(1) Except as per Section 23 of the Act, no one shall collect, store, protect, analyze, process or publish personal data.
(2) The personal information of a person should not be collected as data unless authorized by an authority, organization or related person in accordance with the prevailing law.
(3) For the collection of personal data of a person, even if a person has obtained permission from the relevant government office that collects data, such data shall not be collected or caused to be collected without the consent of the person concerned. However, such permission shall not be required for the collection of data by the government of Nepal or any agency under it for census or any other similar matter or for the collection of data by the provincial government or local level for internal purposes.