Kyrgyzstan

Arts. 191-196, read in full, establish Kyrgyzstan's AI governance framework: Art. 191 sets non-binding design principles (risk reduction, openness, explainability, human oversight, accuracy, reliability, security) that any later binding requirement must implement, and Arts. 192-196 attach binding duties once an owner's own hazard assessment finds a system poses increased danger to a protected interest.

An owner of such a system must reassess and republish the hazard assessment at each life-cycle stage, meet Cabinet of Ministers risk-management and documentation requirements, keep operating logs, and declare conformity by a published, digitally signed document before deployment.

A user of such a system must operate it per its instructions, maintain effective human oversight, immediately suspend use and notify the owner once it has grounds to believe use could cause harm, keep logs, comply with a suspension or final court order, and, where the system's output feeds a rights-affecting decision, explain that result to an affected person on request free of charge; a person using the system solely for personal or family needs is excused most of these duties.

Chapter 23 states no duty for an owner or a user to notify the authorized state body of a suspension or of grounds to believe a system may cause harm: that body's role under Arts. 194(5)(7) and 196(1)(7) is to demand a suspension the owner or user must then carry out, enforceable by a final court act ordering the system's use to stop.

Article 126 of the Digital Code provides that artificial intelligence systems used to provide digital well-being are artificial intelligence systems of increased danger. A provider of a digital well-being service that uses artificial intelligence systems within the service must comply with the requirements the Code sets for artificial intelligence systems of increased danger.

The Code defines a digital well-being service as a service directed at improving the quality of life of a natural person on the basis of processing digital data on that person's physiological characteristics.

Art. 197, read in full, requires an owner or user of an AI system who applies it to interact with natural-person consumers to inform them they are dealing with an AI system, unless that is obvious from context; a user of a system that recognizes emotion or classifies a person by biometric characteristics must inform that person the system is being applied to them; and a user who applies such a system to create deepfakes must disclose that the material's origin or content was artificially produced or altered.

The consumer-interaction and biometric-classification duties are excused where disclosure would defeat a lawful defense, national-security, or crime-prevention purpose, and the deepfake duty is separately excused for lawful use protecting those same interests or exercising freedom of scientific, technical, artistic or educational creation, each excused case still conditioned on measures protecting the rights the disclosure would otherwise serve.

Art. 78, read in full, states lawfulness/fairness/transparency, purpose limitation, data minimization, accuracy, and storage-limitation principles in a structure closely tracking General Data Protection Regulation (GDPR) Art. 5. Art. 88, also read in full, requires privacy-by-design measures, an operations log kept per regulator guidance, a personal-data-responsible person for organizations with more than ten employees, and staff training, with the Cabinet of Ministers setting protection-level requirements by regulation.

Art. 77, read in full, confirms the chapter applies to any personal-data processing including within digital records and resources, exempts a natural person's purely personal or family processing, and voids any conflicting or unpublished regulation. Art. 79 (the general processing-grounds list) is outside the provisions described here.

The official government portal, cbd.minjust.gov.kg, serves the Digital Code's own page in full (81,674 characters), matching the third-party mirrors word for word, but returns only a client-rendered JavaScript shell without a full browser render; the citations here rest on that official page.

Art. 89, read in full and confirmed word for word against the official portal, has the sectoral personal-data regulator approve and publish a list of foreign states ensuring adequate protection; transfer to a listed state is carried out under the Code and may not be prohibited or restricted, a notably strong free-flow guarantee once a state is listed, and the record-owner must verify a destination's listing before transferring.

Transfer to a non-listed state may still occur on subject consent, an international treaty, statutory necessity for the constitutional order, national defense, or state security, or contract necessity, with the article's remaining grounds past a fourth not extracted here. No localization or in-country-storage mandate was found anywhere in Art. 89 or elsewhere in what was read, a real jurisdictional contrast with Kazakhstan, Uzbekistan, Tajikistan, and Turkmenistan in this batch.

Law 150 of 9 October 2026 adds Article 228¹¹ to the Code of the Kyrgyz Republic on Offenses. Article 228¹¹ makes it an administrative offense to breach the order, conditions and requirements set by law for processing and protecting personal data or personal-nature information, or to disseminate such information without authorization, where the act shows no features of a crime. The base fine is 25 calculation indices for an individual, 100 for an official and 650 for a legal entity.

The same act repeated within one year after a penalty carries 75, 300 and 1,200 calculation indices for an individual, an official and a legal entity. Where the act concerns the personal data of children or special categories of personal data, the fines are 75, 200 and 800 calculation indices. A repeat of that act within one year after a penalty carries 150, 400 and 1,400 calculation indices.

Transferring personal data abroad in breach of the legal requirements carries 75, 175 and 650 calculation indices. A repeat of that transfer within one year after a penalty carries 150, 350 and 1,200 calculation indices. The Law takes effect on the expiry of ten days from its official publication. The official gazette Erkin-Too published it on 13 October 2026.

