KyrgyzstanDigital Code, comprehensive personal data regime
Digital Code, Law No. 178 (), in force , Chapter 11, Arts. 78, 88
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal data of individuals in Kyrgyzstan must process it lawfully, fairly, and transparently, limit use to the stated purpose, minimize what is collected, keep it accurate, and limit retention to the processing purpose. An organization with more than ten employees must designate a personal-data-responsible person and provide staff training.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.AT-P1The workforce is informed and trained on its roles and responsibilities.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which provisions of the Digital Code govern the processing of "информации персонального характера, не являющейся цифровыми персональными данными" ("personal-nature information that is not digital personal data") under Article 77(1), and does the principles article, Article 78, apply to it?
- Is the sectoral regulator's guidance binding on a record owner when Article 88(2)(2) requires it to keep a log of operations "в соответствии с рекомендациями отраслевого регулятора в сфере персональных данных" ("in accordance with the recommendations of the sectoral regulator in the field of personal data"), and has the regulator issued any such recommendations?
- Does the count of "работников" ("employees") in the duty to name a responsible person "для организаций с количеством работников более десяти человек" ("for organizations with more than ten employees") include individuals engaged under contract, a term that Article 1 of the Digital Code does not define?
- Which instrument sets the "уровнями защищенности персональных данных" ("levels of protection of personal data") that Article 88(3) tells the Cabinet of Ministers to apply when it sets protection requirements?
What it makes you log
Logging duty
Article 88(2)(2) of the Digital Code requires the record owner (владелец записей) to keep an account of operations with personal records ("ведет учет операций с персональными записями") in accordance with the recommendations of the sectoral regulator in the field of personal data. The Article states no fields for that account, so the contents list is empty, and it names no period for keeping it, no audit and no person entitled to examine it; the regulator's information and inspection powers are in Article 90, which this row does not cite. Article 78(7) adds that the record owner is responsible for the principles of Article 78 and must be able to confirm compliance with them, which also presupposes a record. Article 78(5) limits storage of the personal data itself, not a log. The Articles cited here state no territorial test; Article 77, which sets the chapter's scope, is not cited by this row. English: the record owner keeps an account of operations with personal records in line with the regulator's recommendations.
- Kind
- Explicit
- As of
- Provision
- Article 88(2)(2) (the record owner keeps an account of operations with personal records in accordance with the sectoral regulator's recommendations), with Article 78(7) (the owner must be able to confirm compliance with the principles)
- Trigger
- personal_data_processing
What this law does
Art. 78, read in full, states lawfulness/fairness/transparency, purpose limitation, data minimization, accuracy, and storage-limitation principles in a structure closely tracking General Data Protection Regulation (GDPR) Art. 5. Art. 88, also read in full, requires privacy-by-design measures, an operations log kept per regulator guidance, a personal-data-responsible person for organizations with more than ten employees, and staff training, with the Cabinet of Ministers setting protection-level requirements by regulation.
Art. 77, read in full, confirms the chapter applies to any personal-data processing including within digital records and resources, exempts a natural person's purely personal or family processing, and voids any conflicting or unpublished regulation. Art. 79 (the general processing-grounds list) is outside the provisions described here.
The official government portal, cbd.minjust.gov.kg, serves the Digital Code's own page in full (81,674 characters), matching the third-party mirrors word for word, but returns only a client-rendered JavaScript shell without a full browser render; the citations here rest on that official page.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .