Nepal has no cookie law. The Individual Privacy Act, 2075 (2018), published in English by the Nepal Law Commission, is the main privacy statute, and it applies to cookies only when they collect personal information. As of October 2026, no dedicated data protection act has been passed and Nepal has no data protection authority, so the Privacy Act and its court-based complaints remain the rules that count.
Nepal's privacy framework and how it affects your website
Nepal's Individual Privacy Act, 2075, referred to internationally as the Privacy Act 2018, was authenticated on 18 September 2018. It is the country's first standalone privacy statute, covering both physical privacy and the privacy of information.
For website owners, the key provisions sit in the sections on personal information. Section 23 limits who may collect, store, analyse or publish a person's personal information, and requires anyone collecting it with consent to explain the purpose first. Section 26 bars public bodies and companies from using or passing on the personal information they hold without the person's consent, outside a short list of exceptions. And under Section 19, every person has a right to privacy of information held by electronic means.
The Act does not mention cookies, IP addresses or online identifiers. That gap limits its direct application to website tracking. But if your site collects personal information from visitors in Nepal through forms, account registration or analytics tools that capture identifiable data, the consent provisions apply.
What the Privacy Act 2018 requires
The Act creates a general right to privacy covering a person's body, residence, property, documents, data, correspondence and character, including information held by electronic means.
Three requirements stand out for website operators:
Consent and purpose: information may be collected with the person's consent only after telling them why it is collected (Section 23)
Use limited to that purpose: personal information may not be used or given to anyone without consent, outside the listed exceptions (Section 26)
Security: public bodies must protect the personal information they hold against unauthorised access, use, change, disclosure or transmission (Section 25)
Sensitive information receives extra protection. Section 27 bars public bodies from processing sensitive personal information such as caste, ethnicity, political affiliation, religious belief or health.
Penalties under the Privacy Act
Section 29 lists the offences under the Act, including breaches of the collection rule in Section 23 and the consent rule in Section 26. Under Section 29(2), each carries imprisonment of up to three years, a fine of up to NPR 30,000, or both.
Under Section 30, a person affected by most of these offences may complain to the District Court within three months of the act. For some offences, including breaches of Section 26(1), the Government of Nepal is the plaintiff instead. Section 31 lets a victim also claim compensation from the offender through the District Court.
These penalties are modest next to the GDPR's maximum of €20 million or 4% of worldwide turnover, and the short complaint window and court-based model mean that practical enforcement has been limited.
No dedicated data protection authority
The Privacy Act does not establish a regulator to investigate complaints, carry out audits or issue administrative fines. According to DLA Piper's summary of Nepal's data protection laws, last updated on 20 March 2026, no national data protection authority has been designated. Complaints go to the district court, or to the police as a First Information Report for the offences the state prosecutes.
Proposed changes: a data protection policy and an IT bill
Change is under discussion but not yet law. In July 2025, Kantipur reported that a draft personal data protection policy, prepared under the Office of the Prime Minister, proposed a Data Protection Board to oversee personal data for the first time. As of October 2026, no act creating such a board has been passed.
A revised draft Information Technology and Cyber Security Bill also contains a privacy clause: personal details collected in an information technology system may not be used or shared for purposes other than those disclosed without the person's consent. DLA Piper's March 2026 summary describes that bill as not yet passed by Parliament.
Until one of these instruments becomes law, there is no cookie-specific rule and no regulator. The Privacy Act 2018 and the courts remain the framework.
Cookies need consent in Nepal only when they collect personal information
There is no cookie-specific law in Nepal equivalent to the EU's ePrivacy Directive. The Privacy Act 2018 does not mention cookies, local storage or device-based tracking by name.
If cookies on your website collect personal information from visitors in Nepal, the Act's consent and purpose rules apply. DLA Piper's summary takes the same view: where personal information or location data is collected through cookies, the Privacy Act applies and the information must be used only for the purpose it was collected for. Cookies such as _ga, _fbp or _gcl_au that track behaviour and build profiles tied to identifiable people fall within that scope. Strictly necessary cookies like PHPSESSID, or a cookie that only stores a chosen language, collect no personal information and sit outside it.
