Privacy Act 2075 compliance, security assessments, breach response, employee training, and managed security services - built for Nepal's regulatory environment.
Purba Tech Labs provides cybersecurity and data protection services for Nepal-based organizations - including Privacy Act 2075 compliance, security assessments, breach response planning, employee security training, ISO 27001 readiness, and ongoing managed security services.
Nepal regulatory context: Privacy Act penalties up to 3 years + NPR 30K fine · 7,740 cybercrime complaints in FY 2024/25 · no dedicated regulator yet · pending IT Bill 2082 includes 35-day data destruction · NRB and NTA sectoral rules apply.
Services: Security Assessments · Privacy Act Compliance · Breach Response · Employee Training · ISO 27001 · Managed Security · free security assessment available.
Nepal's cybercrime pressure is accelerating. Reported complaints grew from 4,154 in FY 2023/24 to 7,740 in FY 2024/25, a 90% surge. Another 5,498 complaints were reported in the first 10 months of FY 2025/26. Reported categories include 10,000+ financial crime complaints, 4,000+ fake account cases, and 3,000+ bullying or harassment cases.
The legal exposure is also real. Article 28 of Nepal's Constitution protects privacy. The Privacy Act 2075 and Individual Privacy Regulation 2077 require consent, purpose limitation, reasonable security, and authorized handling of personal information. Violations can carry up to 3 years imprisonment and NPR 30,000 fine. Parallel provisions in Penal Code 2074 Sections 293-298 and ETA 2063 Section 47 add more exposure.
Most Nepali SMEs still have no data inventory, no employee security training, no breach response plan, no documented consent, no access review, and no compliance evidence. Purba Tech Labs closes that gap with security assessments, Privacy Act compliance, technical controls, breach readiness, awareness training, ISO 27001 readiness, and managed security.
From compliance to technology to training - we cover your entire security journey.
Understand your security posture before attackers do: vulnerability assessment, penetration testing, architecture review, Privacy Act gap analysis, and sectoral compliance review for NRB, NTA, healthcare, and e-commerce contexts.
Data inventory, privacy policy, consent mechanism, purpose limitation, Section 28 rectification process, employee training, and audit-ready documentation to reduce exposure to 3 years imprisonment and NPR 30,000 fine.
Encryption, identity and access management, MFA, role-based access, data loss prevention, backup and recovery, secure data disposal, cloud security, and endpoint protection based on your risk and budget.
Incident response plan, breach response team training, tabletop exercises, forensic preservation, voluntary disclosure support, cybercrime complaint guidance, and post-breach remediation.
Nepali and English employee training on phishing, password security, personal information handling, Privacy Act obligations, incident reporting, and role-specific responsibilities.
Ongoing monitoring, SIEM log review, threat detection, alerting, vulnerability scanning, monthly reports, escalation support, and incident response support for teams without 24/7 internal security capacity.
Everything you need for Privacy Act compliance, security operations, and breach readiness.
Data inventory, consent management, purpose limitation, authorized handling, rectification process, and compliance dashboard.
Document what personal data you collect, where stored, who accesses it, retention period, and legal basis.
Website/app privacy policy aligned with Privacy Act 2075 and Individual Privacy Regulation 2077.
Assess vendors, partners, cloud providers, and processors handling your data.
Reports for board review, audit evidence, or regulator questions.
Encryption at rest, in transit, backups, devices, and key management.
Role-based access control, least privilege, MFA, privileged access review, and SSO where needed.
Monitor or block sensitive data leaving through email, USB, cloud upload, or unsafe sharing.
Antivirus, EDR options, device encryption, mobile device management, and patching.
Automated backups, offsite copies, restore testing, RPO/RTO planning.
Centralized logs from servers, network devices, apps, and security tools with alerting.
Detect suspicious processes, privilege escalation, ransomware patterns, and compromised endpoints.
Alert on unusual login times, impossible travel, large data access, or privilege misuse.
Update detection rules for phishing, social hacking, online fraud, and Nepal-relevant threat patterns.
Tabletop exercises to test roles, escalation, evidence preservation, and communication templates.
Defines personal data such as name, address, phone, biometrics, health, financial, citizenship, and ID records.
Record consent timestamp, purpose, scope, method, and withdrawal process.
Remove unnecessary personal data collection and reduce sensitive exposure.
Retention schedule and secure disposal preparation for the IT Bill 35-day destruction direction.
