Processes biometric data, in Kyrgyzstan

Digital Code, Law No. 178 (31 July 2025), in force 6 February 2026, Chapter 23, Art. 197 · Read the law's page

• An app that lets a natural person interact with an AI system must tell that person they are dealing with an AI system, unless the interaction is obviously with one.
• An app that uses an AI system to recognize a person's emotions or to classify a person by biometric characteristics must inform that person the system is being applied to them.
• An app that uses an AI system to create a deepfake must disclose that the material's origin or content was artificially produced or altered.
• These disclosure duties may be skipped only for a lawful defense, national-security or crime-prevention purpose, or, for the deepfake duty only, a lawful exercise of scientific, technical, artistic or educational freedom, and only with measures in place to protect the rights the disclosure would otherwise serve.

Digital Code, Law No. 178, Art. 63 · Read the law's page

• Notify the sectoral regulator with jurisdiction over your sector no later than 72 hours after you discover the incident; if you notify later than that, explain the reason for the delay in the notice.
• If you process data as a processor for a record owner, notify that record owner of an incident within the period your contract sets, and in any event no later than 48 hours after you discover it.
• In every notification, describe the incident and estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences and the remedial measures already taken, and update the notification as new facts emerge.
• This binds any record owner or digital service provider whose digital environment reaches a user in Kyrgyzstan, on any incident affecting digital resilience or the rights and legitimate interests of a digital-environment participant, not only an incident that exposes personal data.

Digital Code, Law No. 178, Art. 63(1)-(4) · Read the law's page

• This binds any subject of a digital-environment legal relationship whose record, resource, service, or technological system reaches a user in Kyrgyzstan, with no exemption for size or sector.
• Maintain the integrity and availability of your digital systems and the confidentiality of the digital data you process, monitor for and help prevent incidents in the digital environment, manage the resulting risk under a risk-management system, and dedicate the resources your continuity of operation and recovery from an incident require.
• If you operate critical information infrastructure, Kyrgyzstan's separate cybersecurity legislation, not analyzed in this instrument, sets the specific procedure you must follow for these measures and for incident monitoring and data exchange.
• Follow any measure the sectoral regulator for your sector directs you to take to prevent an incident in the digital environment or reduce its negative consequences; the regulator may issue binding instructions to that effect.

Digital Code, Law No. 178, Art. 80 · Read the law's page

• An app that processes biometric data for the digital identification of a Kyrgyzstani data subject, including a voiceprint or faceprint, must satisfy one of Art. 80(2)'s narrow lawful grounds before processing; such processing is prohibited by default otherwise. The Code itself supplies no illustrative list of biometric modalities for this general provision.

Digital Code, Law No. 178, Art. 89 · Read the law's page

• An app transferring the personal data of a Kyrgyzstani data subject, including a voiceprint or other biometric identifier, to a state the sectoral regulator has listed as adequate may do so freely. Transfer to a non-listed state requires the subject's consent, a qualifying treaty, statutory necessity, or contract necessity. Kyrgyzstan imposes no domestic-storage or localization requirement on the data itself.