Privacy Regulation, 2077), Nepal Law Commission: https://lawcommission.gov.np/content/12982/12982-personal-privacy-regulation-2/
Digital Solution Pvt. Ltd. is an independent publisher. Sections are summarised from the Act’s Nepali text and the Law Commission’s English translation; the situations table is our own reading. This is general information, not legal advice. For a real dispute, consult a lawyer.
Rabin Paudel
Rabin Paudel is the Founder of Digital Solution, a Content Creator, and an AI Trainer. He shares practical and easy-to-understand content on Artificial Intelligence, Digital Literacy, Online Services, FinTech, and Technology. His mission is to make technology simple, accessible, and useful for everyone.
View all posts by Rabin Paudel →