Duty LXD-0357
Trains models, in Kyrgyzstan
Law of the Kyrgyz Republic No. 6 of 14 January 1998 on Copyright and Related Rights (as amended to 2017)since 1 line
Law of the Kyrgyz Republic No. 6, , on Copyright and Related Rights, as amended by Law No. 42 of ; WIPO Lex doc kg146
- Obtain a licence or consent before reproducing Kyrgyz-hosted copyrighted works for AI training.
Law of the Kyrgyz Republic No. 58 of 14 April 2008 'On Personal Information' (as amended 2017, 2021, 2022)since 3 lines
Law of the Kyrgyz Republic No. 58, , 'On Personal Information' (Kyrgyz: 'Жеке мүнөздөгү маалымат жөнүндө'); as amended by Laws of , , and
- Register as a personal data holder in the national register.
- Complete a mandatory impact assessment for high-risk processing, including profiling and automated decisions.
- Obtain consent or another lawful basis before scraping personal data held in Kyrgyz-hosted systems for AI training.
Criminal Code, unauthorized access to computer informationsince 3 lines
Criminal Code of the Kyrgyz Republic, No. 127 (), Chapter 40, Art. 319 · Read the law's page
- Do not gain unauthorized access to another person's protected computer information, electronic documents, information system, or telecommunications network, including by defeating an access control, where doing so destroys, blocks, or modifies data or disrupts a processing device.
- A more serious tier applies where the access is committed by a group, causes major damage, reaches critical information infrastructure, or is undertaken to intentionally destroy, alter, or disable the system.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to violate this article.
Digital Code, digital resilience incident notificationsince 3 lines
Digital Code, Law No. 178, Art. 63 · Read the law's page
- Notify the sectoral regulator with jurisdiction over your sector no later than 72 hours after you discover the incident; if you notify later than that, explain the reason for the delay in the notice.
- If you process data as a processor for a record owner, notify that record owner of an incident within the period your contract sets, and in any event no later than 48 hours after you discover it.
- In every notification, describe the incident and estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences and the remedial measures already taken, and update the notification as new facts emerge.
- This binds any record owner or digital service provider whose digital environment reaches a user in Kyrgyzstan, on any incident affecting digital resilience or the rights and legitimate interests of a digital-environment participant, not only an incident that exposes personal data.
Digital Code, digital resilience baseline security measuressince 4 lines
Digital Code, Law No. 178, Art. 63(1)-(4) · Read the law's page
- This binds any subject of a digital-environment legal relationship whose record, resource, service, or technological system reaches a user in Kyrgyzstan, with no exemption for size or sector.
- Maintain the integrity and availability of your digital systems and the confidentiality of the digital data you process, monitor for and help prevent incidents in the digital environment, manage the resulting risk under a risk-management system, and dedicate the resources your continuity of operation and recovery from an incident require.
- If you operate critical information infrastructure, Kyrgyzstan's separate cybersecurity legislation, not analyzed in this instrument, sets the specific procedure you must follow for these measures and for incident monitoring and data exchange.
- Follow any measure the sectoral regulator for your sector directs you to take to prevent an incident in the digital environment or reduce its negative consequences; the regulator may issue binding instructions to that effect.