Comprehensive Guide to Nepal’s Data Center and Cloud Service Directives, 2081″

Introduction

On 28 January 2025 (2081/10/15), the Ministry of Communication and Information Technology introduced the Data Center and Cloud Service (Operation and Management) Directives, 2081. This law was made under Section 79 of the Electronic Transaction Act, 2006, with the goal of making sure that all data centers and cloud service providers in Nepal operate in a secure, reliable, and well-regulated way.

The Directive applies to private companies, government bodies, and public organizations that store, process, or manage data. It sets out clear rules and standards so that people and businesses can trust the services they use.

Some of the main points of the Directive include:

• Mandatory registration – Any company providing data center or cloud services in Nepal must be officially registered with the Ministry before starting operations.
• Required documents – Service providers need to submit specific paperwork, such as company registration certificates, technical infrastructure details, and security policy documents.
• Tier rating system – Data centers will be classified into different “tiers” based on their capacity, reliability, and technical standards.
• Compliance obligations – Providers must follow safety, security, and data protection measures as set by the Directive.
• Removal from the official list – If a service provider fails to meet the required standards or violates the rules, their registration can be cancelled, and they will be removed from the list of approved service providers.

Basic Terms You Need to Know About Cloud Services and Data Centers

Before we understand the rules and policies, it’s important to know some key terms in simple words: According to section 2 of the Data Center and Cloud Service (Operation and Management) Directives, 2081

• Cloud Services – This means a set of connected technologies that allow storing, managing, and running information systems for the government, public, or private organizations. These services use data centers or other platforms that include both hardware (like servers and storage devices) and software (like programs and operating systems). In simple terms, cloud services help organizations keep and use their data online safely and efficiently.
• Data Centre – A data center is a special building with high-level technology where computers, servers, and networks are kept to store and manage large amounts of data. It is like a “digital warehouse” where information is stored, protected, and made available whenever needed.
• Public Institution – This means organizations that are owned, funded, or run by the government. Examples include government universities, government banks, research centers, and other agencies that serve the public.
• Department – Here, it refers to the Department of Information Technology, which is responsible for managing and regulating technology-related services in Nepal.
• Center – In this context, it means the National Cyber Security Center, which works to protect the country’s information systems and networks from cyber threats.

Registration for Service Providers

In Nepal, all data centers and cloud service providers must be registered with the Department of Information and Technology (DoIT) before they begin their work. This registration is an important legal step that ensures the service provider meets government standards for security, reliability, and proper management of data. Only after getting this approval can they start offering their services to clients.

Documents Needed to Apply for a Data Center License

According to section 3, If an organization wants to set up and run a data center in Nepal, it must submit an application to the Department of Information and Technology (DoIT) along with certain documents. These include:

• Proof of company or firm registration
• Documents showing compliance with fire safety standards
• Building completion certificate
• The organization’s security and privacy policy
• A Business Continuity Plan (to show how services will continue during emergencies)
• A location map of the data center
• Information on the data center’s tier classification
• Details of technical staff and their qualifications
• Physical security measures and procedures
• Ownership details of the IP pool
• Basic electrical design layout
• If the building is rented or leased, a copy of the agreement with the owner

Registration and Compliance Rules for Existing Data Centers and Cloud Service Providers

If you are already running a data center or cloud service when this Directive starts, you have six months to register with the Department. You’ll need to submit certain documents to complete your registration.

• Data Center Operators must show certificates proving they meet the required Information Security Standards for both their main data center and their disaster recovery site.
• Cloud Service Providers must show certificates for:
  • Information Security Standards
  • IT Service Management Standards

If you run both a data center and a cloud service, you must apply separately for each.

The Department might ask for extra documents during the review. It’s the service provider’s job to provide all required papers. Once everything is verified, the Department will list approved services within one month.

According to section 4 of the directive, Every year, by the end of Poush (mid-January), you must update your registration details in the way the Department specifies.

When a Data Center or Cloud Service Provider Can Be Removed from the Official List

According to the Data Center and Cloud Services (Operation and Management) Directive, 2025 (2081)section 5, the Department of Information Technology (DoIT) keeps an official list of all registered data centers and cloud service providers in Nepal.

However, in certain situations, a company can be taken off (delisted) from this list. This usually happens if the service provider no longer meets the rules, standards, or conditions set by the directive. For example, if the provider fails to maintain proper security measures, does not follow technical standards, violates the terms of its registration, or stops operating altogether, DoIT can remove its name from the registry.

The delisting process is not done suddenly — the department usually follows a set procedure. This can include giving the provider a notice, giving them a chance to fix the issues, and then making a final decision if the problems are not resolved. Once a provider is delisted, they are no longer officially recognized and cannot operate legally under the directive.

