Data Centre and Cloud Services Directive in Nepal / Key Regulations 2025

The Data Centre and Cloud Services (Operation and Management) Directive 2081 (the “Directive’’) is issued by the Government of Nepal, Ministry of Communication and Information Technology, under Section 79 of the Electronic Transactions Act, 2063. The Directive was issued on 10 February 2025.

1. Listing with the Department of Information and Technology (the “Department”)

1. The Directive mandates that Data Centers and Cloud Service Providers (the “Service Providers”) must be registered with the Department of Information and Technology before offering their services.
2. The Directive defines Cloud Services as refers to the integrated technology that enables the hosting of information processing systems developed by government, public, and private sectors using data center services or other sources, incorporating both hardware and software. Likewise, the Data center has been defined as a facility that includes the necessary infrastructure to store and operate data and information technology systems developed by government, public, and private sectors
3. The Company/Firm (Organization) that want to operate or provide services as Service Providers must be listed in the Department. In order to list in the Department, the concerned company/firms need apply (in the prescribed format) to the Department along with the following details:

• Certificate of Incorporation of Company/Firm
• Security and Privacy Policy of the Organization
• Documents related to Business Continuity Plan
• Details of IP Pool available in your name

4. Service Providers currently in operation must submit an application to the Department with the required documents (provided above) within six months of issuance of this Directive’s initiation. Additionally, Data Center Operators must provide certificate related to Information Security Related Standard for both DC and DR and Cloud Service operators must provide certificate related to Information Security Related Standard and Information Technology Service Management Standard.
5. During the examination and inspection of applications, the Department may request additional documents from Service Providers. It is the responsibility of Service Providers to provide the required documents. If the necessary procedures are completed following the inspection, the Department may list the Data Center and Cloud Services within one month. Note: Service Providers operating both Data Center and Cloud Services must apply for separate listings.
6. Service Providers must update their details in the means as prescribed by the Department every year at the end of Month of Poush (Mid-January).

2.Removal from Listing of the Department 

1.  Service Providers listed by the Department may be removed in the following cases:
   1. Non-compliance with the Directive’s rules
   2. Misuse of data stored in the Data Center or Cloud Service Center
   3. Dissolution of the Company/Firm
   4. Request for cancellation of registration by the Service Providers.
2. The Service Provider will be given 15 days to submit their justification before removal from the list. The Department will investigate the response. If no justification is received, or if the investigation of the justification deems removal necessary, the Department will remove the provider from the list within 7 days. If the Data Center or Cloud Service provider applies for cancellation of registration, the Department may remove it after completing the necessary procedures. The Department will publish the details of removed providers in a national newspaper and on its website.

3. Tier Rating of Data Center

1. Data Centers will receive a “Tier Rating” based on their physical infrastructure and services, categorized as:

2. The Data Center Service Provider must submit the tier rating certificate to the Department within one year of listing. Further, any Data Center storing governmental data must have at least 3 tier rating or above.

4. Compliance Requirements for Service Providers

1. Service Providers must offer equal access opportunities to all
2. Must adopt necessary security standards for data storage in the data center and cloud.
3. Must implement security measures to protect customer data and prevent unauthorized access.
4. Should ensure service continuity.
5. In case of unauthorized access, despite adequate security, it must be reported to the regulatory body immediately, and actions should be taken to eliminate the breach.
6. Must appoint a Compliance Officer or obtain services from an organization to ensure compliance with international standards
7. Must submit the requested details to the Department within the specified time
8. A security audit of their infrastructure must be conducted at least annually.
9. When operating a system through cloud services, the security and backup of the system and data should be outlined in a bilateral agreement.
10. Must follow instructions received from the Department and law enforcement agencies.
11. If an entity/person wishes to remove infrastructure or transfer hosted systems to another location, necessary assistance must be provided.
12. If terminated under prevailing laws or if a transfer is requested, secure transfer must be ensured.
13. In addition to the responsibilities and obligations outlined in the Directive service providers must manage the following aspects as necessary:
    

    Provision of suitable server racks for server placement,  Availability of network equipment such as Firewalls, Routers, Switches,  Availability of servers and storage devices for data storage, Proper arrangement for HVAC (Heat, Ventilation, and Air Conditioning), Adequate provision for fire safety, including Fire Extinguishers,  Arrangement for adequate and regular availability of Internet and electricity, Availability of an IP pool in the name of the data center operator, Availability of required technical personnel, Provision of an Access Control System at the location of the data center servers,  Arrangement of personnel related to the physical security of the data center. Proper arrangement of Closed-Circuit Television (CCTV) in the data center, along with a system for monitoring data center infrastructure. A provision for a Network Operation Center (NOC) to regularly monitor network equipment such as Firewalls, Routers, and Switches. Proper arrangement of security devices as needed to ensure the security of the data stored in the data center. Provisions for server colocation for clients for data storage. Arrangements for regular backup of the stored data. The technical staff must have certification or experience in the relevant subject matter. Must be a system in place to allow only authorized personnel to access the server location.  Must be a system to maintain a record of visitors who visit the data center. Must be a system in place to store Closed-Circuit Television (CCTV) data for at least three months.  If hard disks need to be destroyed, there must be arrangements to ensure that the data cannot be recovered.