KyrgyzstanCode on Offenses, administrative fines for personal data breaches
Code of the Kyrgyz Republic on Offenses of No. 128, Art. 228-11, as added by Law 150 of
An enforcement supervision rule binding public and private bodies.
As of .
What it requires
- An app that processes personal data or personal-nature information of people in Kyrgyzstan must follow the order, conditions and requirements that Kyrgyz law sets for processing and protecting it, must not disseminate it without authorization, must meet the requirements that apply to children's data and to special categories of personal data, and must transfer personal data abroad only as Kyrgyz law allows.
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What this law does
Law 150 of adds Article 228¹¹ to the Code of the Kyrgyz Republic on Offenses. Article 228¹¹ makes it an administrative offense to breach the order, conditions and requirements set by law for processing and protecting personal data or personal-nature information, or to disseminate such information without authorization, where the act shows no features of a crime. The base fine is 25 calculation indices for an individual, 100 for an official and 650 for a legal entity.
The same act repeated within one year after a penalty carries 75, 300 and 1,200 calculation indices for an individual, an official and a legal entity. Where the act concerns the personal data of children or special categories of personal data, the fines are 75, 200 and 800 calculation indices. A repeat of that act within one year after a penalty carries 150, 400 and 1,400 calculation indices.
Transferring personal data abroad in breach of the legal requirements carries 75, 175 and 650 calculation indices. A repeat of that transfer within one year after a penalty carries 150, 350 and 1,200 calculation indices. The Law takes effect on the expiry of ten days from its official publication. The official gazette Erkin-Too published it on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings or processes biometric data.