Law on Personal Data Protection Kyrgyzstan

Regulation Summary

All organizations processing personal data in Kyrgyzstan, including public and private entities.
Foreign businesses processing data of Kyrgyz residents, if they operate within Kyrgyzstan or use local infrastructure.
Entities handling sensitive data such as biometric, health, or financial information.

Personal or household use of personal data.
Government authorities processing data for national security, taxation, or law enforcement purposes.
Journalistic, literary, academic, or artistic work complying with ethical guidelines.

Lawful Processing: Businesses must process personal data with consent or a legitimate legal basis.
Purpose Limitation: Data must only be used for specified and lawful purposes.
Data Security: Companies must implement security measures to prevent unauthorized access or breaches.
Accountability: Businesses must document their data processing activities and appoint a responsible officer where applicable.

Cookie Consent: Websites must obtain user consent for the use of non-essential cookies.
Privacy Notice: A transparent and accessible privacy policy must be provided.
User Rights Portal: Websites should facilitate requests for data access, correction, or deletion.
Secure Data Transmission: Encryption and secure handling of collected personal data are required.

Cross-Border Data Transfers: Permitted only if the recipient country provides adequate protection, safeguards are in place, or explicit consent is obtained in accordance with international agreements.
Data Protection Officer (DPO): Required for organizations engaged in large-scale or sensitive data processing.
Impact Assessments: Mandatory for high-risk data processing, including profiling and automated decision-making.

Access: Individuals can request copies of their personal data.
Rectification: Right to correct incorrect or incomplete data.
Erasure: Right to request deletion of personal data in certain circumstances.
Portability: Right to obtain and transfer personal data.
Objection: Right to refuse data processing for direct marketing or other specified purposes.
Restriction: Right to limit processing under specific conditions.

Regulatory Body: The State Agency for Protection of Personal Data oversees compliance.
Fines: Violations can result in fines ranging from 10,000 to 1,000,000 Kyrgyzstani Soms (~$110 to $11,000 USD)depending on the severity, with additional daily fines for continued non-compliance until corrective actions are taken.
Sanctions: In serious cases, businesses may face suspension of data processing activities, and responsible individuals may be subject to criminal penalties, including imprisonment.