Nepal is digitizing at breakneck speed. Mobile banking users have tripled in five years. Government services from land registration to social security distribution are moving online. Ride-hailing apps, e-commerce platforms, and social media now intermediate daily life for millions. Yet there is no comprehensive data protection law governing how personal information is collected, stored, shared, or sold. Citizens are essentially walking into a digital economy naked.

The risks are not hypothetical. Banks and telecom companies routinely share customer data with third-party marketers without consent. Political parties have been accused of using voter databases for targeted messaging outside election periods. The government's own digital identity project, while promising efficiency, collects biometric and demographic data with minimal transparency about who has access, how long the data is retained, or what happens in the event of a breach.

Other countries in South Asia have moved ahead. India enacted its Digital Personal Data Protection Act. Sri Lanka has drafted comprehensive privacy legislation. Nepal's Right to Privacy is enshrined in Article 28 of the constitution, but without enabling legislation, it remains an abstract guarantee. The proposed Information Technology Bill touches on data issues but treats privacy as an afterthought rather than a fundamental right deserving dedicated, robust protection.

Nepal should enact a standalone privacy law that establishes clear consent requirements, limits data collection to what is necessary, creates an independent data protection authority with enforcement teeth, and imposes meaningful penalties for violations. In the digital age, privacy is not a privilege for the tech-savvy — it is a right that every citizen deserves, whether they are a software developer in Kathmandu or a farmer in Jumla accessing services through a basic smartphone.