Electronic Transactions Act, 2063 (Sec. 44–46)
Source-code piracy, unauthorised access (hacking) and system damage: up to 3 years imprisonment and NPR 200,000 fine each.
Up to 3 yrs + NPR 200,000 per count
Overview
Over 80% of complaints to the Nepal Police Cyber Bureau concern social-media offences and online financial fraud — hacked accounts, OTP and wallet fraud, sextortion, revenge pornography, defamation and blackmail. The Electronic Transactions Act, 2063 (ETA) remains the controlling statute, with the Penal Code's privacy and defamation chapters and the Banking Offence Act running alongside for fraud cases.
Digital cases are won on preservation: URLs with timestamps, chat logs with metadata, transaction IDs and call records. Delete the originals and the case often dies with them. We guide victims from the first screenshot to the charge sheet — and defend the accused where speech, mistake or mistaken identity is the real story.
Legal framework
The Nepalese laws that govern this area — what each one does in your matter.
ETA Sec. 47
Publication of illegal electronic material (obscene, hateful, defamatory): up to 5 years and NPR 100,000. The most-prosecuted — and most-misused — cyber provision; the Supreme Court has restrained its use against legitimate speech.
Up to 5 yrs + NPR 100,000
ETA Sec. 48–52
Breach of confidentiality (2 years), false digital-signature statements (2 years), computer fraud including OTP/wallet fraud (2 years + NPR 100,000), abetment (6 months).
Fraud: 2 yrs + NPR 100,000
ETA procedure
Complaint to the Cyber Bureau within 35 days of knowledge; Kathmandu District Court is the designated trial court; extraterritorial reach over acts abroad affecting Nepali systems.
35-day clock — act fast
Parallel laws
Penal Code privacy and defamation (Sec. 293–298, 306–307, with extra penalty for electronic defamation), Individual Privacy Act 2075, Children's Act 2075 for minors, Banking Offence Act for e-fraud.
E-defamation uplift: +1 yr / +NPR 10,000
How we handle it
Preserve everything
We lock down URLs, screenshots with metadata, device logs, transaction IDs and CDRs before anything is deleted or overwritten.
Cyber Bureau complaint
A technically precise first-information report within the 35-day window, with citizenship copy and an affidavit of facts.
Investigation support
Liaison with investigators on IP/device tracing, platform requests and forensic imaging of devices.
Trial & compensation
Kathmandu District Court trial with parallel claims for compensation for loss caused by the offence.
Defence where accused
Challenging attribution (shared devices, spoofed accounts), Section 47 overreach, and negotiating compounding where available.
Punishments at stake
ETA penalties run from 6 months (abetment) to 5 years plus NPR 100,000 (illegal publication), with hacking at 3 years plus NPR 200,000 — stackable where one act breaches several sections, plus compensation to the victim.
Common questions
My Facebook was hacked and money demanded. What now?
Do not delete anything. Screenshot chats with visible URLs and timestamps, note transaction IDs, and file with the Cyber Bureau within 35 days of learning of it. Then change passwords from a clean device.
Can a Facebook post really be a crime?
Yes — a post falsely alleging criminal or shameful conduct, or spreading caste/religious hatred, can be prosecuted under ETA Section 47 (up to 5 years) alongside Penal Code defamation. But legitimate criticism is protected, and courts have pushed back on misuse.
Someone posted my private photos. Is that covered?
Yes — publication of illegal material (Sec. 47), privacy violations under the Penal Code and Individual Privacy Act, and child-protection provisions if a minor is involved. Act within 35 days and preserve the originals.
General legal information for public awareness — not legal advice for your specific situation. Consult an advocate →