KyrgyzstanDigital Code, cross-border transfer of personal data
Digital Code, Law No. 178, Art. 89
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of a Kyrgyzstani data subject, including a voiceprint or other biometric identifier, to a state the sectoral regulator has listed as adequate may do so freely. Transfer to a non-listed state requires the subject's consent, a qualifying treaty, statutory necessity, or contract necessity. Kyrgyzstan imposes no domestic-storage or localization requirement on the data itself.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which act sets the contract conditions that Article 89(4)(6) says "определяются отраслевым регулятором в сфере персональных данных" ("are determined by the sectoral regulator in the field of personal data"), for a transfer to a state that is not on the adequacy list?
- Does Article 89(5), under which transferred data "обрабатываются в соответствии с законодательством страны, в которую они переданы" ("are processed in accordance with the legislation of the country to which they are transferred"), end the record owner's duties under the Code once the data reach the recipient, including a processor acting for a Kyrgyz record owner?
- Article 1 defines cross-border transfer as "передача персональных данных владельцам записей, находящимся под юрисдикцией других государств" ("transfer of personal data to record owners under the jurisdiction of other states"); does storage on a foreign server, or transfer to a foreign processor that is not itself a record owner, count as a cross-border transfer under Article 89?
What it makes you log
Logging duty
Article 89 has the sectoral regulator approve and publish a list of foreign states ensuring adequate protection, bars prohibiting or restricting transfer to a listed state, and requires the record owner to check, before a transfer, that the destination is on the list (Article 89(3)); transfer to an unlisted state needs consent, a treaty, a statutory ground, a contract or protection of life (Article 89(4)). The check before transfer is a duty to verify, and no clause requires the record owner to document the check, keep a transfer log or show it to anyone. The Article names no audit and no territorial test. English: the owner must confirm the listing before transferring.
- Kind
- None
- As of
What this law does
Art. 89, read in full and confirmed word for word against the official portal, has the sectoral personal-data regulator approve and publish a list of foreign states ensuring adequate protection; transfer to a listed state is carried out under the Code and may not be prohibited or restricted, a notably strong free-flow guarantee once a state is listed, and the record-owner must verify a destination's listing before transferring.
Transfer to a non-listed state may still occur on subject consent, an international treaty, statutory necessity for the constitutional order, national defense, or state security, or contract necessity, with the article's remaining grounds past a fourth not extracted here. No localization or in-country-storage mandate was found anywhere in Art. 89 or elsewhere in what was read, a real jurisdictional contrast with Kazakhstan, Uzbekistan, Tajikistan, and Turkmenistan in this batch.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .