Nepal's Privacy Act and your CRM, chatbot and AI tools

Yes, Nepal's Individual Privacy Act, 2075 (2018) applies to your business. If you collect a customer's name, phone number, citizenship details or purchase history, you need their consent, you can only use that data for the purpose you collected it for, and you cannot hand it to anyone else without permission. Breaking the listed rules can mean up to three years in prison, a fine of up to NPR 30,000, or both.

That is the short version. The longer one matters more, because most SMEs now push customer data through five or six tools a day, and some of those tools sit in other countries. This guide walks through what the Act actually says, what it leaves out, and what it means for a CRM, a website chatbot, ChatGPT or Claude, call recordings and KYC files. One thing up front: this is general information, not legal advice. For a specific decision, talk to a Nepali lawyer.

What does the Privacy Act 2075 actually say?

The Act, in force since 2018 and backed by the Individual Privacy Regulation, 2077 (2020), defines personal information broadly in Section 2(c). It covers caste, ethnicity, religion and marital status; education; address, phone number and email; passport, citizenship, national ID, driving licence and voter ID details; fingerprints, retina scans and other biometrics; criminal records; and letters that mention personal details. In practice, almost every row in your CRM qualifies.

The rules that bite hardest for a private business are these:

• Consent to collect. Section 12(2) says a person's consent must be obtained when collecting their personal or family data.
• Purpose limitation. Section 12(3) says data collected by a public body or body corporate with consent may be used only for the purpose it was collected for.
• No disclosure without consent. Section 12(4) lists data you cannot give to anyone or publish without consent, including health, income and property, employment, biometrics, signatures and business or transaction details. Section 26(1) repeats the ban for any body corporate.
• Sensitive data. Section 27 treats caste, political affiliation, religion, health, sexual orientation and property details as sensitive, and bars public bodies from processing them outside narrow exceptions.
• Recording conversations. Section 19(3) bars recording talks held over electronic means without the consent of the people involved.
• Security. Section 25 requires public bodies to guard collected data against unauthorised access, change, disclosure or transmission.

Penalties are in Section 29: imprisonment of up to three years, a fine of up to NPR 30,000, or both, for breaches of the listed sections, including 12(4), 19(2)-(3) and 26(1). Section 31 lets a victim ask the District Court for compensation on top of that, and Section 30 gives most complainants three months to file.

What the Act leaves out matters just as much, so here are the gaps. The Act has no dedicated data protection regulator; complaints go to the District Court, and for some offences the Government of Nepal becomes the plaintiff. It has no duty to notify anyone after a data breach. It sets no general retention period for private companies. The explicit security duty in Section 25 is written for public bodies. And it is silent on sending data abroad, a gap Nepali commentators flagged years ago.

None of that is a licence to be careless. A breach you can't explain still turns into a complaint under Sections 12 or 26, and customers remember. Treat the gaps as places where good practice has to do the work the law doesn't.

What has changed since 2018?

Three things are moving. First, the Information Technology and Cyber Security Bill, 2082, tabled in the House of Representatives in 2025, is meant to replace the Electronic Transactions Act, 2063 and adds personal-data duties, including destroying data once its purpose is served. The Kathmandu Post reported free-speech concerns about it in August 2025. Check its status before relying on either text; until a replacement is in force, the 2063 Act remains the baseline for electronic records.

Second, the National AI Policy, 2082, approved in August 2025, calls for laws on the ownership, privacy and security of personal and institutional data used in AI. It is a policy, not a statute, but it signals where rules are heading. Third, regulated sectors already carry extra duties: banks and financial institutions follow Nepal Rastra Bank's IT Guidelines on confidentiality, outsourcing and information security, and the Data Center and Cloud Service directive of 2081 requires providers to be listed with the Department of Information Technology.

How does personal data flow through a typical SME stack?