Nepal and the GDPR compared
| Aspect | Nepal Privacy Act 2018 | EU GDPR |
|---|---|---|
| Cookie-specific rules | None | Yes, through the ePrivacy Directive |
| Consent requirement | Consent to collect and use personal information (Sections 23 and 26) | Freely given, specific, informed, unambiguous consent |
| Data protection authority | None (a board is proposed in a 2025 draft policy) | Independent authority in each member state |
| Maximum penalty | NPR 30,000, 3 years' imprisonment, or both (Section 29) | €20 million or 4% of worldwide turnover |
| Breach notification | No dedicated duty in the Act | 72 hours (Article 33) |
| Data subject rights | Application to correct information (Section 28) | Access, rectification, erasure, portability, restriction, objection |
| Enforcement | Complaint to the District Court within 3 months (Section 30) | Administrative fines by the authority |
The GDPR's extraterritorial reach means that if your Nepal-based website targets or monitors people in the EU, the GDPR applies regardless of Nepali law.
Checklist for websites targeting Nepal
Even without cookie-specific rules, asking first keeps your site in line with the Privacy Act's consent and purpose rules and with the stricter laws your other visitors may bring. A practical checklist:
Audit your cookies. Find every cookie your site sets, including those from third-party scripts such as analytics, advertising pixels and social embeds.
Categorise cookies. Group them into standard categories: strictly necessary, functional, analytics and marketing.
Display a cookie banner. Explain what data you collect and why, with real opt-in controls for non-essential cookies.
Publish a cookie policy. Keep a detailed cookie policy listing each cookie by name, purpose, duration and provider.
Block non-essential cookies before consent. Use script blocking so non-essential cookies wait until the visitor agrees.
Honour consent choices. Store and respect each visitor's preferences across sessions.
Review third-party scripts. Check that tools from Google, Meta or other providers set no tracking cookies before consent.
Regional context: privacy laws across South and Southeast Asia
Nepal's framework sits in a region where data protection law varies widely. India's DPDPA sets out a detailed consent regime with a dedicated Data Protection Board. Thailand and Indonesia have enacted comprehensive data protection laws with clearer online consent requirements. For Bangladesh, see the guide to cookie consent in Bangladesh.
If your website serves visitors across several Asian countries, one consent setup that meets the strictest applicable standard saves you from maintaining a separate configuration for each.
Questions about cookie consent in Nepal
Does Nepal have a cookie consent law?
No. Nepal has no law that specifically addresses cookies. The Individual Privacy Act 2018 requires consent to collect and use personal information, which can include data gathered through cookies, but there is no equivalent of the EU's ePrivacy Directive.
What happens if I collect personal data from Nepali users without consent?
Under Section 29 of the Privacy Act 2018, the offences carry imprisonment of up to three years, a fine of up to NPR 30,000, or both. For most offences the affected person must complain to the District Court within three months, and can also claim compensation.
Do I need a cookie banner for a website targeting Nepal?
Not for every cookie. Nepali law requires consent when cookies collect personal information, so a banner is the practical way to ask for it if your site uses analytics or advertising cookies.
Does Nepal have a data protection authority?
No. The Privacy Act 2018 did not create a regulator. A draft personal data protection policy published in 2025 proposes a Data Protection Board, but as of October 2026 no law has set one up.
Is there a new data protection act in Nepal?
Not as of October 2026. A draft data protection policy and a revised Information Technology and Cyber Security Bill are under discussion, but neither has been enacted, so the Privacy Act 2018 still applies.
Should I follow the GDPR if my website is based in Nepal?
If your website targets or monitors people in the EU, the GDPR applies wherever your business is based. A geo-targeted consent banner lets you apply the EU rules to European visitors and your local approach elsewhere.
Ask visitors in Nepal and abroad before tracking them
A banner that asks first meets Nepal's consent rule and the stricter rules your European visitors bring. Kukie.io scans your site, blocks non-essential cookies until consent and keeps a record of each choice, and its geo-targeting shows each region the right consent model.
