Is your data center or cloud service legally registered in Nepal? The operation of data centers and cloud services in Nepal is now regulated by a dedicated directive. Therefore, every operator must be listed with the Department of Information and Technology before services are offered.
The Data Center and Cloud Service (Operation and Management) Directives, 2081 were issued on 10 February 2025. They were enacted under Section 79 of the Electronic Transaction Act, 2063. Meanwhile, a new Information Technology and Cybersecurity Bill has introduced licensing and penalties of up to NPR 500,000. Consequently, compliance is no longer optional — it is a legal obligation.
In this tutorial, the complete regulatory framework will be explained. First, the governing directive will be summarized. Then, registration requirements will be detailed. After that, tier standards, operational obligations, and enforcement risks will be presented in tables. Finally, frequently asked questions will be answered.
Legal Framework for Operation of Data Centers and Cloud Services in Nepal
The operation of data centers and cloud services in Nepal is governed by a layered legal structure. Each layer is explained below.
The Data Center Directives 2081
The Directives were approved by the Ministry of Communication and Information Technology on 10 February 2025. Their purpose is to encourage secure and confidential data storage within Nepal. Furthermore, the reliability of the national information technology system is strengthened through them.
The Electronic Transaction Act 2063
Section 79 of this Act authorized the issuance of the Directives. The same Act also prescribes penalties for unauthorized access and misuse of electronic records.
The Draft IT and Cybersecurity Bill 2080
This Bill was registered in 2025. Under Section 43, a formal license will be mandatory. Operating without one may attract fines of up to NPR 500,000. Moreover, two inspections per year will be conducted by the responsible department.
Supporting Policies
The National Cyber Security Policy, the Individual Privacy Act 2075, and the National Cyber Security Center framework also apply. As a result, data protection obligations are broader than the Directives alone.
Registration and Listing Requirements With DoIT
Before any operation of data centers and cloud services in Nepal begins, listing with the Department of Information Technology is mandatory. Customers are legally required to use only listed providers.
Who Must Register
Any entity providing colocation, hosting, cloud computing, or virtual resource services must register. However, organizations operating data centers purely for internal use are exempt under the draft Bill. Public bodies operating their own data centers must use the Integrated Data Management Center instead, subject to Steering Committee approval for dedicated Primary or Secondary sites.
Registration Deadline for Existing Operators
All operators already in business at the time of commencement were required to apply within six months of 10 February 2025. Therefore, the deadline expired in August 2025. New operators must register before services are launched.
Separate Listing Rule
An entity providing both data center and cloud services must obtain two separate listings. One for each service line. A single combined application is not accepted.
Documents Required for Registration
The document checklist differs between data centers and cloud service providers. Both are provided below.
| Data Center Requirements | Cloud Service Requirements |
|---|---|
| Company/firm registration certificate | Company/firm registration certificate |
| Security and privacy policy | Security and privacy policy |
| Business Continuity Plan | Business Continuity Plan |
| Fire safety assurance | Location map |
| Building completion certificate | Agreement with the data center |
| Location map | ISP/NSP affiliation details |
| Tier rating details | IP pool details in own name |
| Technical manpower details | Information Security Standard certificate |
| Physical security procedures | IT Service Management Standard certificate |
| High-level electrical design | — |
| Information Security Standard certificate (DC and DR) within 6 months | — |
| Lease agreement if premises are rented | — |
Additionally, the Department may request certified copies of further documents during physical inspection. The listing decision is made within one month when all procedures are completed.
Tier Classification Standards for Data Centers
The operation of data centers and cloud services in Nepal is tied to a four-tier classification system. The criteria are shown below.
| Standard | Tier 1 | Tier 2 | Tier 3 | Tier 4 |
|---|---|---|---|---|
| Power/cooling path | Single | Single | 1 active + 1 alternative | Dual active |
| Redundancy | N | N | N+1 | 2(N+1) |
| Annual uptime | 99.671% | 99.749% | 99.982% | 99.995% |
| Max annual downtime | 28.8 hours | 22 hours | 1.6 hours | 26.3 minutes |
| Power backup | 12 hours | 12–24 hours | 24–48 hours | 48+ hours |
Two important rules follow from this table. First, the tier rating certificate must be submitted within one year of listing. Second, any data center storing government data must achieve Tier 3 or above. As a result, government contracts effectively require enterprise-grade infrastructure.
Operational Compliance Obligations
Once listed, continuous obligations apply to the operation of data centers and cloud services in Nepal. The key duties are summarized below.
| Obligation | Frequency / Trigger |
|---|---|
| Annual security audit of infrastructure | At least once yearly |
| Compliance officer appointment (or outsourced) | Continuous |
| Update details with DoIT | By end of Poush (mid-January) annually |
| Security breach reporting to DoIT and National Cyber Security Center | Immediately |
| Bilateral security and backup agreement with cloud customers | Per contract |
| CCTV footage retention | Minimum 3 months |
| Visitor log maintenance | Continuous |
| Network Operations Center operation | Continuous |
| Secure HDD destruction before disposal | Continuous |
| Regular data backups | Continuous |
Furthermore, equal access to services must be provided to all customers. Service continuity must be ensured at all times. Instructions from the Department and law enforcement agencies must be followed. Finally, customers whose provider is removed from the list must migrate their data securely to another listed provider.
