Act No. 27 of the Year 2063
Date of Authentication and Publication: 22 Mansir 2063 (December 8, 2006)
Preamble
Whereas, it is expedient to provide legal provisions to authenticate and regulate the recognition, validity, integrity, and reliability of the generation, processing, storage, communication, and transmission of electronic records, and to ensure that electronic transactions are secure and trustworthy;
And whereas, it is necessary to control the unauthorized use and illegal alteration of electronic records;
Now, therefore, this Act is enacted by the House of Representatives in the First Year of the Proclamation of the House of Representatives, 2063 (2007). Medha Law and Partners Is a leading corporate and best law firm in Nepal.
Chapter – 1
Preliminary
- Short Title, Extension, and Commencement (Shortened Version):
(1) This Act shall be called The Electronic Transactions Act, 2063 (2008).
(2) It shall be deemed effective from 24 Bhadra 2063 (September 2, 2006).
(3) It extends throughout Nepal and applies to any person, wherever residing, who commits an offence under this Act.
- Definitions: Unless the subject or context otherwise requires, in this Act,-
(a) “Asymmetric Crypto System” means a system that creates a secured key-pair consisting of a private key creating a digital signature and a public key to verify the digital signature.
(b) “License” means a license obtained pursuant to Sub-section (3) of Section 18.
(c) “Originator” means a person who generates, stores or transmits electronic records, and this term also includes a person who causes any other person to carry out such functions: Provided that it shall not include an intermediary.
(d) “Computer” means an electro-magnetic, optical or other high-speed data processing device or system, which performs logical, arithmetic and memory functions by manipulating electro-magnetic or optical impulses, and also includes all acts of input, output, processing, storage and computer software or communication facilities which are connected or related to the computer in any computer system or computer network.
(e) “Computer Database” means an information, knowledge and concept or presentation of instructions, which are being prepared or have already been prepared in word, image, voice or audio visual form in a formalized manner or which have been produced by a computer, computer system or computer network, with a view to use in a computer, computer system or computer network.
(f) “Computer Network” means an interrelationship between two or more than two computers having interconnection with each other or in contact of communication.
(g) “Computer System” means a device or a group of devices, containing all computer programmes including input and output support devices, electronic instructions, input and output data that performs logical, arithmetic, data storage and retrieval, communication including controlling functions.
(h) “Computer Resource” means a computer, computer system, computer network, data, computer database or software.
(i) “Subscriber” means a person who has obtained a certificate under Sub section (3) of Section 31.
(j) “Key Pair” means a private key in an asymmetric crypto system and of pair of public key, interconnected in a mathematics form with the private key which has a code to verify digital signature by the public key to be created from the private key.
(k) “Data” means the presentation of information, knowledge, fact and concept or instructions in any form, which are kept in a formalized manner in a computer system or computer network and is intended for processing the same, or processed or stored in a computer memory.
(l) “Tribunal” means the Information Technology Tribunal formed pursuant to section 60.
(m) “Private Key” means a key of any key pair used to create a digital signature.
(n) “Controller” means the Controller appointed or designated pursuant to section 13.
(o) “Digital Signature” means a signature made in any electronic form to be included in the transformation of electronic record by a person having a non- transformed initial electronic record and the public key of signatory by using a type of asymmetric crypto system that may clearly ascertain the following matters:
(1) Whether or not transformation of electronic record was created by using a type of private key keeping a logical consistency with the public key of signatory; and
(2) Whether or not the initial electronic record has been changed after the transformation of electronic record.
(p) “Access” means an opportunity of gaining entry into, logical, arithmetical or resources of memory function of any computer, computer system or computer network, giving instructions to such resources or making communication contact with such resources.
(q) “Appellate Tribunal” means the Information Technology Appellate Tribunal formed pursuant to section 66.
(r) “Certificate” means a Digital Signature Certificate issued by the Certifying Authority under Section 30.
(s) “Certification Practice Statement” means any statement issued by a Certifying Authority to specify the practices to be applied by the Certifying Authority while issuing a Digital Signature Certificate.
(t) “Certifying Authority” means a certifying authority which has obtained a license to issue a Digital Signature Certificate under Sub-section (3) of Section 18.