Here is the path a single enquiry usually takes: a web form, then the CRM, then an email tool, then someone pastes it into an AI assistant, and finally it sits in backups for years. Each hop is a place where consent, minimisation, access control or deletion either happens or doesn't. Tap any node to see which duty applies there.

What does it mean for your CRM and your website chatbot?

For the CRM, the Act's core demands translate into a short list. Record consent and purpose alongside each contact. Collect only what the purpose needs; a delivery business rarely needs a citizenship number. Give each staff member their own login with the least access that works. And don't share the list with a partner, a sister company or a marketing agency unless the customer agreed to it, because Section 26(1) makes that an offence.

A website chatbot is a data-collection form that talks. Show a one-line notice before the first message, say what you keep and for how long, and don't ask for ID numbers in chat. Keep transcripts on a timer, not forever. We covered the wider set of practical AI jobs for small firms in our guide to AI for Nepali SMEs; the same rules apply to every one of them. For a public-sector version with audit logs built in, see the citizen-services assistant blueprint.

Is it safe to paste customer data into ChatGPT, Claude or Gemini?

It depends on which account you use. OpenAI says it does not train on data from ChatGPT Business, Enterprise, Edu or its API by default, and lets eligible customers set retention, including zero data retention on the API. Anthropic says it doesn't use inputs or outputs from its commercial products to train models, unless you send feedback or opt in. Google says Gemini in Workspace doesn't use customer data to train models without the customer's permission, and content isn't reviewed by humans for that purpose.

Consumer accounts are a different story, and their settings change. If staff paste customer records into personal accounts, you have handed data to a third party without consent, which is exactly what Section 26 forbids. The practical fix is dull but effective: a company account on a business tier, a written rule about what may be pasted, and masking names and ID numbers before anything leaves your systems.

Can you send data to servers outside Nepal?

Here is the honest answer: the Privacy Act doesn't say. There is no clause that permits transfers abroad and none that bans them. Most SaaS tools Nepali firms use, from CRMs to email platforms to every major AI model, run outside the country, and the Act doesn't make that illegal on its face. What it does say still applies wherever the server sits: you need consent, you must stick to the purpose, and you can't disclose data to others without permission.

Sector rules can be stricter. Banks and financial institutions answer to Nepal Rastra Bank's IT Guidelines, which cover outsourcing and information security, and government projects fall under the 2081 cloud directive. If you are in either group, get the regulator's position in writing before moving data offshore. If you're not, tell customers in your privacy notice that their data may be processed abroad, and name the vendors.

What about call recordings and KYC documents?

Call recordings fall squarely under Section 19(3): recording a conversation held over electronic means needs the consent of the people talking. The familiar opening line, telling callers the call is recorded and why, is the minimum. Store recordings with the same access control as the CRM, and delete them on a schedule.

KYC files are the most sensitive thing most businesses hold: citizenship scans, photos, sometimes fingerprints, all named in Section 2(c) and 12(4). Anti-money-laundering rules set their own minimum retention for financial institutions, so check that before you delete anything. Beyond that, encrypt the files, keep them out of shared drives, and never paste them into a general chatbot. Our KYC document AI blueprint shows how extraction can run with audit trails and masked outputs.

How does Nepal's law compare with the GDPR and India's DPDP Act?

If you serve European or Indian customers, their laws may reach you too. The comparison below shows why Nepal's Act feels light on paper: no regulator, no breach-notice rule, a small fixed fine. The GDPR and India's DPDP Act 2023 are far heavier.

What should you do this month?

You don't need a compliance department. You need a short list you actually finish. Filter the table below by tool or by section to find what applies to you.

If you only do three things, do these: move every staff AI account to a business tier, add a consent line to your forms and your call greeting, and write down how long you keep each kind of record. That covers most of the real risk for a typical SME.

We build AI and automation for Nepali businesses, and privacy is part of the design from the first sketch: redaction before any model call, audit logs, consent fields and deletion jobs that actually run. If you want a second pair of eyes on how customer data moves through your tools, talk to our team or see what our Neural AI service covers.