Source Code Secrecy in Nepal: Layers That Actually Hold
Source code secrecy in Nepal runs on layers: automatic copyright, NDA discipline, registration of the core, and the trade-secret law still in the Bill.
Your codebase is the most copyable asset a Nepali software company owns: one repository clone and the valuable part of the business is gone. And Nepal has no dedicated trade-secret statute to sue with.
That is not a reason for fatalism — it is a reason for architecture. The companies that keep code safe here do it with layers, each one answering a different kind of leak.
In short
Source code secrecy in Nepal is a layered exercise: copyright protects the code as written automatically from creation, with voluntary registration at the Copyright Registrar's Office as dated evidence for the core; NDAs and access discipline carry the secrecy load while trade-secret protection remains contractual; and the Industrial Property Bill 2082 proposes statutory trade-secret protection for the future. The name and logo of the product are separate trademark work.
Why source code secrecy in Nepal is a layered job
Nepal protects code through the Copyright Act, 2059 (2002) — protection is automatic, from creation, for the code as written. What the Act does not do is protect the ideas, algorithms and methods the code embodies; those live or die as secrets.
Trade secrets in Nepal currently stand on contract: NDAs are enforceable as agreements, and the Industrial Property Bill 2082 proposes a statutory trade-secret regime — but until it is enacted, that content is proposed, and the discipline that wins is documentary.
The secrecy layers for a codebase
| Layer | Protects | Instrument |
|---|---|---|
| Copyright | The code as written — expression, not ideas | Automatic; voluntary NCRO registration for the core as dated evidence |
| Secrecy | Algorithms, parameters, data structures before they are public | NDAs plus access control — the contract layer that works today |
| Patent | A qualifying method or process — Section 2(a) of the PDTA | Disclosure trade-off: a patent publishes what secrecy would have kept |
| Trademark | The product name and logo | Separate Schedule 1(c) filing per class at the DOI |
The copyright layer you already have
Copyright needs no filing, but proof is a different question. Voluntary registration with the Copyright Registrar's Office gives a government-issued, dated record of authorship and ownership — presumptive evidence that shifts the burden in a dispute and satisfies the diligence of investors and acquirers.
Register selectively: the core modules that differentiate the product, not every repository. The deposit shows what the code looked like on a date certain — which is precisely the fact a departing-employee dispute turns on.
A working secrecy protocol
Five steps, run in order, cover most Nepali software teams:
Classify the codebase
Separate what is genuinely differentiating from commodity code. Only the first category earns secrecy overhead.
Paper every person with access
Employee IP assignment agreements plus NDAs for staff; different NDA terms for vendors and contractors. The documents differ, and so does the leak risk.
Control the access, not just the people
Least-privilege repositories, key management and logs — the technical half of secrecy that no contract replaces.
Register the core
NCRO registration of the differentiating modules creates the dated evidence file.
Plan the exits
Departing employees are the most common leak route; the exit conversation is easier when the assignment, NDA and access records are already in order.
What NDAs actually give you before the new law
An NDA's strength is contractual: defined confidentiality obligations, defined consequences, a defined term. It will not conjure a statutory trade-secret claim, but it documents the secret's existence, the obligation and the breach — the three facts any future proceeding, under the current law or the proposed one, will ask for.
Pair the paper with habit: code reviews that never paste secrets into tickets, and demos that never show the internals. Most source code leaks in Nepal are casual, not criminal.
The brand layer runs in parallel
The code is half the asset. The name users search for, the app-store listing and the logo are trademark territory — a Schedule 1(c) filing at the Department of Industry, one class per application (Class 9 for the software, Class 42 for the services, in the usual pattern).
File the brand while the code is still secret; first-to-file does not wait for the launch.
Want this handled for your brand?
IP Watch monitors new trademark publications in Nepal and alerts you to potentially conflicting marks — with the context needed to review them.
This article is general information, not legal advice.