KyrgyzstanDigital Code, digital resilience incident notification
Digital Code, Law No. 178, Art. 63
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds any record owner or digital service provider whose digital environment reaches a user in Kyrgyzstan, on any incident affecting digital resilience or the rights and legitimate interests of a digital-environment participant, not only an incident that exposes personal data.
- Notify the sectoral regulator with jurisdiction over your sector no later than 72 hours after you discover the incident; if you notify later than that, explain the reason for the delay in the notice.
- If you process data as a processor for a record owner, notify that record owner of an incident within the period your contract sets, and in any event no later than 48 hours after you discover it.
- In every notification, describe the incident and estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences and the remedial measures already taken, and update the notification as new facts emerge.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
The sectoral regulator with jurisdiction over the notifying record owner's or digital service provider's own sector, under Art. 63(4); the Digital Code names no single cybersecurity authority for this duty, and which body regulates a given sector is not stated in the primary text.
Settledness
- As of
- Open questions
- Article 9(2) lists only three spheres of sectoral regulation, "персональные данные" ("personal data"), "национальная цифровая экосистема" ("national digital ecosystem") and "телекоммуникации" ("telecommunications"); which authority is the "отраслевого регулятора" ("sectoral regulator") that Article 63(5) requires a record owner or digital service provider to notify when its activity falls in none of them?
- Does the procedure that Article 63(3) leaves to the "законодательством Кыргызской Республики в сфере обеспечения кибербезопасности" ("legislation of the Kyrgyz Republic in the sphere of ensuring cybersecurity") for "мониторинга инцидентов в цифровой среде и обмена данными о них" ("monitoring incidents in the digital environment and exchanging data on them") replace or add to the notice that Article 63(5) requires within 72 hours?
- Which provision of Kyrgyz law attaches a penalty to a failure to notify within Article 63(5)'s 72 hours or Article 63(6)'s 48 hours, given that Article 68(1) provides that offenses in the digital environment bring "ответственность в соответствии с применимым законодательством" ("liability in accordance with applicable legislation")?
What this law does
Article 63, positioned in the Digital Code's general chapter on digital resilience outside its dedicated personal-data chapter, requires a record owner or digital service provider to notify the sectoral regulator of any incident in the digital environment affecting digital resilience or the rights and legitimate interests of a subject of a digital-environment legal relationship.
That notice is due no later than 72 hours after the record owner or digital service provider discovers the incident, and a notice given after that clock must explain the reason for the delay. A processor must separately notify the record owner of an incident within whatever period their contract or an applicable legal act sets, and in any event no later than 48 hours after discovering it.
The notification itself must describe the incident, estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences, and describe the remedial measures already taken. The record owner or digital service provider must update that notification as new facts about the incident or its consequences emerge.
The duty is triggered by an incident affecting digital resilience broadly, not only one exposing personal data, and Kyrgyzstan's dedicated personal-data chapter states no separate breach-notification article of its own.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .