Nepal's technology sector has moved from a quiet corner of the economy to one of its most actively courted destinations for foreign capital. With the country set to graduate from Least Developed Country status in late 2026, IT service exports crossing roughly USD 1 billion in 2025, and the government easing entry rules specifically for the IT sector, more foreign investors and technology companies are looking seriously at Nepal as a market and as a base of operations.

But market entry is only half the picture. A foreign company setting up in Nepal has to clear two separate legal tracks at once: the investment approval process that allows foreign capital and ownership in the first place and the data protection and privacy obligations that come with operating a digital platform handling Nepali users' information. Getting one right and overlooking the other is a common and costly mistake. This guide walks through both.

Why Tech Companies Are Looking at Nepal

The Government of Nepal has made a deliberate policy choice to treat IT differently from most other sectors. While most industries face a minimum foreign investment threshold, the IT sector has had that minimum removed entirely for companies entering through the automatic approval route, and the automatic route itself has been progressively widened to cover larger investment amounts without requiring full investment board review. Combined with a young, English-proficient workforce and growing outsourcing and BPO demand, this has made Nepal an increasingly attractive option for technology investment, even as the broader investment climate continues to mature.

Key Legal Framework Governing Foreign Investment

1. Foreign Investment and Technology Transfer Act, 2075 (2019) ("FITTA")

FITTA is the primary law governing foreign direct investment in Nepal. It sets out:

• The minimum investment threshold (currently NPR 20 million for most sectors, with this requirement removed for qualifying IT industries)

• The automatic approval route for investments up to a prescribed ceiling, processed without full Investment Board review

• The "negative list" of sectors closed or restricted to foreign investment

• Investor protections, including repatriation rights for profits, dividends, and proceeds from share sales

• The Department of Industry's role for investments below NPR 6 billion, and Investment Board Nepal's role above that threshold

FITTA was further amended in 2081 (2025) through legislation aimed at improving the broader investment and business environment, and the government periodically issues fresh notifications adjusting thresholds and sector classifications. Because of this, investors should always confirm the currently applicable threshold and negative list before structuring an investment, rather than relying on a figure from a prior fiscal year.

2. Industrial Enterprises Act, 2076 (2020)

Governs industry registration and classification, which determines licensing requirements, incentive eligibility, and applicable compliance obligations.

3. Companies Act, 2063 (2006)

Governs company incorporation, corporate governance, shareholder rights, and the structure of the Nepali entity through which the foreign investment will operate.

4. Foreign Exchange (Regulation) Act and Nepal Rastra Bank Bylaws

NRB approval and registration are required to bring investment capital into Nepal through proper banking channels and to support eventual repatriation. NRB has recently moved to simplify some of these procedures, including easing rules around repatriation approval, but foreign currency inflows and outflows still need to be properly documented and routed through authorized channels.

Step-by-Step: Setting Up a Tech Company in Nepal as a Foreign Investor

1. Confirm sector eligibility. Check the current negative list to confirm the proposed business activity is open to foreign investment.

2. Apply for foreign investment approval. Depending on the investment size, this is processed by the Department of Industry (below NPR 6 billion) or Investment Board Nepal (above that threshold). Qualifying IT investments below the automatic-route ceiling can proceed without the minimum capital requirement that applies to other sectors.

3. Register the company with the Office of the Company Registrar under the Companies Act, 2063.

4. Obtain industry registration under the Industrial Enterprises Act, 2076.

5. Register for PAN/VAT with the Inland Revenue Department.

6. Bring in capital through proper banking channels and complete NRB registration of the foreign investment.

7. Commence operations within the prescribed timeline, and apply for an extension in advance if operations cannot begin within one year of registration.

8. File annual industry operation reports and maintain ongoing compliance once operational.

Data Protection: The Compliance Layer Many Investors Miss

A foreign tech company doesn't just need permission to invest in Nepal — once it starts handling the personal data of Nepali users, customers, or employees, it takes on data protection obligations regardless of where the company itself is headquartered.

The current legal position rests primarily on:

• Article 28 of the Constitution of Nepal, which guarantees the right to privacy as a fundamental right

• The Privacy Act, 2075 (2018) and Privacy Regulation, 2077, which require that personal information be collected only with proper authorization, that individuals be informed of the purpose of collection, and that certain categories of personal information not be disclosed or transferred without consent

• The Electronic Transaction Act, 2063 (2008), which addresses unauthorized access to computer systems and electronic data

• The National Penal Code, 2074, which criminalizes breach of privacy through electronic means

Nepal does not yet have a single, consolidated data protection statute comparable to the GDPR, and there is presently no dedicated, independent data protection authority—enforcement currently runs through a combination of the Ministry of Communication and Information Technology, the Nepal Police Cyber Bureau, and the courts. This is an actively evolving area: new legislation addressing digital privacy, cybersecurity, and data governance has been under active legislative consideration, and the rules a company is building toward today may shift before it goes live. We would advise any company entering this space to build its compliance program against the strictest reasonable interpretation of current and proposed rules, rather than the minimum required under presently enforced law.

Practical steps we recommend to incoming tech companies:

• Obtain clear, informed consent before collecting personal data from Nepali users, and disclose the purpose of collection upfront

• Limit data collection to what is genuinely necessary for the service provided

• Document data processing activities and retention periods

• Put in place secure storage and access controls, particularly for any sensitive personal data

• Have a clear protocol for responding to data breaches, including timely notification

• Build contracts with local partners, vendors, and processors that clearly allocate data protection responsibilities

• Monitor regulatory developments closely, given the pace of change in this area

Frequently Asked Questions

1. Does Nepal have a minimum investment requirement for IT companies?

Most sectors face a minimum foreign investment threshold, but qualifying IT industries have had this requirement removed for investments made through the automatic approval route. Investors should confirm current eligibility criteria before proceeding, as classifications are periodically updated.

2. Can profits be repatriated out of Nepal?

Yes. FITTA guarantees repatriation rights for profits, dividends, proceeds from the sale of shares, and technology transfer payments, subject to proper documentation and NRB procedures, which have recently been simplified in several respects.

3. Do foreign companies need to comply with Nepal's data protection rules even without a physical office in Nepal?

This is genuinely unsettled under current law. Nepal's existing privacy framework was drafted with domestically registered entities primarily in mind, and its application to foreign companies with no local presence remains legally ambiguous. Given the direction of pending legislation, foreign platforms serving Nepali users would be well advised to assume eventual applicability and plan accordingly.

4. What happens if a company collects personal data without proper consent?

Under current law, unauthorized collection or disclosure of personal information can expose a company and, in some circumstances, its officers to both civil liability and criminal penalties, including fines and imprisonment under the Privacy Act and related criminal provisions.

5. Who approves a foreign investment — the Department of Industry or the Investment Board?

This depends on investment size. The Department of Industry handles most applications below NPR 6 billion. Investment Board Nepal handles larger investments above that threshold, generally under a more involved review process.

6. How long does foreign investment approval take?

FITTA mandates that foreign investment applications be processed within seven days of a complete application, though in practice, timelines can extend where documentation is incomplete or additional verification is required.

Building Your Compliance Strategy Before You Launch

Foreign investment law and data protection law intersect at exactly the point where many companies stumble: structuring the investment correctly gets a company into Nepal, but data protection obligations determine whether it can operate there safely and sustainably. Companies that build both into their market entry strategy from the outset, rather than treating data protection as an afterthought, are better positioned as Nepal's regulatory framework in this area continues to develop.

If you are evaluating market entry into Nepal's technology sector or already operate in Nepal and need to assess your current data protection exposure, professional legal guidance can help you structure the investment correctly, build a compliant data handling framework, and stay ahead of a regulatory landscape that is still taking shape.

This article is for general informational purposes only and does not constitute legal advice. Foreign investment thresholds, sector classifications, and data protection requirements in Nepal are subject to periodic government notification and legislative change. Readers should seek current, matter-specific legal advice before acting on any information above.

CONTACT VIDHIJNYA LAWYERS