Registration of Data Center and Cloud Service in Nepal

Nepal has recently implemented comprehensive regulations for data center and cloud service operations through the Data Centre and Cloud Services (Operation and Management) Directive 2081. This Q&A guide will help you understand the registration requirements, compliance obligations, and tier ratings necessary to operate data centers and cloud services in Nepal legally.

1. Registration Requirements

1.1. What regulatory framework governs data centers and cloud services in Nepal?

Data centers and cloud services in Nepal are governed by the Data Centre and Cloud Services (Operation and Management) Directive 2081, which was issued on February 10, 2025, by the Ministry of Communication and Information Technology under Section 79 of the Electronic Transactions Act, 2063. This directive establishes mandatory registration and compliance requirements for all service providers.

1.2. Who needs to register under this directive?

All entities providing data center facilities (infrastructure for storing and operating data and IT systems) and cloud services (integrated technology enabling hosting of information processing systems) must register with the Department of Information and Technology before offering their services in Nepal.

1.3. What is the definition of a data center and cloud service according to Nepali regulations?

According to the directive, a data center is defined as a facility that includes necessary infrastructure to store and operate data and information technology systems developed by government, public, and private sectors. Cloud services refer to integrated technology enabling the hosting of information processing systems using data center services or other sources, incorporating both hardware and software components.

1.4. What documents are required for data center registration?

REQUIRED DOCUMENTS FOR DATA CENTER REGISTRATION

1. Certificate of Incorporation of your company/firm
2. Security and Privacy Policy document
3. Business Continuity Plan documentation
4. Details of IP Pool available in your name
5. Fire Safety certification
6. Building Completion Certificate
7. Map showing the location of the data center
8. Details regarding the tier of the data center
9. Information about technical manpower involved in operations
10. Documentation of methods and procedures for physical security
11. High-level electricity design plans
12. For existing operations, Information Security Standards certification for both DC and DR (to be submitted within 6 months of listing)

1.5. What documentation is required for cloud service registration?

REQUIRED DOCUMENTS FOR CLOUD SERVICE REGISTRATION

1. Certificate of Incorporation of your company/firm
2. Security and Privacy Policy document
3. Details of technical manpower operating the cloud service
4. Map showing the location of the data center where cloud services are operated
5. Agreement with the data center (if you’re not operating your own)
6. Details of your affiliation with ISP/NSP
7. For existing operations, certificates related to Information Security Standards and Information Technology Service Management Standards (to be submitted within 6 months of listing)

2. Registration Process

2.1. What is the application process for registration?

To register your data center or cloud service, you must:

Step 1: Prepare the Application Form
Complete the application using the prescribed format provided by the Department of Information and Technology. Follow all instructions carefully to ensure accuracy.

Step 2: Gather Required Documentation
Collect all necessary documents as listed in the department’s official guidelines. Ensure that each document is complete, up-to-date, and properly formatted.

Step 3: Separate Applications for Operations
If you operate a Data Center and Cloud Services separately, prepare distinct applications for each. Do not combine them into one submission.

Step 4: Submit Completed Applications
File the completed application(s) along with all required documents to the Department of Information and Technology by the method specified (physical submission or online, if allowed).

Step 5: Respond to Inspection Requests
Be ready to provide additional documents or clarifications if the Department requests them during the inspection or evaluation process.

2.2. What is the timeline for registration approval?

After inspection and verification of all required documents, the Department may list your data center or cloud service within one month, provided all necessary procedures are completed satisfactorily.

2.3. What if my data center or cloud service is already operational?

Existing service providers must submit their application with all required documents within six months of the Directive’s issuance. Additionally, data center operators must provide certification related to Information Security Standards for both DC and DR, while cloud service operators must provide certification related to both Information Security Standards and Information Technology Service Management Standards.

2.4. Is there an ongoing compliance requirement after registration?

Yes, service providers must update their details with the Department annually by the end of the month of Poush (mid-January) using the Department’s prescribed methods.