This rule ensures that only reliable, secure, and compliant service providers continue to operate in Nepal’s data and cloud service industry.

Situations Where a Data Center or Cloud Service Provider Can Lose Its Registration

The Department of Information Technology (DoIT) has the legal authority to remove, or “delist,” a registered data center or cloud service provider if it no longer meets the rules and standards under the Data Center and Cloud Services (Operation and Management) Directive, 2025 (2081).

A provider may face delisting in the following situations:

• Failure to Follow Rules: If the provider does not comply with the terms and conditions of the directive.
• Improper Data Handling: If there is misuse, mishandling, or unauthorized use of stored or processed data.
• Business Closure: If the company is legally dissolved or no longer operates.
• Voluntary Exit: If the provider requests to withdraw its registration.

How the Delisting Process Works
If the Department suspects non-compliance or improper data handling, it will first issue a notice to the provider. The provider then has 15 days to send a written explanation.

• If the explanation is acceptable: The case is closed and no further action is taken.
• If the explanation is missing or inadequate: The Department will launch a detailed investigation.

Once the investigation confirms that delisting is justified, DoIT will complete the removal process within 7 days.

Voluntary Delisting
When a provider wishes to cancel its own registration, it must submit an official application. After verifying all necessary steps are completed, the Department will remove the provider’s name from the registry.

Public Announcement of Delisting
After a provider is removed from the official list — whether by enforcement or voluntarily — the Department will publish the details in a national daily newspaper and on its official website. This ensures that businesses, customers, and the public are aware of the change.

Yearly Renewal of Registration Details
According to the rules in Section 4 of the Directive, every registered data center and cloud service provider must renew and update their information once a year. This update has to be sent to the Department of Information Technology using the method they specify. The deadline for submitting these updates is the last day of Poush each year.

Explanation of Data Center Tiers:

• Tier I: Basic setup with a single power and cooling path, no redundancy. Downtime can be up to 29 hours a year. Backup power lasts about 12 hours.
• Tier II: Some redundant components and backup power lasting 12 to 24 hours. Downtime is around 22 hours a year.
• Tier III: Designed for maintenance without downtime (“concurrently maintainable”). Backup power lasts 24 to 48 hours. Downtime less than 2 hours per year.
• Tier IV: Highest reliability with full fault tolerance and dual power paths. Downtime less than 30 minutes a year, backup power for 48+ hours.

For government data, Tier III or above is usually required to ensure security and continuous availability.

Data Center Tier Summary

Criteria	Tier I	Tier II	Tier III	Tier IV
Power & Cooling Paths	1	1	1 active / 1 alternate	2 active
Redundant Components	No	No	N+1	2(N+1)
Redundancy Backbone	No	No	Yes	Yes
Concurrent Maintenance	No	No	Yes	Yes
Fault Tolerance	No	No	No	Yes
Uptime (Availability)	99.671%	99.749%	99.982%	99.995%
Max Downtime per Year	≤ 28.8 hours	≤ 22 hours	≤ 1.6 hours	≤ 26.3 minutes
Power Backup Duration	12 hours	12–24 hours	24–48 hours	48+ hours
Minimum for Government Data	Not Required	Not Required	Required	Acceptable

Compliance Requirements for Data Center and Cloud Service Providers

To operate properly and ensure safety, data center and cloud service providers must follow important rules and standards. This help protect data, maintain service quality, and comply with legal obligations.

Key Responsibilities of Service Providers:

• Provide fair and equal access to their services for all customers.
• Maintain strong security measures to protect data privacy.
• Prevent unauthorized access and ensure their services run without interruption.
• Quickly report any security breaches and take steps to fix them.
• Appoint a dedicated Compliance Officer or work with a certified partner to oversee these responsibilities.
• Submit all required documents and reports to the Department of Information Technology on time.
• Perform yearly security audits of their infrastructure to check for vulnerabilities.
• Have clear cloud service agreements that include data security and backup policies.
• Follow instructions from regulatory authorities and law enforcement when needed.
• Cooperate in moving or shutting down infrastructure if requested.
• Safely transfer or destroy data when service contracts end.

Infrastructure and Operational Standards:

• Provide necessary equipment such as server racks, storage devices, and space for colocated hardware.
• Maintain essential network devices like firewalls, routers, switches, and manage a dedicated pool of IP addresses.
• Ensure proper cooling (HVAC), fire safety measures, and reliable power and internet connections.
• Use security controls such as access cards, CCTV cameras (keeping footage for at least three months), and visitor logs.
• Employ skilled and certified technical staff to manage operations.
• Restrict access to servers only to authorized personnel.
• Safely destroy hard drives and storage devices to prevent any data recovery after disposal.