What is Cyber Law in Nepal?

What Is Cyber Law?

Cyber law is the body of legal rules that govern digital activity. It covers how people and organisations use the internet, computers, electronic records, and digital communication. It also defines what constitutes a crime in the digital space and what penalties apply. Cyber law is not one single law. It is a framework made up of multiple statutes, regulations, and constitutional provisions that work together to regulate online behaviour and protect individuals from digital harm.

When Was Cyber Law Introduced in Nepal?

Nepal introduced its primary cyber legislation through the Electronic Transactions Act (ETA), 2063, enacted in 2008. This was a significant step for a country that was still building its digital infrastructure at the time. The ETA was designed to give legal recognition to electronic records and digital signatures, and to define punishable offences in the digital space. It became the foundation of Nepal's cyber law framework and remains the primary legislation in this area today. Other key legal protections followed. The Individual Privacy Act 2075, enacted in 2018, added data protection rights and placed obligations on those who collect and use personal information. The Constitution of Nepal 2015 also provides a constitutional basis for privacy under Article 28, which protects personal data as a fundamental right.

Key Laws That Make Up Nepal's Cyber Law Framework

Electronic Transactions Act, 2063 (2008)

This is the core law. It covers:

• Legal recognition of electronic records and digital signatures
• Unauthorised access to computer systems
• Damage to computer data or programs
• Publication of illegal or harmful content online
• Data theft and computer fraud

Penalties under the ETA can reach up to 5 years imprisonment or a fine of NPR 1 lakh, depending on the nature of the offence.

Individual Privacy Act 2075 (2018)

This law protects personal data. It requires consent before collecting or disclosing an individual's personal information. Violations can result in legal liability.

Constitution of Nepal 2015

Article 28 of the Constitution guarantees the right to privacy. This includes protection over personal information, communications, and digital data. It gives cyber law a constitutional foundation that cannot be easily overridden.

Why Is Cyber Law Necessary?

Before cyber law existed, the legal system had no clear tools to respond to digital crimes. A person could hack into a system, steal data, or publish defamatory content online and face no specific legal consequence because no law addressed it. Cyber law became necessary for several reasons: Digital crimes are real crimes. Hacking, fraud, identity theft, and online harassment cause genuine harm. Cyber law creates legal recognition for these harms and establishes penalties. Electronic records needed legal standing. Contracts signed digitally, financial records stored electronically, and communications sent by email all needed to be admissible and enforceable. The ETA provided that recognition. Individuals needed protection online. Without legal protection, citizens were vulnerable to data theft, surveillance, and manipulation. Cyber law sets boundaries on what others can do with your digital information. Businesses needed a trustworthy digital environment. E-commerce and digital banking require legal security. Cyber law provides the rules that make digital transactions reliable.

Why Is Cyber Law Important in Nepal?

Nepal's digital economy is growing. Mobile banking, e-commerce, government e-services, and social media use have all increased significantly. With this growth comes exposure to new risks. Here is why cyber law matters specifically in Nepal: Online harassment and defamation are rising. Social media cases under the ETA have increased. Publishing content online that harms reputation or spreads false information can lead to criminal charges, including imprisonment. Financial fraud is a serious threat. Digital payment systems and online banking are targets for fraudsters. The ETA gives law enforcement a legal basis to act. Personal data is at risk. Without legal protection, personal information collected by apps, websites, and services could be misused. The Individual Privacy Act addresses this directly. Government accountability matters online too. Citizens interacting with government systems digitally need assurance that their information is protected and that systems are not being abused. The Cyber Bureau of Nepal Police is the primary regulatory body handling complaints related to hacking, online harassment, and cyber fraud. They are the first point of contact for anyone experiencing a cybercrime in Nepal.

