Data Centers and Cloud Service Company Registration in Nepal

The registration of the Data Centers and Cloud Service is primarily governed by the Data Center and Cloud Service (Operation and Management) Directives, 2025 (2081) (hereinafter referred to as “Directive”) which was issued by the Ministry of Communication and Information Technology (hereinafter referred to as “Ministry”) on 28th January, 2025.

 

The directive was enacted under Section 79 of Electronic Transaction Act, 2006 A.D and aims to mandate registration and provides operational guidelines along with the security standards to establish secure and reliable data management entities for private, public and government sectors.

 

Other relevant laws that guide the registration of the Data Center and Cloud Service are as follows:

a. Companies Act, 2006 (2063)

b. Telecommunications Act, 1997 (2053)

c. Electronic Transaction Act, 2006 (2063)

d. Information Technology Policy, 2015 (2072)

e. National Cybersecurity Policy, 2021 (2078)

 

 

The Department of Information Technology (hereinafter referred to as “Department”) under the Ministry of Communication and Information Technology has the authority for the registration and regulation of the Data Centers and Cloud Service providers.

 

 

The Directive has defined certain terminology which are as follows: 

• Data: Data is any information, knowledge, concept or instruction that are produced by computers, computers systems and computer networks which includes any text, number, images, audio, animation or audiovisual.
• Data Center: A facility equipped with computer systems, telecommunications and storage systems to organize, process, store and disseminate large amount of data developed for government, public and private sectors.
• Cloud Service: Infrastructure both hardware and software developed for the hosting of the information processing system utilizing data center service or other sources for government, public, and private sectors. 
• Service Provider: Those entity that operates and manages the data center and cloud services.

 

For the registration of the Data Centers and Cloud Service in Nepal following step has to be followed: 

 

Step 1: Registration of the Company at Office of the Company Registrar

Step 2: Registration of Business at ward office 

Step 3: Tax Registration at Inland Revenue Department

Step 4: Injecting the Investment amount and receiving the Share Registry        

Step 5: Industry Registration 

Step 6: Submission of application before the Department of Information and Technology 

Step 7: Department of Information and technology shall provide the certificate upon inspection

 

 

The entire process of the registration of the Data Center and Cloud Center for a Nepalese Investor may take 45 to 60 days.

 

 

 

For the registration of the Data Centers and Cloud Service by a foreign investor in Nepal following step has to be followed: 

 

Step 1: Approval of the Foreign Direct Investment from the Department of Industries

Step 2: Registration of Company at Office of the Company Registrar  

Step 3: Registration of business at Ward Office 

Step 4: Tax Registration at Inland Revenue Department

Step 5: Industry Registration before the Department of Industry

Step 6: Obtaining Non Blacklisted Certificate from Credit Information Bureau

Step 7: Obtaining approval to inject the foreign investment amount from local bank 

Step 8: Submitting statutory notice to Nepal Rastra Bank notifying injection of foreign investment 

Step 9: Injecting investment at local bank account and receiving shareholder registry 

Step 10: Submission of application for registration at Department of Information Technology 

Step 11:Upon Inspection Department of Information Technology shall provide the certificate

 

For detail regarding the opening the local company through Foreign Direct Investment kindly check the following article published by our law firm : 

https://lawbhandari.com/publication/foreign-direct-investment-(fdi)-approval-process-in-nepal

Timeline 

The tentative timeline for overall process of registration of the Data Centers and Cloud Services by Foreign Investor in Nepal shall take 3 to 5 months from the date of application of investment at DOI.

 

 

The directive has provided separate documents list required for the registration of Data Center and Cloud Service before the Department.

 

S.N.	Document Name
a	Certificate of Incorporation of Company/Firm
b	Security and Privacy Policy of the Organization
c	Details relating to the Business Continuity Plan
d	Details of IP Pool available
e	Ensuring Fire Safety
f	Building Completion Certificate
g	Map Location of the Data Center
h	Details regarding the tier of the Data Center
i	Details of Technical manpower involved in Data Center
j	Details of procedures to be followed for the physical security of the Data
k	High level electricity design
l	For the Data Centers in operation: Certificate related to the Information Security Standards for both DC and DR must be submitted within 6 months (until 31st July, 2025) of the enactment of the Directive (28th January, 2025)

 

 

S.N.	Document Name
a	Certificate of the Incorporation of Company/Firm
b	Security and Privacy Policy of the Organization
c	Documents related to the Business Continuity Plan
d	Details of the IP Pool available
e	Details of the Technical manpower involved in the operation of the cloud service
f	Map Location of the Data Center where the cloud service is operated
g	Agreement with the Data Center
h	Details regarding affiliation with ISP/NSP
i	For Cloud Services currently in operation: Certificate related to the Information Security Standards must be submitted within 6 months of listings

 

 

The directive mandates compulsory registration for the Data Centers and Cloud Service providers with the Department of Information and Technology before offering their services. The new provider shall compulsorily register before the Department of Information and Technology

 

. For the service provider in operation the department has provided time until 31st July, 2025 to be registered before the Department.

 

 

The Department of Information and Technology has its own compliance which mainly are:

a. Annual Compliance: The service provider must provide annual security audits and submit annual compliance details to the Department of Information and Technology.

b. Compliance Officers: The service provider shall appoint compliance officer or partner with an authorized institution to adhere with the international standards.

c. Report unauthorized access: In case of unauthorized access, the service provider must report to the authority immediately and take action regarding the breach promptly.

d. Building Secure Infrastructure: The service provider must maintain robust technical infrastructure (server racks, network equipment, servers, storage, and HVAC systems), physical security, fire safety, monitoring infrastructure and network equipment.

 

 

Date of Publication: June 4 , 2025 

 

Disclaimer: . This article published on website of the law firm is just for information purpose only. It shall not be taken as the legal advice, advertisement, personal communication, solicitation or inducement. Bhandari Law and Partners or any of the team members of the firm shall not be liable for the consequence arising of the information provided. As the factual situation may be different on your case, thereof if you need further legal advice on the subject matter, please Contact Us.