Digital Code, sectoral regulator for personal data

Digital Code, Law No. 178, Art. 90 (State Agency for Protection of Personal Data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 8 months, effective 6 February 2026.

An enforcement supervision rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app processing Kyrgyzstani personal data answers to the State Agency for Protection of Personal Data, which maintains a register of record-holders and can inspect and issue orders under the Digital Code. No fine schedule or private right of action is confirmed; both should be checked directly against Digital Code Art. 90 before relying on their absence.

Who checks it

Audit expectation

continuous

Who audits it

Regulator, Registered or designated auditor

Where the report goes

Published summary

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Art. 90, read at the official source, requires the sectoral personal-data regulator to be created under Art. 9 of the Code and to be independent of the persons it oversees, with a head who must hold qualifications and experience in personal-data protection.

Art. 90(3) gives it real powers: applying and overseeing the Code; raising subject and controller awareness; advising state bodies; accrediting inspection bodies under Cabinet of Ministers procedure; hearing complaints and conducting inspections, including on its own initiative; taking preventive, corrective, and enforcement measures for violations; and publishing guidance. Art. 90(4) has it maintain a registry of record-owners recording incidents, inspection results, and binding decisions.

No fine schedule or private-right-of-action provision appears within Art. 90 or in the other provisions of the Code described here.

The Code's own text never names the regulator (it uses only "отраслевой регулятор в сфере персональных данных," sectoral regulator in the field of personal data, throughout, confirmed by a search finding zero occurrences of "Агентство" (Agency) anywhere in the Code); its identity as the State Agency for Protection of Personal Data (DPA) rests on the DPA's own official site, which describes itself in exactly these Digital-Code terms and institutionally predates the Code, having been established by a 2021 amendment to the now-repealed Law No. 58.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Read the law

official government portal
Centralized Bank of Legal Information of the Kyrgyz Republic (cbd.minjust.gov.kg), for Art. 90, which serves its full text only through a browser render: the URL itself serves only a 1,961-character JavaScript shell with zero hits for any Chapter 11 term, while a browser render returns the whole 657,172-character document State Agency for Protection of Personal Data official site (dpa.gov.kg) for the regulator's identity

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app