Risk assessment for high-risk processing such as health, financial, biometric, or large-scale data.
Confidentiality, integrity, availability, IT audit, incident reporting, backup, and business continuity readiness for BFIs.
Subscriber data protection, lawful process support, retention, and telecom/ISP data handling controls.
Patient confidentiality, health data access control, consent gaps, retention questions, and PHI protection.
Customer data, privacy notices, consent, payment/order history, and customer account security.
Pre-audit gap analysis, evidence preparation, and remediation support.
Baseline and quarterly tests, click-rate tracking, and immediate coaching.
Short Nepali/English modules for password security, phishing, data handling, clean desk, and reporting.
Different guidance for staff, managers, IT, executives, and compliance teams.
Consent, purpose limitation, authorized handling, rectification rights, and penalties.
Completion, quiz score, simulation result, and compliance evidence reporting.
Compare current controls against ISO 27001:2022 and Annex A.
Policies, risk methodology, procedures, forms, and evidence records.
Asset inventory, threats, vulnerabilities, risk calculation, and treatment plan.
Define applicable controls, exclusions, justification, and control ownership.
Internal audit, certification body preparation, stage 1/2 support, and surveillance readiness.
The Privacy Act has been law since 2018. The IT Bill is coming. Enforcement is increasing. Don't wait for a breach - or a complaint - to act.
Article 28 of Nepal's Constitution protects privacy. The Privacy Act 2075 applies to organizations handling personal information and requires consent, purpose limitation, reasonable security, and authorized handling. Penalties can reach 3 years imprisonment and NPR 30,000 fine.
The pending IT and Cybersecurity Bill 2082 is expected to replace ETA 2063 and includes new requirements such as Clause 61's 35-day destruction rule after purpose is fulfilled. Organizations that prepare now will adapt faster.
Nepal has no dedicated data protection regulator, but complaints still move through courts and sectoral regulators. With cybercrime complaints rising from 4,154 to 7,740 in one year, victims are filing more cases.
NRB IT Guidelines 2012, NTA IT Policy 2080, healthcare confidentiality duties, and e-commerce obligations create sector-specific expectations beyond generic IT security.
| Before (No Security / Minimal Controls) | After (Proper Security + Compliance) |
|---|---|
| No data inventory | Personal information documented, classified, and mapped |
| Copied or missing privacy policy | Privacy Act 2075-compliant privacy policy |
| Consent assumed verbally | Consent captured with timestamp, purpose, and scope |
| Employees access data they do not need | Role-based access control and MFA for privileged access |
| Data unencrypted | Encryption at rest and in transit |
| No breach response plan | Documented and tested incident response plan |
| No employee training | Nepali/English training plus phishing simulations |
| No vulnerability scanning | Regular scans and prioritized patching |
| No incident monitoring | SIEM monitoring and alert escalation |
| Privacy Act exposure unmanaged | Documented compliance evidence and remediation roadmap |
| NRB/NTA/healthcare gaps discovered late | Sectoral audit readiness and evidence prepared |
| ISO 27001 not considered | ISO 27001 gap assessment and ISMS roadmap |
We know the Privacy Act 2075, Individual Privacy Regulation 2077, Penal Code 2074, ETA 2063, pending IT and Cybersecurity Bill 2082, NRB IT Guidelines, NTA IT Policy, and healthcare data concerns.
We start by understanding your data, controls, legal exposure, and risk priorities before recommending tools or managed services.
We focus on highest-risk controls first, provide Nepali/English training, and avoid over-engineered security stacks that SMEs cannot maintain.
Policies alone fail. Firewalls alone fail. We combine compliance documentation, technical controls, breach response, and employee training.
Phased approach from assessment to compliance to ongoing operations.
Assess data inventory, current controls, Privacy Act 2075 gaps, sectoral obligations, breach readiness, backups, and basic vulnerabilities. Output: risk-rated Security & Compliance Report.
Build data inventory, Privacy Act-compliant privacy policy, consent records, Section 28 rectification process, employee obligations training, and audit-ready compliance documentation.
Implement encryption, IAM, MFA, least privilege, endpoint security, vulnerability scanning, backup and recovery, and data loss prevention where the risk and budget justify it.
Create incident response plan, roles, communication templates, forensic preservation steps, tabletop exercise, voluntary disclosure framework, and post-breach remediation process.
Train employees in Nepali and English on phishing, password security, data handling, Privacy Act obligations, incident reporting, and role-specific security responsibilities.