Art. 90, read at the official source, requires the sectoral personal-data regulator to be created under Art. 9 of the Code and to be independent of the persons it oversees, with a head who must hold qualifications and experience in personal-data protection.

Art. 90(3) gives it real powers: applying and overseeing the Code; raising subject and controller awareness; advising state bodies; accrediting inspection bodies under Cabinet of Ministers procedure; hearing complaints and conducting inspections, including on its own initiative; taking preventive, corrective, and enforcement measures for violations; and publishing guidance. Art. 90(4) has it maintain a registry of record-owners recording incidents, inspection results, and binding decisions.

No fine schedule or private-right-of-action provision appears within Art. 90 or in the other provisions of the Code described here.

The Code's own text never names the regulator (it uses only "отраслевой регулятор в сфере персональных данных," sectoral regulator in the field of personal data, throughout, confirmed by a search finding zero occurrences of "Агентство" (Agency) anywhere in the Code); its identity as the State Agency for Protection of Personal Data (DPA) rests on the DPA's own official site, which describes itself in exactly these Digital-Code terms and institutionally predates the Code, having been established by a 2021 amendment to the now-repealed Law No. 58.

Art. 81(1) allows processing of a child's personal data only in the cases listed in Art. 81(2), and only where the processing is in the child's interest and the safeguards of the Article apply.

Art. 81(2) lists seven cases: a law that expressly requires the processing and sets its purposes, protection of the vital interests of the child or another person, medical and preventive purposes, public health or humanitarian aid, the administration of justice, national security, defense, public security or the prevention and prosecution of crime, and scientific, statistical or other research with appropriate data-protection measures and regard for the interests of children, or with anonymized records.

Where none of those cases applies, Art. 81(3) allows processing only with the consent of the child's legal representative, for the purposes for which it was given. A child who has reached the age of fourteen may give consent personally when exercising rights and duties within the capacity set by civil law.

Art. 81(4) requires the request for consent and the information about the processing to be written in clear, accessible language that a child can understand, and Art. 81(5) requires record owners to take the measures needed to prevent unlawful processing of children's personal data.

Art. 80(1), read in full and confirmed word for word against the official portal, prohibits processing by default: data revealing racial or ethnic origin, political views, religious or philosophical beliefs, or trade-union membership; genetic information; biometric data for the digital identification of a natural person; and data concerning health, sex life, or sexual orientation.

Art. 80(2) lifts the prohibition for contract necessity, explicit statutory authorization, vital-interest necessity, data the subject has explicitly made public, medical or public-health purposes, and (in part) membership processing by an association or religious organization.

No definition of biometric data as a general term was found anywhere in the official Code text (confirmed by a search for the root "биометрич" (biometric) across the whole document, which surfaces only Art. 48's state-system provisions and Art. 80(1)(3)'s bare category name); the only enumerated biometric-modality list in the Code is Art. 48(3)'s narrower, government-identification-system-specific list, confirmed at the official source to read exactly: digital facial image, papillary-pattern fingerprints of both hands, and handwritten signature, naming no voice modality, which should not be read as governing this general provision.

Art. 319(1), read in full, prohibits unauthorized access to someone else's protected computer information, electronic documents, an information system, or a telecommunications network, where the access results in destruction, blocking, or modification of information, or in disruption of processing devices, causing significant harm intentionally or through negligence; the base tier is community service, deprivation of the right to hold certain positions, correctional labor, or a fine of 200 to 500 calculated units.

Art. 319(2) raises the penalty to a fine of 500 to 1000 calculated units or imprisonment of up to five years where the act is committed by a group by prior agreement, causes major damage through negligence, or reaches critical information infrastructure.

Art. 319(3) sets the same 500-to-1000-unit or five-year tier for the same base conduct committed with intent to destroy, alter, block, or render unusable the information or to disable the system, and Art. 319(4) applies that tier's aggravating circumstances to the intentional form as well.

The same Chapter 40 separately criminalizes creating malicious software (Art. 320), cyber-sabotage (Art. 321), and unsolicited mass distribution of electronic messages that disrupts a system's operation (Art. 322), each read at the same source.

Because Art. 319's trigger is unauthorized access resulting in one of the listed harms, a scraper reading a public, unauthenticated page without defeating any access control, and without destroying, blocking, or modifying the page's information, falls outside a plain reading of the provision. Article 319 was set out anew by Article 11, point 1 of the Law of the Kyrgyz Republic of 18 January 2022 No. 4, On the Introduction of the Tax Code.

Article 23 of that Law brings it into force on 1 January 2022, except Articles 19 and 20 of that Law and two Tax Code provisions, which start on 1 January 2023.

The Law was published in the newspaper Erkin Too on 19 July 2024. The Law enters into force fifteen days after its official publication. Critical information infrastructure is the set of objects operating in public administration and state e-services, health, science, transport, telecommunications, the credit-financial sphere, defense, electricity, fuel, food and mining.

