Kyrgyzstan

Arts. 191-196, read in full, establish Kyrgyzstan's AI governance framework: Art. 191 sets non-binding design principles (risk reduction, openness, explainability, human oversight, accuracy, reliability, security) that any later binding requirement must implement, and Arts. 192-196 attach binding duties once an owner's own hazard assessment finds a system poses increased danger to a protected interest.

An owner of such a system must reassess and republish the hazard assessment at each life-cycle stage, meet Cabinet of Ministers risk-management and documentation requirements, keep operating logs, and declare conformity by a published, digitally signed document before deployment.

A user of such a system must operate it per its instructions, maintain effective human oversight, immediately suspend use and notify the owner once it has grounds to believe use could cause harm, keep logs, comply with a suspension or final court order, and, where the system's output feeds a rights-affecting decision, explain that result to an affected person on request free of charge; a person using the system solely for personal or family needs is excused most of these duties.

Chapter 23 states no duty for an owner or a user to notify the authorized state body of a suspension or of grounds to believe a system may cause harm: that body's role under Arts. 194(5)(7) and 196(1)(7) is to demand a suspension the owner or user must then carry out, enforceable by a final court act ordering the system's use to stop.

Art. 197, read in full, requires an owner or user of an AI system who applies it to interact with natural-person consumers to inform them they are dealing with an AI system, unless that is obvious from context; a user of a system that recognizes emotion or classifies a person by biometric characteristics must inform that person the system is being applied to them; and a user who applies such a system to create deepfakes must disclose that the material's origin or content was artificially produced or altered.

The consumer-interaction and biometric-classification duties are excused where disclosure would defeat a lawful defense, national-security, or crime-prevention purpose, and the deepfake duty is separately excused for lawful use protecting those same interests or exercising freedom of scientific, technical, artistic or educational creation, each excused case still conditioned on measures protecting the rights the disclosure would otherwise serve.

Art. 78, read in full, states lawfulness/fairness/transparency, purpose limitation, data minimization, accuracy, and storage-limitation principles in a structure closely tracking General Data Protection Regulation (GDPR) Art. 5. Art. 88, also read in full, requires privacy-by-design measures, an operations log kept per regulator guidance, a personal-data-responsible person for organizations with more than ten employees, and staff training, with the Cabinet of Ministers setting protection-level requirements by regulation.

Art. 77, read in full, confirms the chapter applies to any personal-data processing including within digital records and resources, exempts a natural person's purely personal or family processing, and voids any conflicting or unpublished regulation. Art. 79 (the general processing-grounds list) is outside the provisions described here.

The official government portal, cbd.minjust.gov.kg, serves the Digital Code's own page in full (81,674 characters), matching the third-party mirrors word for word, but returns only a client-rendered JavaScript shell without a full browser render; the citations here rest on that official page.

Art. 89, read in full and confirmed word for word against the official portal, has the sectoral personal-data regulator approve and publish a list of foreign states ensuring adequate protection; transfer to a listed state is carried out under the Code and may not be prohibited or restricted, a notably strong free-flow guarantee once a state is listed, and the record-owner must verify a destination's listing before transferring.

Transfer to a non-listed state may still occur on subject consent, an international treaty, statutory necessity for the constitutional order, national defense, or state security, or contract necessity, with the article's remaining grounds past a fourth not extracted here. No localization or in-country-storage mandate was found anywhere in Art. 89 or elsewhere in what was read, a real jurisdictional contrast with Kazakhstan, Uzbekistan, Tajikistan, and Turkmenistan in this batch.

Art. 90, read at the official source, requires the sectoral personal-data regulator to be created under Art. 9 of the Code and to be independent of the persons it oversees, with a head who must hold qualifications and experience in personal-data protection.

Art. 90(3) gives it real powers: applying and overseeing the Code; raising subject and controller awareness; advising state bodies; accrediting inspection bodies under Cabinet of Ministers procedure; hearing complaints and conducting inspections, including on its own initiative; taking preventive, corrective, and enforcement measures for violations; and publishing guidance. Art. 90(4) has it maintain a registry of record-owners recording incidents, inspection results, and binding decisions.

No fine schedule or private-right-of-action provision appears within Art. 90 or in the other provisions of the Code described here.

The Code's own text never names the regulator (it uses only "отраслевой регулятор в сфере персональных данных," sectoral regulator in the field of personal data, throughout, confirmed by a search finding zero occurrences of "Агентство" (Agency) anywhere in the Code); its identity as the State Agency for Protection of Personal Data (DPA) rests on the DPA's own official site, which describes itself in exactly these Digital-Code terms and institutionally predates the Code, having been established by a 2021 amendment to the now-repealed Law No. 58.

Art. 80(1), read in full and confirmed word for word against the official portal, prohibits processing by default: data revealing racial or ethnic origin, political views, religious or philosophical beliefs, or trade-union membership; genetic information; biometric data for the digital identification of a natural person; and data concerning health, sex life, or sexual orientation.

Art. 80(2) lifts the prohibition for contract necessity, explicit statutory authorization, vital-interest necessity, data the subject has explicitly made public, medical or public-health purposes, and (in part) membership processing by an association or religious organization.

No definition of biometric data as a general term was found anywhere in the official Code text (confirmed by a search for the root "биометрич" (biometric) across the whole document, which surfaces only Art. 48's state-system provisions and Art. 80(1)(3)'s bare category name); the only enumerated biometric-modality list in the Code is Art. 48(3)'s narrower, government-identification-system-specific list, confirmed at the official source to read exactly: digital facial image, papillary-pattern fingerprints of both hands, and handwritten signature, naming no voice modality, which should not be read as governing this general provision.