Offences Covered Under Nepal's Cyber Law

The Electronic Transactions Act defines specific offences that carry legal consequences:

• Unauthorised access to a computer system or network
• Damage or alteration of computer data or programs
• Data theft and interception of digital communications
• Publishing illegal content online, including defamatory material
• Computer fraud and misuse of electronic records
• Content that violates social media guidelines or causes reputational harm

These offences are not minor. A conviction can result in imprisonment of up to five years and significant financial penalties.

Cyber Law and Artificial Intelligence

This is the area where Nepal's legal framework currently faces its biggest gap. Artificial intelligence introduces legal questions that the Electronic Transactions Act of 2008 was never designed to answer. When an AI system makes a decision that harms someone, who is legally responsible? When AI is used to generate deepfake content, manipulate images, or spread disinformation, which law applies? Some of the emerging concerns include: AI-generated content and defamation. AI can produce realistic fake images, videos, or text. Current law struggles to attribute authorship and liability when the creator is not a human. Automated decision-making and privacy. AI systems that process personal data for decisions about credit, employment, or services raise serious questions under the Individual Privacy Act. The law requires consent for data use, but AI-driven data processing often happens in ways users do not fully understand. Cybercrime using AI tools. Hackers and fraudsters are increasingly using AI to automate attacks, generate phishing messages, and bypass security systems. Existing cyber law definitions may not fully capture these new methods. Accountability gaps. If an AI system causes harm, identifying who is legally responsible is genuinely difficult. Is it the developer, the business that deployed the AI, or the user who instructed it? Nepal is aware of this challenge. A draft Information Technology and Cyber Security Bill 2024 is currently under consideration. If enacted, it would establish a National Cyber Security Center and update the legal framework to address modern threats, including those arising from AI and advanced technology. Until that legislation passes, Nepal's cyber law remains anchored to a 2008 statute in a 2026 world. That gap is significant.

What This Means for You

Whether you are an individual, a business owner, or a professional working with digital systems, cyber law affects you in practical ways. If you post content online, you are subject to the Electronic Transactions Act. Content that is defamatory, false, or harmful can result in criminal charges. If you collect customer data, the Individual Privacy Act places legal obligations on you. Collecting, storing, or sharing personal information without consent is a legal risk. If you have experienced cybercrime, including hacking, fraud, or online harassment, you can file a complaint with the Cyber Bureau of Nepal Police. The ETA gives them the authority to investigate and act. If you are a business operating digitally, understanding your obligations under cyber law is not optional. Non-compliance exposes you to liability.

Looking Ahead

Nepal's cyber law is not static. The draft IT and Cyber Security Bill 2024 signals that lawmakers recognise the need for an updated framework. When enacted, it is expected to address cybersecurity standards, AI-related risks, and institutional oversight more comprehensively. For now, the Electronic Transactions Act remains the primary tool. Understanding it is the first step to protecting yourself and operating responsibly in Nepal's digital space.

Common Questions About Cyber Law in Nepal

What is the main cyber law in Nepal? The Electronic Transactions Act, 2063 (2008) is the primary legislation. It governs digital records, signatures, and cybercrimes. What is the penalty for cybercrime in Nepal? Offences under the ETA can result in up to 5 years imprisonment or a fine of NPR 1 lakh, depending on the nature of the crime. Who handles cybercrime complaints in Nepal? The Cyber Bureau of Nepal Police is the designated authority for complaints related to hacking, online harassment, and cyber fraud. Is personal data protected under Nepal law? Yes. The Individual Privacy Act 2075 (2018) and Article 28 of the Constitution both protect personal data and require consent for its collection and use. Does Nepal have a law on AI? Not yet. A draft IT and Cyber Security Bill 2024 is under consideration, but AI-specific regulation is still absent from the current framework. I am Rupesh Koirala, an advocate practising in Eastern Nepal. If you are facing a cybercrime issue, need legal advice on digital compliance, or want to understand how cyber law affects your business or personal situation, reach out. Legal clarity in this space can prevent serious consequences before they arise.