Nepal Supreme Court Orders Data Protection Law and Ends Sole Reliance on National ID for Banking

Privacy ruling reaches a database holding millions of identities

Nepal's Supreme Court has ordered the government to pursue a dedicated data protection law and struck down a central bank requirement making the National Identity Card, or its number, the sole basis for identifying banking customers. The decision affects a system that has collected personal details from more than 20.7 million citizens through 539 collection centres.

The October 9 ruling, delivered by Justices Sapana Pradhan Malla and Meghraj Pokharel, requires banks to accept citizenship certificates and other identity documents until customers obtain a National Identity Card or number. Citizens must not lose access to banking because they lack the document.

The judges also called for an independent regulator to monitor the use of personal data, hear complaints and take action against violations. Banks checking identities should receive a yes or no answer rather than broad access to the fingerprints and other sensitive records held in the national system.

The judgment connects two practical problems: people being unable to use their accounts, and the government expanding a database containing biological identifiers before establishing a comprehensive law governing their use. Its immediate effect concerns banking access, while its legislative direction reaches the protection of personal data more widely.

What changes for bank customers?

Advocate Sarita Adhikari brought the case after a bank sought her National Identity Card number rather than accepting her citizenship certificate to update her customer information. Her petition challenged requirements linking banking services to verification through the national identity database.

Nepal Rastra Bank's June directive covered opening accounts and updating know your customer details, commonly called KYC. KYC is the process banks use to confirm a customer's identity and keep identifying information current. The challenge also concerned requirements affecting changes to customers' registered mobile numbers.

The court invalidated the provision of Integrated Directive 2082, identified as E.P. Directive No. 19. 082, insofar as it made the National Identity Card or number the only acceptable basis for identification. Banks must provide services using citizenship certificates and other identity documents while customers await an NID or number.

The judges distinguished citizenship from the newer service identification system. A citizenship certificate establishes a person's citizenship, while the National Identity Card was developed as a means of identifying people when delivering services. The court said administrative delays in issuing the newer document should not cost citizens access to those services.

Why the court wants an act of Parliament

Article 28 of Nepal's Constitution protects privacy. Adhikari argued that access to biometric records without clear rules governing use, retention and consent put that right at risk.

The government defended its existing arrangements under the National Identity Card and Registration Act. It pointed to a committee chaired by the home secretary and security standards for the identity management system. Those standards are identified as Security Standards 2082, also described as the National Identity Management Information System Security Standards, 2025.

The Supreme Court bench said executive safeguards could not substitute for legislation. Explaining the legal protection required, the judges stated:

Here, 'law' means an act enacted by Parliament, not a directive, circular, or standard issued by an executive or administrative body,

A directive tells officials or institutions how to act within their responsibilities. An act of Parliament can establish binding rights, duties and remedies across the organisations handling people's information. The court wants that broader legal structure rather than leaving protection to administrative instructions.

The proposed Data Protection Act would define why information may be collected, limit its use, set out citizens' rights and establish oversight. It would also provide penalties, fines, compensation and legal remedies when those rules are broken.

How a yes or no identity check would work

Fingerprints and eye biometrics are especially sensitive because people cannot replace them as they would a password. The judges warned that compromised biological identifiers could cause lasting harm to individuals and create risks for national security.

The court also identified the possibility that commercial institutions could use information gathered for one purpose for another. Its proposed answer is to restrict what an organisation receives when checking identity.

A bank could submit an identity verification request and receive confirmation that the details match, without receiving the underlying biometric record. The useful result is the answer to the identity check, rather than a copy of the sensitive information used to produce it.

Encryption and tokenization were identified as possible tools for this approach. Encryption makes information unreadable without the appropriate key. Tokenization substitutes a reference value for sensitive information, allowing a system to work with that reference instead of exposing the original record. The court's central requirement concerns the limited response given to the organisation requesting verification.

Nirajan Shrestha, director and information officer at the Department of National Identity Card and Registration, said banks had not yet been given access to the national identity data. He said the department had asked banks to record identity numbers and was working with Nepal Rastra Bank on infrastructure to verify them.

An independent regulator would hear complaints

The proposed regulator would monitor data protection, receive complaints and take action. That would give citizens somewhere to challenge the handling of their information beyond the organisations collecting or using it.