Art. 319(1), read in full, prohibits unauthorized access to someone else's protected computer information, electronic documents, an information system, or a telecommunications network, where the access results in destruction, blocking, or modification of information, or in disruption of processing devices, causing significant harm intentionally or through negligence; the base tier is community service, deprivation of the right to hold certain positions, correctional labor, or a fine of 200 to 500 calculated units.

Art. 319(2) raises the penalty to a fine of 500 to 1000 calculated units or imprisonment of up to five years where the act is committed by a group by prior agreement, causes major damage through negligence, or reaches critical information infrastructure.

Art. 319(3) sets the same 500-to-1000-unit or five-year tier for the same base conduct committed with intent to destroy, alter, block, or render unusable the information or to disable the system, and Art. 319(4) applies that tier's aggravating circumstances to the intentional form as well.

The same Chapter 40 separately criminalizes creating malicious software (Art. 320), cyber-sabotage (Art. 321), and unsolicited mass distribution of electronic messages that disrupts a system's operation (Art. 322), each read at the same source.

Because Art. 319's trigger is unauthorized access resulting in one of the listed harms, a scraper reading a public, unauthenticated page without defeating any access control, and without destroying, blocking, or modifying the page's information, falls outside a plain reading of the provision.

The Code's own text, as archived, carries no commencement clause; it was enacted by a separate introducing law (Law of the Kyrgyz Republic of 28 October 2021 No. 126) whose commencement date is not confirmed in the primary text, so the Code's own in-force status rests on its own extensive amendment history running from January 2022 through January 2024.

Article 63(1) states that state regulation of digital resilience exists to ensure the continuity of operation of the subjects and objects of the digital environment and their recovery after an incident there, expressly recognizing the practical impossibility of fully protecting against one.

Article 63(2) requires every subject of a digital-environment legal relationship to achieve digital resilience by ensuring the integrity and availability of the objects of that relationship and the confidentiality of the digital data it processes. The same provision also requires monitoring for and helping prevent incidents in the digital environment and exchanging data about them, managing risk under a risk-management system, and managing the resources continuity of operation requires.

Article 63(3) reserves the specific procedure for integrity, availability, and confidentiality measures over critical information infrastructure, and for monitoring and exchanging data about incidents affecting it, to Kyrgyzstan's cybersecurity legislation, a body of law not described here. Article 63(4) lets a sectoral regulator direct measures a digital-environment participant must implement to prevent an incident or reduce its negative consequences, and binds the participant to follow them.

Article 63, positioned in the Digital Code's general chapter on digital resilience outside its dedicated personal-data chapter, requires a record owner or digital service provider to notify the sectoral regulator of any incident in the digital environment affecting digital resilience or the rights and legitimate interests of a subject of a digital-environment legal relationship.

That notice is due no later than 72 hours after the record owner or digital service provider discovers the incident, and a notice given after that clock must explain the reason for the delay. A processor must separately notify the record owner of an incident within whatever period their contract or an applicable legal act sets, and in any event no later than 48 hours after discovering it.

The notification itself must describe the incident, estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences, and describe the remedial measures already taken. The record owner or digital service provider must update that notification as new facts about the incident or its consequences emerge.

The duty is triggered by an incident affecting digital resilience broadly, not only one exposing personal data, and Kyrgyzstan's dedicated personal-data chapter states no separate breach-notification article of its own.

Art. 74(2), read in full, fines distributing to children information that causes harm to their health or development and is prohibited for distribution among children, where the conduct does not amount to a criminal offense, at 20 calculation indicators for a natural person and 100 for a legal person.

Art. 74(3) raises that fine to 50 and 250 calculation indicators, respectively, where the same conduct is carried out using mass media or an information-telecommunications network, including the Internet. Contemporaneous press coverage of the amending law's signing reported the resulting fines as 2,000 som for a natural person and 10,000 som for a legal person, rising to 25,000 som for a legal person where the information was published in mass media or on the Internet.

Article 8, read in full, excludes 'daily news or information on current events that constitute regular press information' from copyright protection, alongside official documents, official symbols, and works of folk art, so a bare news item is not a copyrighted work to begin with.

Where a work is protected, Article 19(1)(1) permits, without the author's consent or payment of remuneration but on condition that the author's name and the source are given, quotation in the original language or in translation for scientific research, polemic, critical, or informational purposes from lawfully published works to the extent justified by the purpose, expressly including reproduction of extracts from newspaper and magazine articles in press reviews.

Article 19(1)(3), on the same conditions, permits reproducing in newspapers, by broadcast, or by cable, for general information, material newspapers or periodicals have published on current economic, political, social, or religious issues, or broadcast works of the same character, unless the author has specifically prohibited such reproduction, transfer to broadcast, or cable transmission.

Article 19(1)(4) further permits reproducing public political speeches, addresses, and lectures for an informatory purpose, with the author retaining the right to publish a collection of them. None of these provisions caps the length of a permitted extract beyond the fair-practice and purpose-justified test itself, and no reported Kyrgyz decision applies any of them to a systematic news aggregator rather than an individual quoting a published work.

Neighbouring rights under the Law (Arts. 34-47) protect performers, phonogram producers, and broadcasting or cable organizations, not a print or online news publisher's own reporting, so Kyrgyzstan has no publisher-side neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates. The Law entered into effect on the date of its publication in the newspaper Erkin Too, 23 January 1998.