Making a Case for Data Security

In early September 2025, Nepal awoke to a national heartbreak. What began as Gen Z protests against corruption quickly escalated into widespread destruction. Iconic government buildings, courts, media offices and central administrative institutions, including Parliament, the Supreme Court and the Office of the Prime Minister and Council of Ministers, were set ablaze. Legal documents, court files, administrative records and long-standing heritage vanished in smoke and ash.

More than 300 local government offices were damaged, their records, furniture, and files—tangible layers of administrative memory—were obliterated. For many Nepalis, the loss went beyond physical infrastructure; it struck at trust, continuity, proof of rights and evidence of past decisions. Overnight, the nation’s administrative memory lay exposed, vulnerable and ephemeral. This crisis underscored a stark reality: when physical documents, fragile archives or inadequately secured digital storage are destroyed, the repercussions ripple for years, affecting governance, justice and public confidence.

Nepal is no stranger to disasters. Earthquakes, floods and fires have repeatedly tested the country’s resilience. Yet, until recently, no robust framework existed to align the scale of risk with systematic data preservation. The recent conflagrations made one thing painfully clear: reconstruction alone is insufficient. Nepal must rethink the very architecture of its administrative memory.

Early Steps: Legislative and Infrastructural Foundations

Recognizing the threat, the government took a crucial step in February 2025, issuing the Data Center and Cloud Services (Operation and Management) Directive, 2025, under the Electronic Transactions Act, 2008. The directive requires all data center and cloud service providers to register with the Department of Information Technology (DoIT), submit documentation demonstrating structural safety and operational continuity, and meet minimum operational and security standards before legally operating.

The first implementation successes are notable. Ncell became the first company fully certified under this regime. The telecom operator has built a Tier-III integrated data center in Nakkhu, Lalitpur, with disaster recovery facilities in Hetauda and Pokhara. The Nepal Electricity Authority (NEA) has also built a Tier-III-standard data center in Syuchatar, Kathmandu, at an estimated cost of Rs 1.40 billion. Meanwhile, a joint venture of Nepal’s BLC Holdings and India’s Yotta is developing a “super cloud” data center in Ramkot, Kathmandu, with an investment of around Rs 3 billion.

These steps signal serious intent, yet the September 2025 crisis proved that legislation and infrastructure alone are not sufficient. Without comprehensive planning, resilient design, capacity building and sustainable economic models to support maintenance, backups and nationwide coverage, the next disaster could replicate—or even exceed—the last.

What a High-Security Data Storage Revolution Must Deliver

To truly transform Nepal’s approach, a high-security data storage revolution must be holistic, integrating technical, institutional, economic and legal measures. Partial solutions alone cannot safeguard the nation’s administrative, legal and historical memory.

Physical Safety: Data centers and archival buildings must be fireproof, equipped with robust detection and suppression systems, and designed to contain flames. Earthquake-resistant construction is essential given Nepal’s seismic vulnerability. Protection against floods, landslides and storms, along with backup power, climate control and redundant cooling systems must be made standard. Physical security measures, including restricted access, surveillance and strong perimeter defenses, are equally vital.

Disaster Recovery: A single data center in Kathmandu is not sufficient. Mirrored or disaster recovery centers across Hetauda, Pokhara, Butwal, Dhangadhi, Surkhet, Janakpur and Birtamod, among other cities, ensure continuity if one site fails. Offsite, air-gapped backups protect data from cyber attacks, fire or other catastrophes. Redundancy, however, alone is insufficient. Regular drills and restoration tests must confirm functional recovery in practice, not just on paper.

Immutable Storage and Version control: Documents that must remain unaltered, such as judgments, contracts and land titles, require Write-Once-Read-Many (WORM) systems or equivalent technology. Versioned backups and snapshots ensure that other data can be restored if corrupted. Laws must recognize the legal validity of immutable digital copies, guaranteeing evidentiary value, enforceable property rights and judicial admissibility.

Encryption, Key Management, Secure Data Handling: All stored or transmitted data must be encrypted and key control should reside with a trusted authority to prevent single points of failure. Access must be regulated by using multi-factor authentication, least-privilege policies and tamper-proof logging systems.

Availability and Tiered Standards: Tier III certification, or ideally Tier IV, guarantees redundancy in power, cooling and network paths, minimizing downtime. High uptime is essential for judicial and administrative systems, where interruptions can have legal and economic consequences.

Legal and Policy Framework: Legislative mandates must define which records are preserved, for how long, in what formats and under what standards of immutability. Oversight, inspections, penalties and license revocation enforce compliance. Data sovereignty and privacy laws regulate storage locations, access and protection of sensitive information.