(u) “Addressee” means a person receiving the processed electronic record as intended by the originator. Provided that it shall not include an intermediary.
(v) “Electronic Record” means the data, record, image or sound transmitted, received or stored in an electronic form by generating the same through any means.
(w) “Electronic Form” means a form of information transmitted, received or stored by generating the same through the means of magnetic, optical, computer memory or similar other devices.
(x) “Public Key” means a key of any key pair used to verify digital signature.
(y) “Information” means the data details of the scripted texts, images, sounds, codes, computer programmes, software and computer databases.
(z) “Information system” means a system to generate, produce, transmit, receive, store and display information or to process the same by other method.
(aa) “Software” means any specific part of computer system such as system software and application software having the capacity for operating computer hardware.
(ab) “Computer Accessory” means a technology such as computer resource, the information used by any institution in its business, a software-like item produced or purchased by such an institution, hardware and computer network.
(ac) “Government Authority” means a Ministry, Secretariat, Department of Government of Nepal or the Offices thereunder, Constitutional Body or the Offices thereunder, Court or Tribunal or Office of the Nepal Army and it shall also includes other Offices of the similar nature.
(ad) “Public Institution” means the following institutions:-
(1) A company, bank or board whether fully or partially owned or controlled by Government of Nepal , or a Commission agency, authority, corporation, enterprise board, centre, council and other corporate body of the similar nature established by Government of Nepal pursuant to the laws prevailing.
(2) A university, school, research centre, and other similar academic or educational institutions operated by Government of Nepal or which have been receiving a full or partial grant from Government of Nepal,
(3) The Local Bodies formed under the Local Self-Governance Act, 1998 (2055 B.S);
(4) The Institutions run on the loan, grant or guarantee of Government of Nepal;
(5) The Institution which is fully or partially owned or controlled by the institution referred to in sub-Clauses (1), (2), (3) or (4) or which receiving grant from such institution;
(6) Any other Institutions prescribed by Government of Nepal as a public institution by a notification published in the Nepal Gazette.
(ae) “Prescribed” or “As prescribed” means prescribed or as prescribed in Rules framed under this Act.
Chapter – 2
Provisions Relating to Electronic Record and Digital Signature
- Authenticity of Electronic Record
(1) A subscriber may authenticate an electronic record using their personal digital signature.
(2) Authentication must be done using an asymmetric cryptosystem and a hash function.
Explanation: A hash function converts data into a fixed-size output, making it computationally infeasible to reverse or generate the same result from different inputs.
(3) Anyone may verify an electronic record using the subscriber’s public key.
- Legal Recognition of Electronic Records
If any law requires information or documents to be in written or printed form, such requirements are fulfilled if the documents are maintained electronically as per this Act and its Rules.
- Legal Recognition of Digital Signatures
If a document or information requires a signature under existing law, a digital signature affixed in compliance with this Act and its Rules shall have equal legal validity.
- Safe Custody of Electronic Records
If law requires a document to be safely kept, this may be done electronically, provided:
(a) It remains accessible for future reference;
(b) It can be reproduced in its original form;
(c) Origin, destination, date, and time of transmission or receipt are identifiable.
Exception: This does not apply to automatically generated transmission data.
- Electronic Records as Original Documents
If law requires the submission or retention of an original document, an electronic record is valid if:
(a) There is reliable evidence that it has not been altered since its creation;
(b) It can be clearly presented to the required person when needed.
- Secured Electronic Records
An electronic record verified as unaltered through prescribed security procedures shall be deemed a secured electronic record.
- Secured Digital Signature
A digital signature verified using prescribed methods and security procedures shall be deemed a secured digital signature.
Chapter – 3
Provision Relating to Dispatch, Receipt and Acknowledgement of Electronic Records
- Attribution of Electronic Record to Originator
(1) An electronic record shall be attributed to the originator if:
(a) Sent by the originator personally;
(b) Sent by someone authorized to act on behalf of the originator; or
(c) Sent through an automated system programmed by or on behalf of the originator.
(2) If these conditions exist, the addressee may consider the record as coming from the originator and act accordingly.
