Nepal stands at a remarkable crossroads. Fueled by its vast hydropower resources (over 95 percent of the country’s installed electricity capacity of around 3,400 megawatts now comes from hydroelectric projects) and supported by progressive energy and import policies, the country is undergoing one of the fastest transitions to electric mobility in the world.

In the first nine months of fiscal year 2024–25 alone, Nepal imported 10,036 electric vehicles (EVs) compared to 6,268 internal combustion engine (ICE) vehicles, according to the Department of Customs. EVs now make up over 70 percent of newly imported four-wheeled passenger vehicles, marking an exponential rise from just a few hundred units per year as recently as 2020. Nepal now stands second globally in EV market share among new vehicle sales, behind only Norway. If current trends continue, EVs will dominate Nepal’s national fleet within the next decade.

While this transition is important in the context of the environment, beneath the hum of cleaner engines lies a growing vulnerability: The risks to data security and digital sovereignty—especially given that the EV sector remains largely unregulated and susceptible to external control.

Today’s electric vehicles are no longer just machines that transport us from one point to another; they are sophisticated intelligent systems equipped with cameras, sensors, microphones, GPS, AI and continuous internet connectivity. In essence, each EV can also be considered a mobile node within a nationwide network of surveillance and data transmission. This network expands daily, largely invisible to the public and even the state when it remains unregulated.

The moment an EV is turned on, it begins collecting and transmitting a stream of data over the internet. Such data range from real-time location and driving routes to the driver’s chosen destination, all potentially linked to personal profiles, payment information and behavioural patterns.

What happens to this data? Who owns it? Where is it stored? Who has access? These are questions that even the world’s most advanced regulatory systems have yet to adequately resolve. With no clear legal or institutional framework, there is a risk that vast amounts of real-time behavioural and geospatial data—both Nepal’s citizens and public infrastructure—are being funnelled into opaque, proprietary systems that operate beyond the country’s jurisdiction and control.

The risks facing Nepal and its EV users are no longer theoretical. In January 2025, a data breach in Germany exposed personal data—including precise driving patterns and contact details—of some 800,000 EV users, via an unsecured cloud server of Cariad, Volkswagen’s connected-car software unit. In October 2024, cybersecurity researchers revealed that critical vulnerabilities in Phoenix Contact EV chargers could allow attackers to disrupt operations, steal data and even immobilise vehicles remotely. Likewise, in September 2023, The Los Angeles Times reported that major automakers were selling vehicle location and behaviour data to third-party brokers, with some sharing data with law enforcement or insurers without explicit customer consent.

If such breaches can occur in countries with strong privacy laws and mature digital infrastructure, the risk to Nepal is both real and immediate. As EV adoption accelerates and more state officials, diplomats, critical infrastructure personnel and members of the general public travel in vehicles capable of streaming audio, video and location data to foreign cloud servers, the threat extends far beyond personal privacy. It becomes a matter of national security and its adverse impact can transcend beyond borders too.

Nepal should be cautious about promoting electric vehicles (EVs) in a way that could upset the balance of power in the region. The policy measures must create a 'level playing field' rather than turning the situation into a 'battlefield' dominated by Chinese interests in the EV market. This could lead to significant tax concessions that undermine local entrepreneurship. Instead, the goal should be to develop an indigenous capacity for sustainable mobility, which is essential for the country's progress. Nepal’s hydroelectricity potential is promising, but it is marred by a rare dichotomy that is fuelled by underutilised production and dependence on power import from India during the peak seasons. The little progress made with the seasonal export of hydroelectricity gets eclipsed when Nepal has to look outside to meet the increased demand for power during the summer peak. India’s import guarantee for 10,000 MW of hydroelectricity (relatively a clean source) from Nepal is an opportunity that Nepal must seize to boost its economy and get the country back on track with sustainable industrialisation.

Another leap forward should be to enhance the recycling of EV batteries and other components that are highly hazardous to the environment if not dealt with promptly. The rise and shine of EVs will depend on the groundwork alone. Overlooking environmental and data-safety concerns can be detrimental and distract from an ideal course of green mobility transition in Nepal.

However, the concern should not be rooted in exclusion or excessive protectionism, but in prudence—by promoting an ecosystem that is transparent, accountable, and under local control.

This means establishing clear regulatory frameworks for data collection, storage, access and privacy to ensure that data generated by EVs remains protected. Nepal needs to ensure that such data is stored on sovereign, locally hosted servers, protected by enforceable laws and subject to oversight by domestic regulatory bodies. Manufacturers and service providers should be required to disclose data pathways, retention policies and any remote access capabilities. Without this foundational layer of governance, Nepal risks building a future transportation system whose intelligence is outsourced and sovereignty compromised.

The shift to electric mobility is a commendable leap into the future. However, the real future of Nepal’s clean mobility depends not only on green technology but on reclaiming control over the data that drives it. Without appropriate intervention, it risks trading climate actions to digital dependency—one that is far less visible, but far more dangerous.