KyrgyzstanDigital Code, sectoral regulator for personal data
Digital Code, Law No. 178, Art. 90 (State Agency for Protection of Personal Data)
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- continuous
- Who audits it
- Regulator, Registered or designated auditor
- Where the report goes
- Published summary
What it requires
- An app processing Kyrgyzstani personal data answers to the State Agency for Protection of Personal Data, which maintains a register of record-holders and can inspect and issue orders under the Digital Code. No fine schedule or private right of action is confirmed; both should be checked directly against Digital Code Art. 90 before relying on their absence.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Which Cabinet of Ministers decision approves the regulations of the personal-data regulator, as Article 9(3) provides ("Положения об отраслевых регуляторах утверждаются Кабинетом Министров", "the regulations on sectoral regulators are approved by the Cabinet of Ministers"), and does it make the State Agency for Personal Data Protection under the Cabinet of Ministers the body that Article 90(1) describes as "создаваемым в порядке, установленном статьей 9 настоящего Кодекса" ("created in the manner established by Article 9 of this Code")?
- Which statute is the "законодательством Кыргызской Республики о порядке проведения проверок субъектов предпринимательства" ("legislation of the Kyrgyz Republic on the procedure for inspecting business entities") that Article 90(3)(7) applies to inspections of businesses, and does it limit the regulator's inspections on its own initiative?
- Does Article 90(4) oblige "владельцев записей" ("record owners") to be entered in the registry, or does it direct the regulator only to record incidents, inspection results and liability?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 90 sets up the sectoral regulator and its powers and does not require a record owner to keep a log. The register in Article 90(4) is kept by the regulator itself, entering incidents with personal data, inspections and binding decisions, and the regulator's annual report is Article 90(6). Article 90(7)(1) and (2) let the regulator demand information from persons and organizations and enter premises and examine documents, equipment and staff of a record owner, and Article 90(3)(7) lets it inspect on its own initiative; those powers are why the regulator can ask for a record, and the audit keys already on this row describe that supervision. The record owner's own account of operations is Article 88(2)(2), which this row does not cite. The Article names no territorial test. English: the regulator keeps a register of record owners and may demand information and documents.
- Kind
- None
- As of
What this law does
Art. 90, read at the official source, requires the sectoral personal-data regulator to be created under Art. 9 of the Code and to be independent of the persons it oversees, with a head who must hold qualifications and experience in personal-data protection.
Art. 90(3) gives it real powers: applying and overseeing the Code; raising subject and controller awareness; advising state bodies; accrediting inspection bodies under Cabinet of Ministers procedure; hearing complaints and conducting inspections, including on its own initiative; taking preventive, corrective, and enforcement measures for violations; and publishing guidance. Art. 90(4) has it maintain a registry of record-owners recording incidents, inspection results, and binding decisions.
No fine schedule or private-right-of-action provision appears within Art. 90 or in the other provisions of the Code described here.
The Code's own text never names the regulator (it uses only "отраслевой регулятор в сфере персональных данных," sectoral regulator in the field of personal data, throughout, confirmed by a search finding zero occurrences of "Агентство" (Agency) anywhere in the Code); its identity as the State Agency for Protection of Personal Data (DPA) rests on the DPA's own official site, which describes itself in exactly these Digital-Code terms and institutionally predates the Code, having been established by a 2021 amendment to the now-repealed Law No. 58.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .