Nepal Moves to Secure EV Data Locally as Foreign Servers Raise National Security Concerns

KATHMANDU: Nepal has begun discussions on how to protect data generated by electric vehicles (EVs) within the country, amid growing concerns that sensitive vehicle information is being transmitted to servers operated by foreign manufacturers.

The issue was discussed at the Ministry of Science, Technology and Innovation in a meeting chaired by Minister Mahabir Pun, with participation from cybersecurity experts, representatives of the National Cyber Security Centre and technology-sector stakeholders.

EVs Are More Than Just Vehicles

Experts at the discussion highlighted that modern EVs function as network-connected computing devices, rather than simply transportation vehicles.

EVs use SIM cards, sensors and centralized systems to continuously collect and transmit information.

This can include:

• Vehicle location

• Distance travelled

• Battery condition

• Electric motor status

• Other vehicle-related technical data

According to experts, much of this information can be transmitted through centralized systems to foreign manufacturers.

Why Is Foreign Data Storage a Concern?

Cybersecurity experts warned that the centralized nature of EV systems could create risks if the systems or servers handling the data are compromised.

Cybersecurity expert and Bhairav Tech CEO Bijay Limbu said an EV's connected systems could potentially be used to monitor the movements of individuals.

He warned that if a centralized system were hacked, information about the movements of high-profile individuals could potentially become a national security concern.

The discussion therefore treated EV data as more than a consumer privacy issue.

Government Wants EV Data Stored in Nepal

Minister Mahabir Pun said data generated by EVs should be treated as an important national resource and protected within Nepal.

The ministry has begun consultations on the possibility of establishing systems that would allow EV-related data to be stored on servers located in Nepal and used within the country.

The move could give Nepal greater control over sensitive vehicle information and reduce dependence on foreign-controlled data infrastructure.

Experts Say a Strong Cybersecurity Law Is Needed

While local data storage could address part of the concern, experts warned that a government directive alone would not be sufficient.

Limbu argued that Nepal first needs a strong national cybersecurity law that establishes a clear legal framework for data protection and critical infrastructure.

Only after such legislation is in place, he said, should detailed regulations and guidelines be developed.

What Counts as Critical Infrastructure?

The discussion also raised concerns over Nepal's existing legal framework.

Although Nepal has laws concerning personal privacy, experts said there is still a lack of clear legal definitions regarding which types of data and infrastructure should be classified as critical.

Potentially critical sectors could include:

• Hospitals

• Banks and financial systems

• Power grids

• Telecommunications

• Transportation systems

• EV-related digital infrastructure

• Data centres and servers

Clearly defining such infrastructure would help authorities establish stronger security measures and responsibilities.

EV Growth Makes the Issue More Urgent

As EV adoption continues to increase in Nepal, the amount of data generated by connected vehicles is also expected to grow.

The discussion suggests that Nepal's challenge is no longer simply about expanding digital infrastructure but also about determining who controls, stores and protects the data generated by that infrastructure.

The government is now exploring the legal and technical requirements for keeping such data within Nepal, while experts are calling for stronger legislation to support any future policy.

Key Points

• Nepal is discussing ways to store EV-generated data within the country.

• EVs can collect location, battery, mileage and technical information.

• Some of this data is transmitted to foreign manufacturers' servers.

• Cybersecurity experts warn that compromised centralized systems could create security risks.

• The government is considering local servers for storing and protecting EV data.

• Experts say a strong national cybersecurity law is needed before detailed regulations can be effectively implemented.

• Nepal also needs clearer definitions of critical data and infrastructure.