Institutional and Human Capacity: Skilled personnel in data center operations, cyber security and archival management ensure infrastructure functions as intended. Standard operating procedures, 24/7 monitoring, incident response and routine maintenance must be institutionalized. Budgets should cover not only construction but ongoing operations, including energy, staffing, upgrades, audits and security.

Financial Sustainability: Capital expenditure for construction and hardware, alongside operational costs for power, personnel, security and insurance must be factored. Public-private partnerships, cost-sharing, tax incentives and training grants encourage compliance, high standards and timely upgrades.

Current Infrastructure and Remaining Gaps

Nepal has made notable progress in modern data infrastructure. Ncell’s Tier-III Data Centre in Nakkhu, which is valued at Rs 2 billion, operates with disaster recovery facilities in Pokhara and Hetauda. Similarly, NEA’s three-story Tier-III data center in Syuchatar, equipped with 40 racks and built with Rs 1.40 billion investment, reflects successful collaboration with the Asian Development Bank (ADB). Ambitious initiatives such as the Ramkot “super cloud” data center, a BLC-Yotta partnership estimated to cost Rs 3 billion, signal a growing commitment to modern, high-capacity data storage facilities in the country.

Regulatory frameworks are also evolving. The DCCS Directive mandates registration, tier ratings and compliance standards. Ncell’s full certification has set an industry benchmark. Despite this, there still are critical gaps. Nationwide coverage, disaster recovery capacity and sustainable operations demand urgent attention. Preservation of older physical records is especially pressing. Thousands of microfilm reels at the National Archives are deteriorating due to vinegar syndrome, with many already lost. Much of this material exists solely on fragile media.

Redundancy is uneven. Many local government units, especially the 300 offices damaged during recent protests, lacked backup copies or alternative storage. While most existing data centers meet Tier III standards, very few reach Tier IV, which may be necessary for judicial and constitutional functions. Human resource capacity is limited, and operational practices are still weak. Without skilled personnel and standardized protocols, even the best infrastructure can fail. Financial and logistical barriers further complicate progress, particularly in remote provinces with unstable power, inadequate climate control and limited connectivity. Constructing high-security data centers in these regions is both costly and complex, requiring viable economic models.

A Roadmap for Data Resilience

In the immediate term, Nepal must assess recent damage, prioritize digitization of high-value documents and create emergency backups in certified data centers. Controlled digitization should secure at-risk manuscripts, microfilms and legal files. Legal frameworks must urgently recognize immutable digital storage and define evidentiary standards.

Nepal should transition from emergency measures to structural resilience over the next one to three years. New or upgraded Tier III/IV data centers must support judicial, financial and identity systems. Disaster recovery centers should be geographically distributed in less vulnerable regions. National archival centers with climate-controlled storage, WORM systems and secured protection for physical collections are essential. In parallel, human capacity must grow through training, certifications and academic partnerships. Public-private partnerships, donor contributions and government incentives can ensure financial sustainability.

Beyond three years, Nepal must embed resilience and governance into its archival ecosystem. A comprehensive archival law should clearly define ownership, retention, access and destruction of state records. Advanced technologies, including blockchain for audit trails and AI for anomaly detection, can strengthen oversight. All tiers of government and court must maintain redundant backups, supported by regular audits, enforcement mechanisms and public awareness campaigns to cultivate a culture of preservation.

Economic Imperatives

High-security data storage is not only protective but also an economic opportunity. Strong archival systems reduce legal disputes, avoid costly reconstruction and stimulate growth in cloud services, telecommunications, cyber security and infrastructure. Reliable preservation builds investor confidence, supports IT exports and leverages Nepal’s hydropower potential to cut operational costs.

By 2030, Nepal’s judiciary could maintain digital mirrors in resilient Tier III+/IV centers, local governments could ensure redundant records and the National Archives could safeguard fragile collections while offering digital access. Citizens would trust that legal and administrative records are protected. Certified domestic cloud services could power businesses by creating jobs in cyber security, archival management and data center operations.

However, there still are risks like underfunding, skill shortages, urban concentration, technology obsolescence and weak enforcement. But the potential payoff is immense: an enduring, digitally anchored Nepal.

Conclusion

The recent vandalism and arson have taught Nepal a harsh lesson: documents can vanish overnight, history can be erased, legal rights compromised and public trust shattered. Yet this crisis also presents an opportunity. With regulatory rigor, resilient infrastructure, capacity building and economic incentives, Nepal can shift from vulnerability to resilience.

The journey from ashes to archives is complex, demanding vision, resources, political will, institutional strength and public participation. But inaction carries a far greater cost: lost heritage, disrupted justice and weakened governance. If the government acts decisively, it can build a framework of trust, reliability, identity and legality that endures. Nepal can secure its rightful future by preserving its past.

This opinion article was originally published in October 2025 issue of New Business Age magazine.