3. Tier Ratings for Data Centers

3.1. What are the tier ratings for data centers in Nepal?

Data centers in Nepal are categorized into four tiers based on their infrastructure capabilities:

Feature	Tier 1	Tier 2	Tier 3	Tier 4
Distribution path for power and cooling	1	1	1 active / 1 alternative	2 active
Redundant active component	N	N	N+1	2(N+1)
Backbone redundancy	No	No	Required	Required
Horizontal cabling redundancy	No	No	No	Optional
UPS/Generator	Optional	Required	Required	Dual Systems Required
Concurrently maintainable	No	No	Yes	Yes
Fault-tolerant	No	No	No	Yes
Minimum annual uptime	99.671%	99.749%	99.982%	99.995%
Maximum downtime per year	28.8 hours	22 hours	1.6 hours	26.3 minutes
Power backup requirement	12 hours	12–24 hours	24–48 hours	48+ hours

3.2. When must tier rating certification be submitted?

Data center service providers must submit their tier rating certification to the Department within one year of being listed.

3.3. What tier rating is required for government data storage?

Any data center storing governmental data must have at least a Tier 3 rating or above.

4. Compliance Requirements

4.1. What are the ongoing compliance requirements for service providers?

Service providers must:

1. Provide equal access opportunities to all clients
2. Implement necessary security standards for data storage
3. Protect customer data from unauthorized access
4. Ensure continuous service availability
5. Report security breaches immediately to regulatory bodies
6. Appoint a Compliance Officer or contract with a compliance organization
7. Submit requested information to the Department within specified timeframes
8. Conduct annual security audits of their infrastructure
9. Follow instructions from the Department and law enforcement agencies
10. Assist clients wishing to remove or transfer their infrastructure
11. Ensure secure transfer of systems if service is terminated

4.2. What infrastructure and security requirements must be maintained?

Service providers must maintain:

1. Suitable server racks
2. Network equipment (firewalls, routers, switches)
3. Servers and storage devices
4. HVAC systems (heating, ventilation, air conditioning)
5. Fire safety measures
6. Reliable internet and electricity supply
7. IP pool in the provider’s name
8. Qualified technical personnel
9. Access control systems
10. Physical security personnel
11. CCTV monitoring with 3-month data retention
12. Network Operation Center (NOC)
13. Security devices for data protection
14. Server colocation capabilities
15. Regular data backup systems
16. Certified or experienced technical staff
17. Visitor record-keeping systems
18. Secure data destruction protocols

5. Deregistration

5.1. Under what circumstances can a service provider be removed from the Department’s list?

Service providers may be removed from the Department’s list for:

1. Non-compliance with the Directive’s rules
2. Misuse of data stored in their facilities
3. Dissolution of the company/firm
4. Voluntary request for cancellation

5.2. What is the deregistration process?

Before removal, the service provider is given 15 days to submit justification. If no response is received or if the justification is deemed insufficient after investigation, the Department will remove the provider within 7 days. For voluntary cancellation, the Department may remove the listing after completing necessary procedures. Details of removed providers are published in a national newspaper and on the Department’s website.

Axion Partners’ Expertise

At Axion Partners, we specialize in guiding businesses through the complex regulatory landscape of data center and cloud service registration in Nepal. Our team of experienced legal professionals can assist with preparation of all required documentation, compliance audits, and ongoing regulatory requirements to ensure your business operates within the legal framework established by the Data Centre and Cloud Services Directive 2081.

Conclusion

The registration of data centers and cloud services in Nepal involves comprehensive documentation and compliance with stringent technical and security standards. The tier-based system ensures that facilities meet appropriate reliability and uptime requirements based on their intended use. By understanding these requirements and preparing thoroughly, service providers can successfully navigate the registration process and establish compliant operations in Nepal.

For professional assistance with your data center or cloud service registration needs, contact Axion Partners for expert guidance throughout the process.