🇰🇬

Kyrgyzstan

Law on Personal Information (2008, as amended)

Asia🟡 Moderate

Compliance Score

14%

2 Addressed

9 Partial

3 None

Authority

State Agency for Personal Data Protection / designated competent authority

Overview

Kyrgyzstan’s personal data protection framework underwent a fundamental overhaul in 2026. The Digital Code, adopted on 31 July 2025 and in force since 5 February 2026, replaced the long-outdated 2008 Law on Personal Information . Enforcement is now vested in the State Agency for the Protection of Personal Data under the Cabinet of Ministers, established in 2021 but only recently equipped with real sanctioning power . Amendments to the Code of Offenses introduced in May 2025 and effective November 2025 created a graduated penalty regime: violations of data processing rules trigger fines of up to 650 calculation units for legal entities, rising to 1,200 units for repeat offenses; unlawful cross-border transfers carry fines of up to 1,000 units; and failure to comply with Agency requests attracts additional penalties . Registration in the Register of Personal Data Holders remains a formal obligation, though the Digital Code removed certain registration-related fines . The framework still lacks dedicated provisions for artificial intelligence and automated decision-making, and cookie-specific rules remain absent. Organisations processing Kyrgyz data should reassess compliance against the post-2026 regime rather than relying on the pre-Digital Code framework.

14-Topic Coverage Analysis

Data Protection Authority

Partial

Consent Requirements

Addressed

Data Subject Rights

Addressed

Cross-Border Transfer

Partial

Breach Notification

Partial

DPO Requirements

Partial

Children's Data

Partial

Penalties & Enforcement

Partial

Sector-Specific Rules

Partial

Cookie/Tracking

None

AI & Automated Decisions

None

Data Localisation

Partial

Significant Data Fiduciary

None

Government Data

Partial

? Frequently Asked Questions

What are the penalties for non-compliance in Kyrgyzstan?+

Kyrgyzstan's data protection framework (2008) is outdated and enforcement is weak. There are no significant penalties for non-compliance compared to modern laws like GDPR or DPDPA. However, organizations should still follow best practices.

Does Kyrgyzstan require a Data Protection Officer (DPO)?+

Partially. The law may require a DPO only for specific high-risk organizations or sectors. It is not universally mandatory for all businesses.

How does Kyrgyzstan handle cross-border data transfers?+

Cross-border transfers are generally permitted, but the law allows the state to restrict transfers to countries that do not provide adequate protection for personal data.