5.10 Information Technology Law and Cyber Crime

UK: the Computer Misuse Act 1990 (unauthorised access — "hacking" unauthorised access with intent; unauthorised modification — the foundational trinity); the Data Protection Act2018 / UK GDPR (personal data principles, lawful bases, data-subject rights, breach notification; the regulator ICO); online-harms and fraud legislation developing since. Nepal: the ElectronicTransactions Act 2063 (2008) — the pioneer statute: recognition of electronic records and digital signatures (and the certifying-controller framework), and a catalogue of computer offences (unauthorised access and damage to computer systems, data theft/tampering, computerfraud and forgery, publishing of illegal content — with penalties) — cite without sections; the Individual Privacy Act 2074 (2018) (privacy as a statutory right including data privacy — the constitutional right's working statute); the Nepal Police's cyber units and the draft federal cyber- security legislation. Evidence: electronic records admissible subject to authentication (the ETA's evidentiary provisions and the Evidence Act's development). The daily practice (the exam'sapplied edge): advising clients on data handling, drafting privacy notices and website terms, takedown and impersonation complaints, social-media defamation (the speech-vs-reputation line — Jurisprudence's Mill territory, Unit 3 of Political Thoughts), and advising on cross-border data flows — a live issue for Nepal's IT outsourcing industry.