Ride-hailing, e-commerce, wallets, ISPs and SaaS companies live inside criminal exposure: user fraud on the platform, data breaches that become ETA Section 45/46 cases, employee misuse of customer data, and intermediary questions when users offend through the service. Nepal's pending IT and Cyber Security Bill will only widen this surface.
We counsel platforms on breach response, Cyber Bureau interfaces, data-protection posture under the Individual Privacy Act 2075, and defence of companies and officers named in computer-offence cases — including the Foodmandu/Vianet-style database-breach precedents.
The Nepalese laws that govern this area — what each one does in your matter.
Hacking (45), system damage (46), illegal publication (47), confidentiality breach (48), computer fraud (51) — with corporate liability and officer exposure, tried at Kathmandu District Court.
Up to 5 yrs + entity & officer liability
Consent, collection and use rules for personal and customer data — the compliance backbone breach cases are judged against.
Wallet, OTP and card fraud on fintech rails, overlapping ETA computer-fraud charges.
Stacked ETA + banking charges
Software and content piracy claims against platforms and developers.
Heightened duties where platforms touch minors — CSAM and exploitation reporting obligations.
Enhanced penalties for child victims
Breach triage
72-hour containment: scope the intrusion, preserve logs, engage forensics — before regulators or police frame it.
Notification strategy
Sequenced user, regulator and Cyber Bureau communications that satisfy duties without volunteering liability.
Complaint & defence
Filing against intruders and fraudsters; defending the platform and officers where the company is accused.
Evidence engineering
Log integrity, access records and chain-of-custody built to courtroom standard from day one.
Hardening & policy
Terms, consent flows, access controls and incident playbooks updated to the lessons of the case.
Punishments at stake
Platform cases stack fast — 3 years for intrusion, 2 more for fraud, corporate fines plus officer terms — but prompt breach discipline and cooperation posture routinely keep companies out of the accused box.
Our user database was breached. Must we report to police?
Strategic reporting usually beats discovery: a well-framed Cyber Bureau complaint positions you as victim, preserves evidence expectations, and starts the limitation clock on your terms.
Can our officers be personally charged for a company data leak?
Yes — the ETA imposes officer liability for corporate computer offences. Counsel-led response and documented compliance are the shields.
Users commit fraud through our platform. Are we liable?
Intermediary exposure turns on knowledge and response: takedown speed, cooperation and prior safeguards. Get advice before the first police letter, not after.
General legal information for public awareness — not legal advice for your specific situation. Consult an advocate →