Cybersecurity regulation in Nepal (2026)

The Electronic Transactions Act 2063 (enacted 2008) is Nepal's primary cyber statute. It criminalises hacking, fraud, and unauthorised access with penalties of NPR 50,000–300,000 and 6 months to 3 years imprisonment, but imposes no general breach-notification obligation or structured incident-reporting regime.

Nepal's Cabinet approved the National Cyber Security Policy 2080 in August 2023—the country's first dedicated cybersecurity policy. It calls for provincial CERTs, ethical-hacking promotion, and digital-literacy programmes, but is an executive policy instrument rather than binding legislation.

Nepal established the NCSC on 24 January 2024 as the national body to coordinate and resolve cybersecurity incidents. In January 2025 it issued a 102-point advisory covering mandatory software updates, MFA, and voluntary incident reporting, though it currently lacks statutory enforcement authority under the ETA 2063.

The Information Technology and Cyber Security Bill 2082 was registered in the House of Representatives in June 2025 and passed the lower house. It would replace the ETA 2063, introduce mandatory breach notification, a CII protection regime, AI governance provisions, and heavier penalties (up to NPR 1,000,000 and 5 years imprisonment). Full enactment into law has not been confirmed as of mid-2026.

Nepal Rastra Bank issued Cyber Resilience Guidelines in August 2023 for banks, payment service providers, and payment service operators. Requirements include two-factor authentication, disaster-recovery sites, ISO 27001-aligned controls, continuous monitoring, and mandatory IT audits every two years—currently the most binding sector-specific cybersecurity obligations in force.

No general statutory breach-notification or cross-sector incident-reporting duty exists under current law. The NRB guidelines impose reporting duties on the financial sector only. The draft IT & Cybersecurity Bill 2082 would introduce mandatory notification for the first time across sectors upon enactment.