Skip to content
World Watch

Data protection & privacy law in Bhutan (2026)

Data protection in Bhutan: sectoral rules.

Bhutan has no standalone comprehensive data protection law and no dedicated Data Protection Authority. Privacy obligations are fragmented across sector-specific instruments: the ICMA 2018 provides minimal online-privacy and payment-security provisions for ICT/media services, the RMA's 2021 Guidelines impose data protection requirements on financial institutions, and the National Digital Identity Act 2023 introduces a self-sovereign identity model with built-in personal-data controls. Bhutan's National Cybersecurity Strategy 2024-2029 formally identifies the absence of a dedicated data privacy law as a legal gap requiring legislative action.

Last verified Official sources first · MethodologyCompare Bhutan with other countries

Legal framework

Information, Communications and Media Act (ICMA) 2018 administered by Bhutan InfoComm and Media Authority (BICMA); supplemented by Royal Monetary Authority (RMA) Guidelines on Data Privacy and Data Protection 2021 (financial sector) and National Digital Identity Act 2023

Key points: data & privacy in Bhutan

  1. ICMA 2018, primary privacy instrument

    The Information, Communications and Media Act 2018, enforced by BICMA, is Bhutan's broadest privacy-adjacent law. It covers online privacy, unsolicited commercial communications, and payment-transaction security for ICT and media service providers, but does not establish comprehensive data-subject rights or general data-processor obligations.

    bicma.gov.bt nab.gov.bt

  2. RMA Guidelines 2021, financial-sector rules

    The Royal Monetary Authority issued sector-specific Guidelines on Data Privacy and Data Protection in 2021, binding on licensed financial institutions. These represent the most detailed data-handling obligations currently in force in Bhutan, but apply only to the financial sector.

    rma.org.bt rma.org.bt

  3. National Digital Identity Act 2023

    Enacted by Parliament in 2023, the NDI Act establishes a self-sovereign identity framework (biometric digital wallet) giving citizens selective control over personal-data disclosure. It includes built-in data-protection principles for the national digital-identity system but does not constitute a general-purpose data protection law.

    iambasnet.com

  4. BICMA Code of Practice 2024

    In 2024 BICMA issued a Code of Practice for Information Security, Cybersecurity and Privacy Protection for ICT Service Providers, extending specific security and privacy-protection obligations to regulated ICT operators under the ICMA framework.

    bicma.gov.bt

  5. National Cybersecurity Strategy 2024-2029, legislative gaps acknowledged

    Bhutan's government-published National Cybersecurity Strategy 2024-2029 explicitly identifies the lack of a dedicated data privacy law as a gap and calls for new or amended legislation covering data privacy and Critical Information Infrastructure Protection, signalling intent to legislate but no enacted law as of mid-2026.

    tech.gov.bt tech.gov.bt

  6. No dedicated Data Protection Authority

    Bhutan has no standalone Data Protection Authority. BICMA (under the Ministry of Information and Communications) oversees ICT/media privacy; the RMA supervises financial-sector data rules. There is no cross-sectoral supervisory body with general data-protection enforcement powers.

    bicma.gov.bt dataguidance.com

Sources

  1. bicma.gov.bt/?page_id=31
  2. nab.gov.bt/assets/uploads/docs/bills/2016/FinalBICMAbill2016Eng.pdf
  3. rma.org.bt/media/Laws_By_Laws/Guidelines%20on%20Data%20Privacy%20and%20Data%20Pr
  4. rma.org.bt/legislation/
  5. bicma.gov.bt/wp-content/uploads/2024/10/Code-of-Practice-for-Information-Security-
  6. tech.gov.bt/wp-content/uploads/2025/05/National-Cybersecurity-Strategy_Published.
  7. tech.gov.bt/national-cybersecurity-strategy/
  8. iambasnet.com/blog/bhutan/national-digital-identity-system-in-bhutan---meeting-data
  9. dataguidance.com/jurisdiction/bhutan
  10. dig.watch/resource/national-cybersecurity-strategy-of-bhutan-2024-2029
  11. bicma.gov.bt/

Next for Bhutan: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026