Unlocking Data Capital Nepal’s Next Economic Frontier

In today’s economy, data is no longer a by-product of business it is the business itself. Globally, enterprises that treat data as strategic capital consistently outperform competitors, attract greater investment, and scale faster. For Nepal, the question is no longer whether data matters, but whether we are ready to govern, secure, and monetise it responsibly.

Regional developments offer important lessons. India’s Digital Personal Data Protection Act (2023) has formalised a consent-based governance model, while its digital infrastructure Aadhaar, UPI, and IndiaStack demonstrates how public-private collaboration can drive financial inclusion and innovation. In contrast, China’s Personal Information Protection Law emphasises national sovereignty and strict cross-border compliance, reshaping how global firms operate within its borders.

These contrasting approaches highlight the choices Nepal must make. As sectors such as banking, telecommunications, e-commerce, hydropower, and digital services expand, the volume of sensitive data is increasing rapidly. With this growth comes risk. Rising cybersecurity threats across South Asia show how weak governance can quickly erode consumer trust and enterprise value.

Nepal therefore faces three critical questions:

Can we design governance frameworks that protect citizens without stifling innovation?

Are businesses investing enough in cybersecurity to ensure data remains an asset rather than a liability?

Can stronger public-private collaboration unlock value across sectors such as fintech and precision agriculture?

This opinion segment brings together voices from business, technology and policy to examine whether Nepal is truly prepared to treat data as capital, and what must change to unlock its full economic potential.

Is Nepal treating data as an asset or merely as IT infrastructure? Should it feature in strategic planning like capital investment?

Nepal has significant potential to leverage data, as it is largely an untapped landscape. However, it is crucial to prioritise data privacy, ensuring that monetisation efforts do not result in any breaches or misuse of information.

Juna Mathema, Co-founder and Managing Director, Blitz

Sumit Jha: Nepal remains in a transition phase. Most organisations still treat data as IT infrastructure, something to store and secure, rather than as a strategic asset that drives business value. While sectors like banking and telecom are beginning to adopt analytics, very few companies quantify the economic value of their data.

Businesses are not yet measuring how data influences revenue, customer retention, operational efficiency, or competitiveness. In today’s digital economy, data must be embedded in strategic planning alongside capital investment and market expansion. It is no longer a support function, it is intellectual capital. Real transformation begins when data is discussed in boardrooms, not just server rooms.

Juna Mathema: Nepali businesses have yet to fully recognise data as an asset. Most companies collect operational data, sales, distribution, and revenue, but often stop short of leveraging it strategically. Multinationals are more advanced, using third-party research to generate insights that inform decisions and investments.

When collected systematically, data can validate assumptions, forecast trends, and enable evidence-based decision-making. It should not only track performance but also uncover new opportunities. To truly treat data as an asset, businesses must invest in it, measure its returns, and integrate it into everyday decision-making culture.

Santosh Sigdel: Data in Nepal is still largely viewed as a byproduct rather than a strategic asset. Organisations primarily use it for compliance, reporting, or operational efficiency. However, both policymaking and business strategy increasingly depend on reliable data.

Some sectors, particularly finance, ICT, and AI-driven services, are beginning to recognise its value. Yet there is limited evidence that organisations systematically integrate data into long-term strategy. That said, the emergence of data-driven services signals gradual progress.

Mona Nyachhyong Shrestha: Many organisations still treat data as an IT function rather than a strategic resource. Despite growing volumes of customer and operational data, much of it remains underutilised. Larger institutions are adopting analytics, but SMEs often continue to see data as routine records.

This reflects a broader maturity gap. While some organisations use data to guide strategy and manage risk, many remain compliance-focused. The shift is clear: data must move from server rooms to boardroom agendas.

Narayan Koirala: Nepal is clearly in transition. We are beginning to recognise data as an asset, but we are not fully there yet. Very few companies formally assign value to their data—and that needs to change.

Strategic planning today must include how data is collected, protected, and leveraged. Importantly, treating data as an asset also means understanding its risk value. Organisations must identify their “crown jewels” - the data that would cause the most damage if compromised -and prioritise protection accordingly. This is the foundation of a mature data strategy.

What kind of data governance framework does Nepal need?

When leadership teams start discussing data in boardrooms, not just server rooms, that’s when transformation truly begins. The organisations that recognise this early will lead Nepal’s next phase of digital growth.

Sumit Jha, Entrepreneur and Software Engineer, NepalXAI Tech

Sumit Jha: Nepal needs a pragmatic, forward-looking framework that protects citizens without hindering innovation. A model closer to India’s, balancing consent, accountability, and growth, would be more suitable than a highly restrictive system.

The key trade-off is between control and competitiveness. Overregulation could stifle innovation, while weak protections risk eroding trust. Nepal should prioritise trust-based governance: clear consent mechanisms, strong cybersecurity standards, and enforceable accountability, without creating barriers to innovation.

Juna Mathema: Nepal’s policy direction already recognises technology as central to development. Initiatives under the Digital Nepal Framework and national plans highlight opportunities across sectors.

However, governance must guide rather than restrict. It should accommodate diverse business needs while addressing data ethics, security, accuracy, and public awareness. A balanced approach is essential, one that supports both innovation and responsible data use.

Santosh Sigdel: Nepal needs a comprehensive framework that balances privacy, innovation, and national security. This should include open data policies that enable anonymised datasets to support research and innovation.

Critically, Nepal lacks a dedicated personal data protection law. Existing provisions are insufficient for today’s digital landscape. A modern law, supported by an independent data protection authority, is essential to ensure compliance and build public trust.

Mona Nyachhyong Shrestha: Nepal’s current legal framework does not fully address the realities of a data-driven economy. A balanced, rights-based approach is needed, combining consent, accountability, and risk-based data classification.

Sensitive data may require sovereignty protections, but cross-border flows should remain possible to support trade and innovation. Strong governance may slow rapid deployment, but it ultimately builds long-term trust and resilience.

Narayan Koirala: Nepal should adopt a “best of both worlds” approach, learning from global models while tailoring solutions locally. However, the key lesson is simple: laws are only as effective as their implementation.

A strong, independent Data Protection Authority is critical. It must enforce regulations, guide businesses, and resolve disputes. Without institutional capacity, even the best-designed framework will fail to build trust.

Are Nepali businesses investing enough in cybersecurity?

Very few companies in Nepal are formally putting a price tag on their data but they should be. Strategic planning in the 21st century needs to include data. Just as we plan for market expansion or capital investment, we need to have a plan for how we collect, protect and use and share our data to create value.

Narayan Koirala, Founder, Eminance Ways

Sumit Jha: Most businesses are still underinvesting. Cybersecurity is often seen as a technical expense rather than a strategic necessity. Yet if data is capital, it must be protected accordingly.

The financial risks, operational disruption, legal liabilities, and recovery costs, are significant. However, the reputational damage from a breach can be far greater. Cybersecurity should be viewed as a competitive advantage, not just a cost.

Juna Mathema: Awareness remains limited. Many businesses underestimate cyber risks until incidents occur. Data breaches can have severe consequences, exposing sensitive information and damaging trust.

As digital adoption grows, there is an urgent need to increase awareness and strengthen preventive measures.

Santosh Sigdel: Investment remains uneven. Regulated sectors like banking and telecom are better protected due to compliance requirements, but SMEs lag behind.
Cyber incidents carry both financial and reputational risks, with long-term trust erosion often being the most damaging consequence.

Mona Nyachhyong Shrestha: Cybersecurity is still treated as a compliance requirement rather than a core business risk. This leads to superficial protections rather than comprehensive resilience.

As digital services expand, risks are increasing in both frequency and sophistication. Organisations that invest strategically in cybersecurity are better positioned to sustain growth.

