Duty LXD-0952
Processes personal data, in Kyrgyzstan
Each law's tag says when it binds: since in force from a date not yet set not yet in force
Digital Code, comprehensive personal data regimesince 1 line
Digital Code, Law No. 178 (), in force , Chapter 11, Arts. 78, 88 · Read the law's page
- An app that collects, uses, or discloses the personal data of individuals in Kyrgyzstan must process it lawfully, fairly, and transparently, limit use to the stated purpose, minimize what is collected, keep it accurate, and limit retention to the processing purpose. An organization with more than ten employees must designate a personal-data-responsible person and provide staff training.
Digital Code, digital resilience incident notificationsince 3 lines
Digital Code, Law No. 178, Art. 63 · Read the law's page
- Notify the sectoral regulator with jurisdiction over your sector no later than 72 hours after you discover the incident; if you notify later than that, explain the reason for the delay in the notice.
- If you process data as a processor for a record owner, notify that record owner of an incident within the period your contract sets, and in any event no later than 48 hours after you discover it.
- In every notification, describe the incident and estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences and the remedial measures already taken, and update the notification as new facts emerge.
- This binds any record owner or digital service provider whose digital environment reaches a user in Kyrgyzstan, on any incident affecting digital resilience or the rights and legitimate interests of a digital-environment participant, not only an incident that exposes personal data.
Digital Code, digital resilience baseline security measuressince 4 lines
Digital Code, Law No. 178, Art. 63(1)-(4) · Read the law's page
- This binds any subject of a digital-environment legal relationship whose record, resource, service, or technological system reaches a user in Kyrgyzstan, with no exemption for size or sector.
- Maintain the integrity and availability of your digital systems and the confidentiality of the digital data you process, monitor for and help prevent incidents in the digital environment, manage the resulting risk under a risk-management system, and dedicate the resources your continuity of operation and recovery from an incident require.
- If you operate critical information infrastructure, Kyrgyzstan's separate cybersecurity legislation, not analyzed in this instrument, sets the specific procedure you must follow for these measures and for incident monitoring and data exchange.
- Follow any measure the sectoral regulator for your sector directs you to take to prevent an incident in the digital environment or reduce its negative consequences; the regulator may issue binding instructions to that effect.
Digital Code, processing of children's personal datasince 4 lines
Digital Code, Law No. 178, Art. 81 · Read the law's page
- Process a child's personal data only where one of the cases in Art. 81(2) applies and the processing is in the child's interest, such as a law that expressly requires it, protection of the child's vital interests, medical purposes, or research with appropriate data-protection measures.
- Where no Art. 81(2) case applies, obtain the consent of the child's legal representative, for the purposes for which it was given; a child who has reached fourteen may consent personally when exercising rights and duties within the capacity set by civil law.
- Write the request for consent, and the information about the processing, in clear and accessible language a child can understand.
- As a record owner, take the measures needed to prevent unlawful processing of children's personal data.
Digital Code, cross-border transfer of personal datasince 1 line
Digital Code, Law No. 178, Art. 89 · Read the law's page
- An app transferring the personal data of a Kyrgyzstani data subject, including a voiceprint or other biometric identifier, to a state the sectoral regulator has listed as adequate may do so freely. Transfer to a non-listed state requires the subject's consent, a qualifying treaty, statutory necessity, or contract necessity. Kyrgyzstan imposes no domestic-storage or localization requirement on the data itself.
Digital Code, sectoral regulator for personal datasince 1 line
Digital Code, Law No. 178, Art. 90 (State Agency for Protection of Personal Data) · Read the law's page
- An app processing Kyrgyzstani personal data answers to the State Agency for Protection of Personal Data, which maintains a register of record-holders and can inspect and issue orders under the Digital Code. No fine schedule or private right of action is confirmed; both should be checked directly against Digital Code Art. 90 before relying on their absence.
Code on Offenses, administrative fines for personal data breachesfrom a date not yet set1 line
Code of the Kyrgyz Republic on Offenses of No. 128, Art. 228-11, as added by Law 150 of · Read the law's page
- An app that processes personal data or personal-nature information of people in Kyrgyzstan must follow the order, conditions and requirements that Kyrgyz law sets for processing and protecting it, must not disseminate it without authorization, must meet the requirements that apply to children's data and to special categories of personal data, and must transfer personal data abroad only as Kyrgyz law allows.