Government proposes licensing system for data centers in Nepal to enhance cybersecurity

KATHMANDU: In a bid to regulate and secure the rapidly growing data center market, the Nepalese government has proposed a licensing system that requires any company wishing to operate a data center within the country to obtain a license.

This significant move is part of the draft of the ‘Bill to Make Arrangements Regarding Information Technology and Cyber Security,’ released by the Ministry of Communication and Information Technology. The proposed legislation addresses various aspects of data center operations, cloud services, and disaster management.

The draft bill, specifically outlined in Section 84, stipulates that organizations intending to operate data centers, provide cloud services, or both, must submit an application in the prescribed format to the Department of Customs Clearance.

Upon submission, the organization will undergo testing procedures to ensure compliance with the established standards. This marks the government’s first attempt to define and regulate the operations of data centers in Nepal.

The global and local data center markets have experienced significant growth, attributed to the increasing adoption of advanced information technologies such as artificial intelligence, cloud computing, and the internet of things.

In Nepal, both government and private sector entities have actively participated in establishing and operating data centers. However, until now, there have been no policy frameworks or standards governing data center operations in the country.

One of the key provisions of the proposed bill is the requirement for licensed organizations to submit updated details to the department annually.

Additionally, the bill mandates that if the legislation is implemented before passing through Parliament and becoming law, data center, cloud, and service providers must obtain a license within one year of its implementation. The license renewal process is stipulated to occur annually, ensuring ongoing compliance with regulations.

The draft bill also emphasizes the importance of disaster management systems for licensed data centers, outlining specific requirements for the operation of these systems.

Furthermore, government agencies are permitted to store their computers and information systems in licensed data centers or clouds, as specified in Section 85. Section 86 explicitly states that operating a data center, cloud, or both without obtaining a license is prohibited.

The bill defines a data center as a structure equipped with high-capacity computer infrastructure for data storage, management, processing, and exchange. This infrastructure includes servers, routers, switches, firewalls, storage, fire control systems, and environmental management systems.

Cloud services, according to the proposed bill, encompass the infrastructure related to information technology provided by cloud computing service providers based on user demand through web technology.

To reinforce compliance, the draft bill establishes penalties for operating a data center or cloud without a license, with fines of up to five lakh rupees imposed for this offense. Several prominent organizations in Nepal, such as Ncell, Dish Home, Worldlink, and the Government Integrated Data Center (GIDC), have already established data centers of various capacities.

The proposed licensing system aims to bring uniformity, security, and accountability to the burgeoning data center industry in Nepal. The Government Integrated Data Center (GIDC), previously operational at the National Information Technology Center in Kathmandu, is undergoing restructuring following the government’s decision to abolish and merge it with the Department of Information Technology, as announced in the current financial year’s budget statement.