- Procedure for Receipt and Acknowledgement of Electronic Record
(1) If the originator requests or agrees with the addressee to acknowledge receipt of an electronic record, the following rules apply:
(2) If no specific format or method is agreed, acknowledgement can be:
(a) By automated or other communication means; or
(b) Through conduct indicating receipt.
(3) If the originator specifies that the record is only valid upon receipt of acknowledgement, the record is not considered transmitted until such receipt is received.
(4) If no such condition is stated but no acknowledgement is received within the prescribed time, the record shall be deemed not transmitted.
(5) Additional procedures shall be as prescribed.
12. Time and Place of Dispatch and Receipt of Electronic Record
(1) Unless otherwise agreed, an electronic record is considered dispatched when it enters an information system beyond the control of the originator.
(2) The time of receipt shall be determined as prescribed, unless agreed otherwise.
(3) Unless otherwise agreed:
- The record is deemed dispatched from the originator’s place of business.
- It is deemed received at the addressee’s place of business.
Explanation:
- (a) If there are multiple business locations, the relevant place is where the business related to the transaction is conducted.
- (b) If there is no business location, the place of residence is considered the place of business.
Chapter 4
Provisions Relating to Controller and Certifying Authority:
13. Appointment of the Controller and Other Employees
(1) The Government of Nepal may, by notification in the Nepal Gazette, appoint a qualified person or designate a government officer as the Controller.
(2) To assist the Controller, the Government may appoint or assign a Deputy Controller and other necessary employees, who shall work under the Controller’s direction and control.
14. Functions, Duties, and Powers of the Controller
The Controller shall have the following responsibilities:
(a) Issue licenses to Certifying Authorities;
(b) Supervise and monitor Certifying Authorities;
(c) Set standards for digital signature verification;
(d) Define operational conditions for Certifying Authorities;
(e) Specify the format and required contents of digital certificates;
(f) Prescribe procedures for dealings between Certifying Authorities and subscribers;
(g) Maintain and update a publicly accessible database of disclosed information from Certifying Authorities;
(h) Perform other functions as prescribed.
15. License Requirement
No person shall act as a Certifying Authority without obtaining a license under this Act.
16. Application for License
(1) Any qualified person wishing to act as a Certifying Authority must apply to the Controller in the prescribed format, along with the prescribed fee.
(2) The application must include:
(a) Details of the certification process;
(b) Proof of identity and verification;
(c) Information on financial, human, and other necessary resources;
(d) Other prescribed documents.
(3) The Controller may request additional documents to assess the applicant’s suitability. No action will be taken until the applicant submits the requested documents.
17. Other Functions and Duties of Certifying Authority
In addition to issuing, suspending, or revoking certificates, a Certifying Authority shall perform other functions and duties as prescribed.
18. Procedure for Granting a License
(1) Upon receiving an application under Section 16, the Controller shall, within two months, decide whether the applicant meets the required qualifications and has the necessary financial, physical, and human resources.
(2) The Controller may inspect the applicant’s resources.
(3) If approved, a license shall be issued in the prescribed format, specifying its validity period and applicable terms and conditions.
(4) Other licensing procedures shall be as prescribed.
19. Renewal of License
(1) A Certifying Authority must renew its license annually.
(2) An application for renewal must be submitted at least two months before the license expires, in the prescribed format with the required fee.
(3) The Controller must decide on renewal at least one month before the license expires.
(4) If renewal is to be denied, the applicant must be given a reasonable opportunity to present their case.
20. Suspension of License
The Controller may suspend a Certifying Authority’s license if false documents were submitted or legal conditions were violated, pending inquiry. A reasonable opportunity for defense must be provided. Further procedures shall be as prescribed.
21. Revocation of License
After inquiry, the Controller may revoke a license if:
(a) the Authority fails to meet legal obligations;
(b) false documents were submitted;
(c) business operations harm public interest or national economy;
(d) any offense under this Act or Rules is committed.
A chance for defense must be given. Additional procedures will be prescribed.
