The framework
Nepal regulates personal data through the Individual Privacy Act, 2075 (2018), without a dedicated supervisory authority.
For advertisers the consent posture matters most, and Nepal sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Individual Privacy Act, 2075 (2018)
Nepal legislated early for the region with the 2018 Privacy Act and 2020 regulations, but without a supervisory authority enforcement runs through criminal complaints, which keeps practical pressure low.
Marketing and advertising
Consent required for collection, use and publication of personal information, with broad government exceptions. Most channel decisions here follow from that consent rule.
Cross-border transfers
Transfers abroad rely on consent, and the law sets out no dedicated transfer mechanism.
Enforcement and penalties
Violations can bring fines and up to three years' imprisonment.