Duty LXD-8006
Is a payment provider, in Kyrgyzstan
Digital Code, digital resilience incident notificationsince 3 lines
Digital Code, Law No. 178, Art. 63 · Read the law's page
- Notify the sectoral regulator with jurisdiction over your sector no later than 72 hours after you discover the incident; if you notify later than that, explain the reason for the delay in the notice.
- If you process data as a processor for a record owner, notify that record owner of an incident within the period your contract sets, and in any event no later than 48 hours after you discover it.
- In every notification, describe the incident and estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences and the remedial measures already taken, and update the notification as new facts emerge.
- This binds any record owner or digital service provider whose digital environment reaches a user in Kyrgyzstan, on any incident affecting digital resilience or the rights and legitimate interests of a digital-environment participant, not only an incident that exposes personal data.
Law on Cybersecurity, informing of cyber incidentsin force2 lines
Law of the Kyrgyz Republic No. 121 () "On Cybersecurity of the Kyrgyz Republic", Arts. 8(5), 10(2) and 17 · Read the law's page
- Inform the authorized state body in the cybersecurity sphere of cyber incidents affecting your critical information infrastructure, or the National Bank if it supervises you (Article 10(2)(3)); the Law states no hour count, and your head and the staff responsible for cybersecurity answer for informing immediately (Article 8(5)).
- If you are a state body, local self-government body or an enterprise, organization or institution with state participation using information infrastructure objects, provide for timely detection of unauthorized access to information and for immediately informing the authorized state body, and pass on the known data on cyber threats and cyberattacks (Article 17).when it serves a public body
- Applies to a subject of critical information infrastructure, meaning a state body, local self-government body, or an enterprise, organization or institution that holds a critical information infrastructure object, in public administration and state e-services, health, science, transport, telecommunications, the credit-financial sphere, defense, electricity, fuel, food or mining (Article 8); the National Bank sets the points that name it for a subject it supervises.
Law on Cybersecurity, duties of critical information infrastructure subjectsin force4 lines
Law of the Kyrgyz Republic No. 121 () "On Cybersecurity of the Kyrgyz Republic", Arts. 8, 10, 12 and 15 · Read the law's page
- Take the necessary measures to ensure the cybersecurity of your critical information infrastructure objects and meet the cybersecurity requirements the Cabinet of Ministers sets for them by category of significance (Articles 10(2) and 12).
- Carry out the instructions and measures of the authorized state body in the cybersecurity sphere, or of the National Bank if it supervises you (Article 10(2)).
- Arrange a cybersecurity audit of your entity, and send the audit results for your critical information infrastructure objects to the authorized state body, or to the National Bank if it supervises you (Articles 10(2) and 15(1)).
- Your head and the staff responsible for cybersecurity answer for the security of the objects, for immediate informing about cyber incidents and for arranging the audit (Article 8(5)).
- Applies to a subject of critical information infrastructure, meaning a state body, local self-government body, or an enterprise, organization or institution that holds a critical information infrastructure object, in public administration and state e-services, health, science, transport, telecommunications, the credit-financial sphere, defense, electricity, fuel, food or mining (Article 8); the National Bank sets the points that name it for a subject it supervises.