22. Notice of Suspension or Revocation
If a license is suspended or revoked, the Controller shall notify the Certifying Authority in writing, record it in the database, and publish it electronically and in at least two Nepali and English newspapers. However, failure to publish does not invalidate the decision.
23. Recognition of Foreign Certifying Authorities
With Government approval, the Controller may recognize a foreign Certifying Authority licensed under foreign law. Recognized foreign Authorities may issue certificates under this Act. The recognition process shall follow prescribed procedures.
24. Power to Issue Directives
The Controller may issue directives to ensure compliance in certificate issuance, and it is the duty of Certifying Authorities to follow such directives.
- Power Delegation by Controller
The Controller may delegate any or all of his/her powers under this Act or Rules to a subordinate officer for necessary execution.
- Power to Investigate
(1) If there is reason to believe that this Act or Rules are not being followed, the Controller may conduct or assign an investigation.
(2) Certifying Authorities must cooperate during such investigations.
(3) The investigation procedure shall be as prescribed.
- Performance Audit
(1) The Controller may conduct or assign a yearly performance audit of Certifying Authorities.
(2) Recognized auditors or experts in computer security may be appointed for audits.
(3) Audit reports shall be published electronically and stored in a database.
(4) Auditor qualifications, remuneration, and procedures shall be prescribed.
(5) The Controller shall fix service standards of Certifying Authorities and publish them for public awareness.
- Access to Systems and Data
(1) If a violation is suspected, the Controller may access any computer system, device, or data involved.
(2) The Controller may issue directives for technical or other cooperation.
(3) Concerned individuals must comply with such directives.
- Record Maintenance and Security
(1) The Controller shall maintain records of all certificates issued.
(2) To ensure digital signature privacy and integrity, the Controller must:
- Use a computer security system,
- Apply security procedures,
- Comply with prescribed standards.
(3) A computerized public key database shall be maintained and updated.
(4) Public keys shall be made available upon request for digital signature verification.
Chapter-5
Provisions Relating to Digital Signature and Certificates
- Issuance of Certificate
Only a licensed or recognized Certifying Authority may issue a Digital Signature Certificate under this Act.
- Application for Certificate
(1) A person seeking a Digital Signature Certificate must apply to the Certifying Authority with the prescribed fee and details.
(2) The Certifying Authority must decide within one month whether to issue the certificate.
(3) If approved, the certificate must be issued within seven days in the prescribed format. If rejected, the applicant must be informed with reasons within seven days.
- Suspension of Certificate
(1) A certificate may be suspended in the following cases:
- At the request of the subscriber or authorized representative,
- If required in the public interest as prescribed,
- If legal violations during issuance could harm relying parties, as instructed by the Controller.
(2) Grounds and procedures for suspension and reinstatement shall be as prescribed.
- Revocation of Certificate
(1) The Controller or Certifying Authority may revoke a certificate under these conditions:
- At the subscriber’s or authorized person’s request,
- If required in the public interest,
- Upon death of the subscriber,
- Upon insolvency, dissolution, or winding up of the subscriber’s company,
- If eligibility criteria were not met,
- If any material fact is found false,
- If the key or security system is compromised.
(2) Revocation procedures shall be as prescribed.
- Notice of Suspension or Revocation
(1) Upon suspension or revocation, a public notice must be issued and recorded in the official repository.
(2) The Certifying Authority or Controller must inform the concerned subscriber promptly.
Chapter-6
Functions, Duties and Rights of Subscriber
- Generation of Key Pair
(1) If a certificate includes a public key and it is to be generated by the subscriber, the subscriber must generate the key pair using a secure asymmetric crypto system.
(2) If the subscriber and Certifying Authority have an agreement or the Authority accepts a particular system, the subscriber must use that agreed or accepted system to generate the key pair.
- Acceptance of Certificate
(1) A certificate is deemed accepted by the subscriber if:
- It is published or authorized for publication by the subscriber, or
- There is any indication suggesting the subscriber has accepted it.
(2) Upon acceptance, the subscriber is deemed to guarantee that:
- They hold the corresponding private key and are authorized to do so,
- All information provided to the Certifying Authority is true, and
- All details in the certificate are accurate to the best of their knowledge.