Narayan Koirala: The short answer is no. Many organisations still rely on ‘checkbox security’, doing the minimum required for compliance.
A mature approach must be risk-based, focusing on protecting critical data assets. Equally important is building a security culture. Technology alone is not enough, human behaviour is often the weakest link.

How can public and private sectors collaborate responsibly on data?

Anonymised datasets are essential for modern businesses and innovators because they enable data-driven insights while protecting individual privacy. Government agencies should therefore regularly publish anonymised datasets that can be used for research, innovation and service improvement.

Santosh Sigdel, Co-founder and Executive Director, Digital Rights Nepal

Sumit Jha: Collaboration is essential to unlock data’s full value. The key is structured frameworks based on anonymisation, consent and accountability.
Models such as data sandboxes and data trusts can enable innovation while protecting privacy. With the right governance, collaboration can drive financial inclusion, smarter policymaking and AI-driven growth.

Juna Mathema: There is significant potential for integration, particularly in areas like KYC systems. Government investment in infrastructure and clear consent frameworks will be critical.
Public-private partnerships can help align innovation with real service needs.

Santosh Sigdel: Collaboration requires strong governance, anonymisation standards, and legal clarity. Open data policies and secure sharing mechanisms can support innovation while protecting privacy.

A comprehensive data protection law is essential to enable this ecosystem.

Mona Nyachhyong Shrestha: Responsible data sharing must prioritise privacy, security and trust. Anonymised and aggregated data can support innovation across sectors - from finance to public health.

Equally important is cyber threat intelligence sharing to strengthen national resilience.

Narayan Koirala: The foundation is anonymisation, supported by secure data exchange platforms. More advanced privacy-enhancing technologies can further enable safe collaboration.
If implemented correctly, this can unlock innovation while maintaining strict privacy protections.

What are realistic data monetisation strategies for Nepal?

Sumit Jha: Data monetisation is about creating value, not selling data. Analytics can improve efficiency, optimise pricing and enhance customer retention.
AI-driven personalisation, alternative credit scoring, and risk modelling offer significant opportunities, particularly in expanding financial inclusion.

Juna Mathema: Nepal has untapped potential, but success depends on data quality and relevance. Businesses must identify market demand, segment data effectively and ensure privacy is protected.

Santosh Sigdel: The real value lies in using data strategically, to improve services, reduce costs, and develop new products. Data can also support AI systems and predictive insights.

Mona Nyachhyong Shrestha: Responsible monetisation focuses on insights, not raw data. Analytics can drive efficiency, innovation and new revenue streams while maintaining trust.

Narayan Koirala: The goal is to solve real-world problems. Data can power smarter products, better risk models and actionable insights.

However, privacy and security must be built into systems from the start, through ‘Privacy by Design’ and ‘Security by Design’.

What should Nepal prioritise in the next 2–3 years?

Sensitive national and critical infrastructure data may require sovereignty protections, while trusted cross-border data flows should remain possible to support trade, outsourcing and digital services. Strong governance may slow rapid deployment, but it builds public trust, regulatory clarity and long-term digital resilience.

Mona Nyachhyong Shrestha, Chairperson, Cybersecurity Committee, CAN Federation

Sumit Jha: Regulatory clarity and digital public infrastructure are the top priorities. Clear rules build confidence, while infrastructure enables innovation.

Juna Mathema: Nepal must also focus on data diplomacy and global engagement, ensuring it remains competitive in the evolving digital landscape.

Santosh Sigdel: A comprehensive data protection law, national data strategy and stronger cybersecurity standards are essential foundations.

Mona Nyachhyong Shrestha: Trust, clarity and capability must guide progress. Investment in infrastructure and local capacity will be critical.

Narayan Koirala: If one priority stands above all, it is regulatory clarity. Without clear rules, investment and innovation will stall.

At the same time, Nepal must build cyber resilience, develop talent, and strengthen public-private partnerships to create a complete data ecosystem.