Removal From the List and Penalties
Non-compliance carries real consequences. The removal procedure operates as follows.
| Stage | Timeline |
|---|---|
| Written notice and opportunity to clarify | 15 days |
| Department investigation of clarification | After response |
| Removal from the list if non-compliance confirmed | Within 7 days |
| Publication of removal in national daily + DoIT website | Upon removal |
Removal occurs when conditions are violated, data is misused, the company is dissolved, or cancellation is requested voluntarily. Meanwhile, under the draft IT Bill, operating without a license may result in fines of up to NPR 500,000. In addition, the Department will inspect licensed providers at least twice per year once the Bill is enacted.
Cost and Timeline of Compliance
A realistic budget for the operation of data centers and cloud services in Nepal is summarized below.
| Item | Estimated Cost (NPR) | Timeline |
|---|---|---|
| Company registration (if new entity) | 15,000 – 50,000 | 7–10 days |
| ISO 27001 or equivalent certification | 200,000 – 800,000+ | 2–6 months |
| ITSM (ISO 20000) certification | 150,000 – 500,000+ | 2–4 months |
| Tier rating certification | 300,000 – 2,000,000+ | 3–12 months |
| Infrastructure upgrades (fire, CCTV, NOC, access control) | 500,000 – 5,000,000+ | Varies |
| Professional compliance services | 100,000 – 500,000 | — |
| DoIT listing processing | Minimal government fee | Up to 1 month |
Compliance is therefore a significant investment for smaller providers. However, certification and tier ratings also function as competitive advantages in bids for government and banking clients.
Market Opportunities for Data Centers in Nepal
The regulatory burden is matched by genuine opportunity. Government data localization pressures are pushing public bodies toward national data centers. The banking sector is expanding digital services. Similarly, e-commerce, fintech, and outsourcing companies are driving cloud demand.
The Integrated Data Management Center creates structured demand for colocation and cloud hosting. Meanwhile, the mandatory migration of government data centers guarantees long-term contracts for compliant providers. As a result, certified Tier 3+ operators hold a strong market position.
Why Choose Attorney Nepal Pvt Ltd?
The operation of data centers and cloud services in Nepal involves registration, certification, drafting of policies, bilateral agreements, and ongoing compliance reporting. At Attorney Nepal Pvt Ltd, end-to-end regulatory support is provided. DoIT listing applications, security policy drafting, cloud service agreements, and annual compliance calendars are all handled by a dedicated technology law team.
Call to action: Contact Attorney Nepal Pvt Ltd today for a compliance audit of your data center or cloud operation. Registration and certification gaps can be closed before enforcement actions begin.
References
For verification of every provision in this guide, the following official and authoritative sources are linked directly:
- Department of Information Technology, Nepal — registration and listing authority
- Ministry of Communication and Information Technology — directive issuance and policy oversight
- Electronic Transaction Act 2063 official text — underlying legal authority
- National Cyber Security Center — breach reporting and forensic investigation
- Nepal Telecommunications Authority — ISP/NSP regulatory framework
- Uptime Institute Tier Standards — global tier classification methodology
- ISO/IEC 27001 Information Security — international security standard
- New Business Age — IT Bill Analysis — licensing and penalty reporting
Disclaimer
This article is provided for general informational purposes only. The Directives may be amended, and the draft IT and Cybersecurity Bill may be enacted with modified provisions. Therefore, the latest official texts must be verified, and a licensed legal professional should be consulted before the operation of data centers and cloud services in Nepal is commenced or modified. No liability is accepted for actions taken based solely on this content.
Frequently Asked Questions
The Data Center and Cloud Service (Operation and Management) Directives, 2081, issued under Section 79 of the Electronic Transaction Act, 2063, currently govern registration and operation. A formal licensing regime under the draft IT and Cybersecurity Bill will follow.
Any entity offering colocation, hosting, or cloud services to third parties must be listed. Internal-use-only data centers are exempt under the draft Bill.
Existing operators were required to apply for listing within six months of 10 February 2025, meaning by August 2025. New operators must register before commencing services.
Yes, but two separate listings are mandatory. One application must be filed for each service category.
At least Tier 3. The tier rating certificate must be submitted to DoIT within one year of listing.
It must be reported immediately to the Department of Information Technology and the National Cyber Security Center. Corrective action must also be taken to neutralize the unauthorized access.
At least once per year for both data center and cloud service infrastructure.
Under the draft IT and Cybersecurity Bill, fines of up to NPR 500,000 may be imposed. The provider may also be removed from the DoIT list and publicly named.
Yes. CCTV footage must be retained for at least three months, and visitor records must be maintained continuously at the server location.
Data must be secured and migrated to another registered provider immediately. Security incidents should also be reported to the National Cyber Security Center.
This article is for general informational purposes only and does not constitute legal advice. For advice on your specific situation, please contact Attorney Nepal directly.