- Secure Retention of Private Key
(1) Subscribers must take reasonable care to secure their private key and prevent unauthorized access.
(2) If the private key is compromised, the subscriber must promptly notify the Certifying Authority, which must suspend the certificate immediately.
(3) Even during suspension, the subscriber must continue to safeguard the private key.
- Deposit of Private Key with Controller
(1) For reasons such as protecting national sovereignty, public order, or preventing crime, the Controller may order a subscriber to deposit their private key. The subscriber must comply immediately.
(2) The Controller must not disclose the deposited key to any unauthorized person.
Chapter-7
Electronic Record and Government use of Digital Signature
39. Publication of Government Documents in Electronic Form
(1) The Government of Nepal may publish laws, notifications, orders, and other official matters in electronic form, in addition to publication in the Nepal Gazette.
(2) Forms, applications, documents, records, licenses, certificates, payments, and approvals required by law may be submitted, issued, or made electronically, and such electronic actions shall not be denied legal validity solely due to their form.
40. Acceptance of Electronic Documents and Payments
(1) Government agencies, public entities, and financial institutions in Nepal may accept documents and payments in electronic form, and such acceptance shall be legally valid.
(2) However, unless prescribed otherwise, such agencies are not obligated to accept or require others to use electronic documents or payments.
(3) Procedures, formats, and processes for electronic submissions shall be as prescribed.
41. Use of Digital Signatures in Government Offices
(1) Where signature verification is required, the Government may allow the use of digital signatures by officials and institutions.
(2) Additional security measures may be prescribed for verification and authentication of such digital signatures.
(3) Provisions regarding Certifying Authorities and digital certificates used by government entities shall be as prescribed.
Chapter –8
Provisions Relating to Network Service
42. Liability of Network Service Providers
Network service providers shall be liable for:
(a) Obligations under their agreements with subscribers;
(b) Obligations under their service license;
(c) Any other liabilities as prescribed by law.
43. Exemption from Liability for Network Service Providers
Network service providers are not liable for criminal or civil claims arising from third-party information they transmit or provide access to, unless they knowingly facilitate access to content that violates this Act or related rules.
Explanation: “Third party” means any person or entity outside the control of the network service provider acting as an intermediary.
Chapter -9
Offence Relating To Computer
44. Piracy, Destruction, or Alteration of Computer Source Code
Any person who knowingly or maliciously pirates, destroys, or alters computer source code shall be punished with imprisonment up to three years, or a fine up to NPR 200,000, or both.
Explanation: “Computer source code” includes program listings, commands, design, layout, and program analysis.
45. Unauthorized Access to Computer Materials
A person who accesses any computer program, data, or information without authorization, or exceeds authorized access, shall be punished with imprisonment up to three years, or a fine up to NPR 200,000, or both.
46. Damage to Computer and Information Systems
Any person who maliciously destroys, damages, deletes, alters, or disrupts computer data or systems causing wrongful loss shall be punished with imprisonment up to three years, or a fine up to NPR 2,000, or both.
47. Publication of Illegal Materials in Electronic Form
(1) Publishing prohibited or immoral electronic material, or content that spreads hatred or disrupts social harmony, shall be punished with imprisonment up to five years, or a fine up to NPR 100,000, or both.
(2) Repeat offenses shall attract an increased penalty of 1.5 times the previous punishment each time.
- Confidentiality Breach:
Any person who, without authorization, divulges confidential records or information accessed under this Act or its Rules shall be punished with a fine up to NPR 10,000, or imprisonment up to two years, or both, depending on the severity. - False Statements:
Anyone who knowingly submits false or conceals information to obtain a license or digital signature certificate from the Certifying Authority or Controller shall be punished with a fine up to NPR 100,000, or imprisonment up to two years, or both. - Submission or Display of False License or Certificates:
(1) Any person acting as a Certifying Authority without a license from the Controller shall be punished with a fine up to NPR 100,000, or imprisonment up to two years, or both, depending on the offence.
(2) Anyone who publishes or provides a fake license or false license-related statement without a license shall be fined up to NPR 100,000.