A critical information infrastructure subject must take the necessary measures to ensure the cybersecurity of its objects and meet the cybersecurity requirements for them. A critical information infrastructure subject must arrange a cybersecurity audit of the subject. The results of a cybersecurity audit of critical information infrastructure objects must be sent to the authorized state body, or to the National Bank for a subject it supervises.

A breach of the Law entails liability under the legislation of the Kyrgyz Republic. No commencement notice for the provisions this entry describes has been located.

Article 63(1) states that state regulation of digital resilience exists to ensure the continuity of operation of the subjects and objects of the digital environment and their recovery after an incident there, expressly recognizing the practical impossibility of fully protecting against one.

Article 63(2) requires every subject of a digital-environment legal relationship to achieve digital resilience by ensuring the integrity and availability of the objects of that relationship and the confidentiality of the digital data it processes. The same provision also requires monitoring for and helping prevent incidents in the digital environment and exchanging data about them, managing risk under a risk-management system, and managing the resources continuity of operation requires.

Article 63(3) reserves the specific procedure for integrity, availability, and confidentiality measures over critical information infrastructure, and for monitoring and exchanging data about incidents affecting it, to Kyrgyzstan's cybersecurity legislation, a body of law not described here. Article 63(4) lets a sectoral regulator direct measures a digital-environment participant must implement to prevent an incident or reduce its negative consequences, and binds the participant to follow them.

Article 63, positioned in the Digital Code's general chapter on digital resilience outside its dedicated personal-data chapter, requires a record owner or digital service provider to notify the sectoral regulator of any incident in the digital environment affecting digital resilience or the rights and legitimate interests of a subject of a digital-environment legal relationship.

That notice is due no later than 72 hours after the record owner or digital service provider discovers the incident, and a notice given after that clock must explain the reason for the delay. A processor must separately notify the record owner of an incident within whatever period their contract or an applicable legal act sets, and in any event no later than 48 hours after discovering it.

The notification itself must describe the incident, estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences, and describe the remedial measures already taken. The record owner or digital service provider must update that notification as new facts about the incident or its consequences emerge.

The duty is triggered by an incident affecting digital resilience broadly, not only one exposing personal data, and Kyrgyzstan's dedicated personal-data chapter states no separate breach-notification article of its own.

The Law defines a cyber incident as an event that breaches or stops the functioning of an information infrastructure object or breaches the security of the information it processes, including one caused by a cyberattack. Critical information infrastructure subjects must inform the authorized cybersecurity body of cyber incidents, or the National Bank where the subject is supervised by it.

Responsibility for immediate informing about cyber incidents rests with the heads of critical information infrastructure subjects and the staff responsible for cybersecurity. State bodies, local self-government bodies and enterprises with state participation must provide for the timely detection of unauthorized access to information and for immediately informing the authorized body. No commencement notice for the provisions this entry describes has been located.

Art. 74(2), read in full, fines distributing to children information that causes harm to their health or development and is prohibited for distribution among children, where the conduct does not amount to a criminal offense, at 20 calculation indicators for a natural person and 100 for a legal person.

Art. 74(3) raises that fine to 50 and 250 calculation indicators, respectively, where the same conduct is carried out using mass media or an information-telecommunications network, including the Internet. Contemporaneous press coverage of the amending law's signing reported the resulting fines as 2,000 som for a natural person and 10,000 som for a legal person, rising to 25,000 som for a legal person where the information was published in mass media or on the Internet.

Article 8, read in full, excludes 'daily news or information on current events that constitute regular press information' from copyright protection, alongside official documents, official symbols, and works of folk art, so a bare news item is not a copyrighted work to begin with.

Where a work is protected, Article 19(1)(1) permits, without the author's consent or payment of remuneration but on condition that the author's name and the source are given, quotation in the original language or in translation for scientific research, polemic, critical, or informational purposes from lawfully published works to the extent justified by the purpose, expressly including reproduction of extracts from newspaper and magazine articles in press reviews.

Article 19(1)(3), on the same conditions, permits reproducing in newspapers, by broadcast, or by cable, for general information, material newspapers or periodicals have published on current economic, political, social, or religious issues, or broadcast works of the same character, unless the author has specifically prohibited such reproduction, transfer to broadcast, or cable transmission.

Article 19(1)(4) further permits reproducing public political speeches, addresses, and lectures for an informatory purpose, with the author retaining the right to publish a collection of them. None of these provisions caps the length of a permitted extract beyond the fair-practice and purpose-justified test itself, and no reported Kyrgyz decision applies any of them to a systematic news aggregator rather than an individual quoting a published work.

Neighbouring rights under the Law (Arts. 34-47) protect performers, phonogram producers, and broadcasting or cable organizations, not a print or online news publisher's own reporting, so Kyrgyzstan has no publisher-side neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates. The Law entered into effect on the date of its publication in the newspaper Erkin Too, 23 January 1998.