NIST Privacy Framework, Govern-PGV.AT-P1

Take legal, organizational and technical measures against unauthorized or accidental access, modification, termination, copying, dissemination, transmission or erasure of personal data, appoint a data protection officer or a dedicated unit, publish your data processing policy, and train staff who handle personal data, under Article 17.

Implement technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or alteration, confine internal access to what each role requires, and train staff on their data protection duties.

An app that collects, uses, or discloses the personal data of individuals in Kyrgyzstan must process it lawfully, fairly, and transparently, limit use to the stated purpose, minimize what is collected, keep it accurate, and limit retention to the processing purpose. An organization with more than ten employees must designate a personal-data-responsible person and provide staff training.

Follow schedules for monitoring, evaluating and maintaining the data security system, and for organisation-wide internal sensitisation and training on data privacy.

Take security measures appropriate to the risk of unauthorized access, alteration, or loss of personal data, taking the state of technology and the cost of the measures into account, and make sure staff know and follow them.

When processing sensitive personal data, build the capacity of staff involved, control who can access it, and apply technical and organisational measures appropriate to the risk, including storing it separately and applying tokenisation, pseudonymisation or encryption where appropriate.

Maintain your own written do-not-call policy, train personnel in it, and honor an individual's request not to be called by you again within a reasonable time not to exceed ten business days.