(3) Anyone who knowingly publishes or provides a certificate not issued, accepted, or that is suspended/revoked shall be punished with a fine up to NPR 100,000, or imprisonment up to two years, or both.
Exception: Publishing a suspended/revoked certificate for verification before suspension/revocation is not an offence.
- Non-submission of Statements or Documents:
(1) Failure to submit any required statement, document, or report to the Controller or Certifying Authority within the specified time shall incur a fine up to NPR 50,000.
(2) Failure to properly maintain books, registers, records, or accounts securely as required shall incur a fine up to NPR 50,000. - Computer Fraud:
Anyone who, with intent to defraud, creates, publishes, or uses a digital signature certificate or benefits unlawfully from payments, accounts, inventories, or ATM cards shall have the gained amount recovered and be punished with a fine up to NPR 100,000, or imprisonment up to two years, or both. - Abetment of Computer Offence:
Anyone who abets, attempts, or conspires to commit a computer-related offence shall be punished with a fine up to NPR 50,000, or imprisonment up to six months, or both, depending on the offence. - Punishment to Accomplice:
Anyone assisting or acting as an accomplice in committing an offence under this Act shall be liable to half the punishment applicable to the principal offender. - Offences Committed Outside Nepal:
If a person commits an offence under this Act involving a computer system located in Nepal, they shall be liable for prosecution and punishment in Nepal, even if the act was committed from abroad. - Confiscation:
Any device, system, or accessory (e.g., computers, disks, software) used in committing a computer-related offence under this Act shall be subject to confiscation. - Offences by Corporate Body:
(1) If a corporate body commits an offence, the chief responsible person at the time shall be deemed liable. However, they are exempt if they prove lack of knowledge or due diligence to prevent the offence.
(2) If the offence occurred with the consent, knowledge, or negligence of a director, manager, secretary, or responsible person, both the corporate body and the individual shall be held liable. - Other Punishments:
For any violation of this Act or its Rules not specifically penalized, the offender shall be liable to a fine up to fifty thousand Rupees, or imprisonment up to six months, or both. - No Hindrance to Punishment under Other Laws:
If an act constitutes an offence under this Act as well as other prevailing laws, separate legal action and punishment under those laws shall not be barred by this Act.
Chapter-10
Provisions Relating to Information Technology Tribunal
- Constitution of Tribunal:
(1) The Government of Nepal shall establish a three-member Information Technology Tribunal (with one expert each from law, IT, and commerce) to adjudicate computer-related offences under Chapter 9.
(2) The Law Member shall chair the Tribunal.
(3) The Tribunal shall function as per prescribed jurisdiction.
(4) Appeals against Tribunal decisions may be filed with the Appellate Tribunal within 35 days. - Qualifications for Tribunal Members:
(1) Law Member: Must have legal knowledge in IT and be or be qualified to be a District Court judge.
(2) IT Member: Nepali citizen with a Master’s in Computer Science/IT and at least 3 years of experience in IT or electronic transactions.
(3) Commerce Member: Nepali citizen with a Master’s in Management/Commerce, specialization in electronic transactions, and 3 years of relevant experience. - Tenure, Remuneration, and Oath:
(1) Members serve for five years and may be reappointed.
(2) Remuneration and service terms shall be as prescribed.
(3) Before assuming office, members must take an oath before the Chief Judge of the Appellate Court. - Vacancy and Replacement:
(1) The office of a Member shall be vacant upon:
a) Expiry of term
b) Attaining age 63
c) Death
d) Resignation
e) Conviction for a crime involving moral turpitude
f) Proven misbehavior or incompetence after a prescribed inquiry, with the right to defend.
(2) If the Law Member is a sitting judge, the inquiry shall follow relevant judicial service laws.
(3) Inquiry procedures shall be as prescribed.
(4) Vacancies shall be filled by appointing a qualified person under Section 61 for the remaining term. - Staff of the Tribunal:
(1) The Government of Nepal shall provide necessary staff for the Tribunal.
(2) Their duties and responsibilities shall be as prescribed. - Tribunal Procedures:
The Tribunal shall follow prescribed procedures while initiating proceedings and adjudicating cases under Section 60.
