Data Privacy Law in Nepal for Web Apps

By Kokil Thapa | Last reviewed: September 2026

Data Privacy Law in Nepal for Web Apps is not a checkbox on a policy page. It is a set of engineering constraints rooted in the Privacy Act 2075 (2018) and the Electronic Transactions Act 2063. If you collect names, phone numbers, citizenship details, or payment data, your database schema, encryption, and consent flows must reflect Nepali law — not a copied GDPR template. This guide maps statutory requirements to concrete patterns for Laravel and custom web development in Nepal.

On legal-tech portals and eCommerce builds, I treat privacy as architecture work from the first migration. A registration form that stores citizenship numbers in plain text, or a marketing checkbox pre-ticked by default, creates liability long before a regulator knocks. Whether you ship a booking app, a client portal, or a SaaS product, compliance protects users and your business. The sections below follow the order a developer actually needs them: law first, then consent, encryption, user rights, and operational checks.

What does Data Privacy Law in Nepal for Web Apps actually require?

Three statutes matter most for web applications serving users in Nepal. The Privacy Act 2075 is the primary data protection law. The Electronic Transactions Act 2063 covers digital records, signatures, and cyber offences. The Individual Privacy Act 2075 (a separate statute focused on individual dignity) overlaps on publication of private facts — relevant if your app exposes user profiles publicly.

For developers, the Privacy Act translates into four operational duties:

• Lawful collection: Section 12 prohibits collecting personal information without consent. Pre-ticked marketing boxes fail this test.
• Purpose limitation: Section 14 restricts use to the stated purpose. A phone number collected for delivery cannot drive SMS ads without separate consent.
• Security safeguards: Section 25 requires reasonable measures to protect stored data. In 2026, that means TLS, strong password hashing, and encryption for sensitive identifiers.
• Individual rights: Users may request access, correction, or deletion of their data. Your app needs workflows — not just a support email — to honour these.

Nepal does not operate a GDPR-style data protection authority with automated fines yet. That is not permission to ignore the law. The ETA carries criminal penalties for unauthorised access and data misuse. Reputational damage from a leaked user database can be worse than a fine for a small Nepali business. When I build legal-tech solutions for law firms in Nepal, every government-issued identifier field gets encrypted and access-controlled by default.

Sensitive vs general personal data in the Nepali context

Not all fields deserve the same treatment. General personal data includes name, email, and phone number. Sensitive data in practice includes citizenship numbers, PAN/VAT details, passport copies, biometric data, health records, and financial account numbers. Store sensitive fields with column-level encryption, not just disk-level RDS encryption. See our guide on database encryption at rest and in transit for the full stack picture.

How do you implement valid consent management in Laravel?

Valid consent under Nepali law must be informed, specific, and unambiguous. A single "I agree to everything" checkbox fails when your app runs analytics, marketing email, and third-party payment processing as separate activities. Split consent by purpose and record each decision in an append-only ledger.

Database schema for audit-ready consent

Never overwrite consent rows. Append new records so you can prove what a user agreed to on a given date. This migration works on Laravel 12.x and 13.x with PHP 8.3+:

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    public function up(): void
    {
        Schema::create('user_consents', function (Blueprint $table) {
            $table->id();
            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
            $table->string('consent_type'); // marketing_email, analytics, payment_share
            $table->boolean('granted');
            $table->string('ip_address', 45)->nullable();
            $table->text('user_agent')->nullable();
            $table->json('metadata')->nullable();
            $table->timestamp('consented_at')->useCurrent();
            $table->index(['user_id', 'consent_type', 'consented_at']);
        });
    }
};

Recording consent in Form Requests

Capture consent at the point of interaction. Record IP address and user agent as corroborating evidence:

public function register(RegisterRequest $request): RedirectResponse
{
    $user = User::create($request->safe()->except(['consent_marketing', 'consent_analytics']));

    foreach (['marketing', 'analytics'] as $type) {
        if ($request->boolean("consent_{$type}")) {
            $user->consents()->create([
                'consent_type' => $type,
                'granted' => true,
                'ip_address' => $request->ip(),
                'user_agent' => $request->userAgent(),
                'metadata' => ['policy_version' => '2026-09-v1'],
            ]);
        }
    }

    return redirect()->route('dashboard');
}

Withdrawal must be equally easy. A user who revokes marketing consent should not lose account access. Write a new ledger row with granted = false and stop the downstream job — do not delete the old record. For payment flows tied to Laravel payment integrations, disclose which third parties receive transaction data before checkout completes.

How should web apps encrypt and store sensitive personal data?

Infrastructure encryption protects disks. Application encryption protects columns. A DBA or backup restore should not expose raw citizenship numbers. Laravel's built-in encrypted cast uses AES-256-CBC with your APP_KEY. For highly sensitive fields, consider envelope encryption with a KMS — patterns covered in our PII protection guide for LLM apps apply equally to traditional CRUD apps.

Laravel model encryption example

class Client extends Model
{
    protected function casts(): array
    {
        return [
            'citizenship_number' => 'encrypted',
            'pan_number' => 'encrypted',
        ];
    }
}

Passwords are not encryption candidates — hash them with Argon2id. Laravel 12+ supports automatic rehashing; see our two-factor authentication setup guide for the broader auth hardening picture. Rotate APP_KEY only with a documented re-encryption migration. Losing the key means losing the data permanently.

Transit encryption is non-negotiable. Force HTTPS, enable HSTS, and terminate TLS 1.2+ at your reverse proxy. Our website and server security guide for Nepal covers Certbot, UFW, and PHP-FPM hardening on Ubuntu.

What user rights must your web app support under Nepali law?

The Privacy Act grants individuals the right to know what data you hold, request correction of inaccurate records, and request deletion when retention is no longer justified. Your app should expose these through authenticated self-service endpoints — not only a generic contact form.

1. Data export: Return a JSON or PDF bundle of the user's stored fields and consent history within a reasonable timeframe.
2. Correction: Allow users to update contact details; log admin overrides separately.
3. Deletion: Soft-delete the account, purge PII from active tables, and anonymise rows you must keep for legal or tax reasons.
4. Objection: Stop marketing processing immediately upon withdrawal without affecting core service delivery.

On the Mijar Law Associates client portal, document uploads and case notes require strict role-based access. Spatie Laravel Permission policies gate every read operation. That pattern belongs in any app handling legal or financial PII.

Data retention and deletion jobs

Define retention periods per data category. Inactive accounts after 24 months, server logs after 90 days, and payment records for seven years if tax law requires it. Schedule a nightly Artisan command to anonymise expired records:

// app/Console/Commands/PurgeExpiredUserData.php
User::where('deleted_at', '<', now()->subMonths(24))
    ->each(fn ($user) => $user->forceFill([
        'email' => "deleted-{$user->id}@anon.local",
        'phone' => null,
        'name' => 'Deleted User',
    ])->save());

How do WordPress and eCommerce sites handle Nepal privacy compliance?

Not every Nepali business runs Laravel. WooCommerce stores on WordPress 7.1 need the same consent and security fundamentals. Disable commenter IP logging if unnecessary. Use a cookie consent plugin that blocks analytics scripts until opt-in. Never store card numbers locally — delegate to Nepal payment gateways like eSewa, Khalti, or ConnectIPS.

Many WordPress sites store citizenship scans as media attachments with public URLs. That is a critical failure. Restrict uploads to private disks and serve via signed URLs. Our WordPress GDPR compliance checklist covers overlapping controls useful even though Nepal is not in the EU.

What operational checks prevent privacy failures in production?

Code-level controls fail without operational discipline. Treat the items below as a pre-launch and quarterly audit checklist. Run them before every major release on apps you host — I use the same list across sister sites on shared Deployer 7 infrastructure.

• Access reviews: Quarterly audit of admin accounts. Remove ex-staff immediately.
• Audit logging: Log PII reads and exports with user ID, timestamp, and IP. Use Spatie Activity Log or equivalent.
• Backup encryption: Encrypt database dumps at rest. Restrict restore access.
• Third-party DPAs: Document which SaaS tools receive user data — email providers, SMS gateways, analytics.
• Breach response plan: Define who notifies affected users and within what timeframe. The ETA expects prompt action.
• Secrets hygiene: Scan git history for leaked keys. Rotate credentials after any incident.

Generate strong keys with our password generator tool for service accounts — never reuse admin passwords across environments. Validate JSON export formats with the JSON formatter before sending data bundles to users.

API endpoints need the same protections as web forms. If you expose user data through a REST API, apply rate limiting, token scoping, and pagination. Our Laravel Sanctum authentication guide and API rate limiting patterns cover the technical side. For SaaS billing data, cross-reference Nepal VAT compliance for SaaS businesses when defining retention for invoices.

Penetration testing and static analysis catch issues code review misses. Run OWASP Top 10 checks on Laravel apps and dependency scans in CI. For enterprise builds, our enterprise application development service includes privacy-by-design reviews during architecture phase — cheaper than retrofitting consent systems after launch.

Compare Nepal's framework to GDPR only for internal planning, not as a substitute. GDPR has formal DPAs, SCCs, and a dedicated authority. Nepal's regime is thinner but still binding. Document your processing activities in a simple register: what you collect, why, where it is stored, who can access it, and how long you keep it. That register satisfies auditors and speeds up testing and optimization audits.

Reference the official Nepal Law Commission portal when verifying statutory text. Cross-check cyber offence provisions in the Electronic Transactions Act if your app handles digital signatures or certificate-based login — common on government-adjacent portals.

Key Takeaways

• Data Privacy Law in Nepal for Web Apps rests on consent, purpose limitation, security, and user rights under Privacy Act 2075 — implement all four in code.
• Build an append-only consent ledger with IP, user agent, and policy version — never overwrite old consent rows.
• Encrypt citizenship numbers, PAN details, and document paths at the application layer, not just the disk.
• Ship self-service export, correction, and deletion endpoints before launch — a contact form alone is insufficient.
• Schedule retention purge jobs and maintain audit logs for every PII read or export operation.
• Run the pre-launch checklist on every release; privacy regressions are as serious as payment bugs.

People Also Ask

Is GDPR compliance enough for Nepali web apps?

No. GDPR protects EU residents regardless of where your servers sit. Nepal's Privacy Act 2075 protects individuals in Nepal under its own consent and security rules. A GDPR-aligned app is a strong starting point, but you must still meet Nepali statutory requirements for consent granularity, local data handling, and ETA cyber offence provisions.

What counts as personal data under Nepal's Privacy Act?

Personal information includes any data that identifies an individual — name, email, phone, address, photo, citizenship number, PAN, biometric data, and online identifiers tied to a person. If a data point alone or combined with other fields can identify someone, treat it as personal data and apply appropriate safeguards.

Do small business websites in Nepal need privacy compliance?

Yes, if you collect any personal information. A contact form storing names and phone numbers triggers consent obligations. Scale does not exempt you. Smaller sites can use simpler tooling — cookie consent plugins, HTTPS, and clear privacy pages — but the legal duty applies regardless of traffic volume.

Who enforces data privacy law in Nepal?

There is no standalone GDPR-style data protection authority in Nepal as of 2026. Enforcement flows through general legal channels — civil claims, criminal prosecution under the ETA for unauthorised access, and sector-specific regulators where applicable. The absence of a dedicated DPA is not a reason to skip technical controls.

Ship privacy-compliant apps from day one

Data Privacy Law in Nepal for Web Apps becomes manageable when you treat it as engineering work: consent ledgers, encrypted columns, user rights APIs, and audit logs baked into your Laravel or WordPress architecture from migration one. Retrofitting after a data incident costs more in trust, time, and legal exposure than building it right the first time. If you need a privacy-by-design review on an existing portal or a new build, contact us or explore our custom software development service in Nepal.