For managed clients: SIEM monitoring, threat detection, vulnerability scans, patch support, quarterly phishing simulations, compliance review, and incident response support.
Professional service pricing. Technology costs such as firewalls, SIEM, EDR, or DLP licenses are estimated separately when applicable.
Privacy Act documentation, data inventory, access review, NRB IT audit evidence, incident response plan, employee training, and board-ready risk report.
Customer data inventory, privacy policy, consent mechanism, role-based access, database encryption plan, breach response workflow, and phishing training.
Patient confidentiality policy, PHI access controls, consent documentation, health data retention review, staff training, and breach response preparation.
Purba Tech Labs provides cybersecurity services Nepal, data protection Nepal, Privacy Act 2075 compliance, information security Nepal, security assessment Nepal, incident response Nepal, ISO 27001 Nepal, vulnerability assessment Nepal, penetration testing Nepal, cloud security Nepal, employee security training, and managed security services for organizations across Nepal. Whether you are a financial institution in Kathmandu, healthcare provider in Pokhara, e-commerce business in Biratnagar, telecom/ISP in Nepalgunj, school in Dharan, cooperative in Damak, NGO in Lalitpur, or public-sector organization in Dhangadhi, we design practical security and compliance programs for your regulatory context.
Security assessment one-time NPR 50,000-1,50,000, Privacy Act Compliance Package NPR 1,00,000-2,50,000, managed security services NPR 20,000-80,000+/month depending on environment size, and penetration testing NPR 50,000-1,50,000 per test. Free security assessment ma exact cost estimate ra compliance roadmap paaincha.
The Privacy Act 2075 requires informed consent before collecting personal information, limited collection for a stated purpose, use only for the consented purpose, reasonable security measures, handling only by authorized persons, and rectification process under Section 28. Penalties can reach 3 years imprisonment and NPR 30,000 fine.
The Privacy Act 2075 is Nepal's principal data protection law for collection, storage, processing, and disclosure of personal information. The IT and Cybersecurity Bill 2082 is intended to replace the Electronic Transactions Act 2063 and includes new requirements such as a 35-day data destruction rule after the purpose is fulfilled.
No. Nepal currently has no dedicated data protection regulator. Privacy Act enforcement runs through courts, while sectoral regulators such as NRB and NTA enforce their own rules for banking and telecom. Lack of a single regulator does not remove legal exposure.
Cybercrime complaints in Nepal surged from 4,154 in FY 2023/24 to 7,740 in FY 2024/25, and 5,498 complaints were reported in the first 10 months of FY 2025/26. Financial fraud, fake accounts, bullying, harassment, phishing, social media hacking, and payment scams are common reported categories.
ISO 27001 is not legally required for most Nepal organizations, but it is useful for regulated sectors, enterprise clients, government tenders, outsourcing, and partner trust. We support readiness through gap assessment, ISMS implementation, risk assessment, internal audit, and certification support.
BFIs must consider NRB IT Guidelines 2012 covering confidentiality, integrity, availability, IT audit, incident reporting, backup, and business continuity. Telecom/ISP organizations follow NTA IT Policy 2080. Healthcare providers must protect patient confidentiality under health-sector laws and professional ethics.
Contain the incident, revoke compromised access, preserve logs and evidence, assess scope, notify leadership, consider voluntary disclosure where trust or sectoral rules require it, file a complaint if criminal activity is involved, and remediate root causes. A prepared incident response plan makes this faster and cleaner.
Create an intake channel, verify the requester, check supporting evidence, correct inaccurate personal information within a reasonable time, confirm the action to the data subject, and keep a documented record of the request and response.
Fill the form or WhatsApp us. We schedule a free security assessment, review your data handling, current controls, regulatory obligations, incident readiness, and budget, then provide a prioritized Security & Compliance Report.
Yes. Human error through phishing, weak passwords, and poor data handling is one of the biggest breach drivers. Training also supports Privacy Act compliance because employees need to understand authorized handling, consent, purpose limitation, and incident reporting.
Clause 61 of the pending IT and Cybersecurity Bill 2082 requires entities to destroy data within 35 days after the purpose is fulfilled. It is not yet the current Privacy Act rule, but organizations should prepare with retention schedules and secure disposal processes.
Whether you need Privacy Act compliance, NRB IT audit readiness, breach response planning, or ongoing security monitoring - start with a free security assessment.