Chapter-11
Provisions Relating to Information Technology Appellate Tribunal
- Establishment and Formation of the Appellate Tribunal:
(1) The Government of Nepal shall, by notification in the Nepal Gazette, establish a three-member Information Technology Appellate Tribunal to hear appeals against decisions of the Tribunal, Controller, or Certifying Authority. The members shall represent law, information technology, and commerce, and meet the qualifications under Section 67.
(2) The Law Member shall serve as the Chairperson.
(3) The Appellate Tribunal shall exercise its jurisdiction as prescribed. - Qualifications of Appellate Tribunal Members:
(1) A person with knowledge of information technology who is, has been, or is qualified to be an Appellate Court judge is eligible as the Law Member.
(2) A Nepali citizen with at least a Master’s degree in computer science or IT and five years’ experience in electronic transactions, IT, or electronic communication is eligible as the IT Member.
(3) A Nepali citizen with a Master’s degree in management or commerce, specialization in electronic transactions, and five years of relevant experience is eligible as the Commerce Member. - Term, Remuneration, and Conditions of Service:
(1) The term of office of Appellate Tribunal members shall be five years, with eligibility for reappointment.
(2) Remuneration and service conditions shall be as prescribed.
(3) Members must take an oath of office and secrecy before the Chief Justice of the Supreme Court before assuming duties. - Vacancy and Replacement of Appellate Tribunal Members:
(1) The office of a member shall become vacant if:
(a) Term expires,
(b) Member turns 63,
(c) Death,
(d) Resignation,
(e) Conviction for a criminal offense involving moral turpitude,
(f) Proven misconduct or incapacity after a government inquiry, with the right to a fair defense.
(2) If the Law Member is a sitting judge, inquiry under (f) shall follow applicable judicial service laws.
(3) Inquiry procedures under (f) shall be as prescribed.
(4) Vacancies shall be filled by eligible candidates under Section 67 for the remaining term. - Staff of the Appellate Tribunal:
(1) The Government shall provide required staff to the Appellate Tribunal.
(2) Additional staff-related provisions shall be as prescribed. - Procedure of Appellate Tribunal:
The Appellate Tribunal shall conduct proceedings and adjudicate appeals as per prescribed procedures.
Chapter-12
Miscellaneous
- Agreement Between Parties:
Parties involved in creating, transmitting, receiving, storing, or processing electronic records may, by mutual agreement, modify or exclude provisions of Chapter 3 to suit their business needs. - Government Directives:
The Government of Nepal may issue directives for implementing this Act, which the Controller or Certifying Authority must follow. - Time Limit for Complaint:
A complaint regarding any violation or offence under this Act must be filed within 35 days from the date the violation or offence was known. - Government as Plaintiff:
(1) Offences under this Act shall be prosecuted by the Government of Nepal and treated as government cases under the Government Cases Act, 1992.
(2) Police must seek assistance from the Controller or relevant experts during investigations. - Recovery of Compensation:
Offenders shall be liable to pay compensation for any loss or damage caused due to offences committed under this Act. - Non-Applicability of the Act:
(1) This Act shall not apply to:
(a) Negotiable Instruments,
(b) Deeds involving immovable property (e.g., wills, mortgages, conveyances),
(c) Ownership/title documents of immovable property,
(d) Legal documents used in court proceedings,
(e) Arbitration documents (e.g., claims, defenses),
(f) Documents that are legally required to be non-electronic.
(2) The Government may modify this list by notification in the Nepal Gazette. - Power to Frame Rules:
The Government of Nepal may frame necessary Rules to fulfill the objectives of this Act. - Power to Issue Directives:
The Government may also issue and enforce necessary directives consistent with this Act and the Rules. - Effect of Inoperativeness of the Electronic Transactions Ordinance, 2063 (2008):
The inoperativeness of the Ordinance shall not:
(a) Revive any provision not in effect when the Ordinance ended,
(b) Affect ongoing matters, actions taken, or punishments under it,
(c) Affect any rights, liabilities, obligations, or privileges acquired,
(d) Impact penalties or punishments already incurred,
(e) Hinder legal proceedings or remedies that may continue as if the Ordinance were still in force.