LexLint

Know the law your code answers to.

Law / Kyrgyzstan

Digital Code, digital resilience incident notification

Digital Code, Law No. 178, Art. 63

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 8 months, effective 6 February 2026.

A vulnerability and incident reporting rule binding public and private bodies.

As of 18 September 2026.

What it requires

  • This binds any record owner or digital service provider whose digital environment reaches a user in Kyrgyzstan, on any incident affecting digital resilience or the rights and legitimate interests of a digital-environment participant, not only an incident that exposes personal data.
  • Notify the sectoral regulator with jurisdiction over your sector no later than 72 hours after you discover the incident; if you notify later than that, explain the reason for the delay in the notice.
  • If you process data as a processor for a record owner, notify that record owner of an incident within the period your contract sets, and in any event no later than 48 hours after you discover it.
  • In every notification, describe the incident and estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences and the remedial measures already taken, and update the notification as new facts emerge.

Who enforces it

Enforcement body

The sectoral regulator with jurisdiction over the notifying record owner's or digital service provider's own sector, under Art. 63(4); the Digital Code names no single cybersecurity authority for this duty, and which body regulates a given sector is not stated in the primary text.

Settledness

As of
18 September 2026
Open questions
  • Which authority receives Art. 63(5)'s notification when the notifying record owner's or digital service provider's sector has no sectoral regulator the Digital Code itself names?
  • Does a failure to notify within Art. 63(5)'s 72-hour clock or Art. 63(6)'s 48-hour clock carry its own administrative or civil penalty, and if so under which provision of Kyrgyz law?

What it reaches

Obligation class

Reporting, Security

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 63, positioned in the Digital Code's general chapter on digital resilience outside its dedicated personal-data chapter, requires a record owner or digital service provider to notify the sectoral regulator of any incident in the digital environment affecting digital resilience or the rights and legitimate interests of a subject of a digital-environment legal relationship.

That notice is due no later than 72 hours after the record owner or digital service provider discovers the incident, and a notice given after that clock must explain the reason for the delay. A processor must separately notify the record owner of an incident within whatever period their contract or an applicable legal act sets, and in any event no later than 48 hours after discovering it.

The notification itself must describe the incident, estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences, and describe the remedial measures already taken. The record owner or digital service provider must update that notification as new facts about the incident or its consequences emerge.

The duty is triggered by an incident affecting digital resilience broadly, not only one exposing personal data, and Kyrgyzstan's dedicated personal-data chapter states no separate breach-notification article of its own.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach
  • high_risk_decisions
  • processes_voice
  • processes_biometrics
  • serves_minors
  • operates_social_platform
  • ships_mobile_app
  • distributes_software_product

Read the law

Official government portal
Centralized Bank of Legal Information of the Kyrgyz Republic (cbd.minjust.gov.kg), whose page at this URL serves only a JavaScript shell to a standard web request and required a browser render to read the full text confirmed directly against this URL

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app