The existing committee sits under the leadership of the home secretary. The court's call for an independent authority places separate scrutiny alongside the government's responsibility for operating the identity system.

The requested law would connect that scrutiny to consequences. A citizen whose information was misused would need a route to seek a remedy, while organisations would need clear limits on their conduct and defined penalties for violations.

The court directed the Office of the Prime Minister and Council of Ministers, the Home Ministry and other defendants to proceed with legislation. Nepal Investment Mega Bank Limited was also named among the defendants in Adhikari's petition.

Millions have numbers, far fewer have cards

Department figures show the scale of both enrolment and the remaining distribution work. More than 20 million people had received national identity numbers, 7.8 million cards had been printed and 4 million had reached citizens.

The 4 million delivered cards amount to about 51 percent of the 7.8 million printed. The difference is approximately 3.8 million cards. That gap makes alternative identification practically important, although some banking requirements accepted an identity number rather than demanding the physical card.

Nepal Rastra Bank spokesperson Guruprasad Paudel said banks and financial institutions held more than 63 million accounts. Customers can hold multiple accounts, so the figure describes the volume of accounts across the banking system rather than a count of individual customers.

Paudel said banks already collected extensive identifying information, including citizenship documents and personal details. He described the planned connection as a way to check information rather than an attempt to give banks all the records in the national identity database. He also supported suitable legal arrangements to protect data.

The government has continued investing in the identity infrastructure. In June, the Cabinet approved the purchase of 10 million biometric matching licences from IN Groupe. Matching software helps a system compare biometric records when checking identities.

How the requirements developed

The banking dispute follows a broader effort to connect public services to a single national identity system. Officials said the NID had already been linked to 13 bodies, including services involving banking and passports.

The main steps described in the proceedings and subsequent official explanations were:

• Asar 2081: The government published a gazette notice introducing National Identity Card requirements for banking, social security and other services according to a geographical timetable.
• June: Nepal Rastra Bank issued banking identification requirements involving the NID or its number and verification against electronic records.
• June 8: Adhikari filed her petition challenging the restrictions and the protection of personal information.
• October 9: The Supreme Court struck down sole reliance on the NID for banking identification and directed the government to pursue a dedicated data protection law.
• December 16: A separate health insurance requirement is scheduled to apply to citizens aged 16 and older seeking to enrol, renew or access services.

The gazette arrangements included exemptions for children, people unable to care for themselves, people who were helpless or incapacitated, and citizens older than 90. Overseas Nepalis could open accounts with other identification, but were required to update their NID details within 35 days of returning to Nepal.

An earlier plan to require the card for phased social security allowance renewals was postponed after opposition. The banking judgment gives another concrete example of the tension between expanding digital identification and keeping services accessible during that expansion.

Other services face a legal review

The Health Insurance Board's December 16 requirement brings the privacy issue into another service used by households. Its rule covers citizens aged 16 and older enrolling in, renewing or accessing the health insurance programme.

Paudel said officials needed to clarify whether the judgment affected every service covered by the gazette notice or only banks and financial institutions. Shrestha said the department would seek legal advice and follow the resulting government decision. The wider scope of implementation therefore awaits clarification, and no specific date for passing the new data protection law was given.

Nepal has also asked India to recognise its National Identity Card on a basis comparable to Nepali citizenship documentation. The two countries had not reached a conclusion on that request. Within Nepal, the court has already drawn a firm line: expanding use of the identity system must be accompanied by legal protection and continued access to banking for people awaiting identification.

The practical tasks now sit with several institutions. Banks must accept alternative documents as directed, the government must develop legislation, and Parliament must consider the legal framework. Verification infrastructure must also reflect the court's requirement to limit the information released to organisations checking identity.

Key Points

• The Supreme Court's October 9 ruling ended sole reliance on the National Identity Card or number for banking identification.
• Banks must accept citizenship certificates and other identity documents until customers obtain an NID or number.
• The court called for a data protection act approved by Parliament and an independent regulator.
• Identity verification should return a yes or no answer rather than expose biometric records.
• The identity programme has collected details from more than 20.7 million citizens; officials said 7.8 million cards had been printed and 4 million delivered.
• Officials are reviewing how the judgment affects requirements beyond banking, including the broader expansion of NID use.