Data protection & privacy laws in Kyrgyzstan (2026)

Law of the Kyrgyz Republic No. 58 'On Personal Information' (enacted 14 April 2008, most recently amended November 2021/July 2022) is the cornerstone data-protection statute, governing collection, processing, storage, and transfer of personal data by both public and private entities.

The State Agency for Personal Data Protection under the Cabinet of Ministers (dpa.gov.kg) was created by Presidential Decree of 14 September 2021 and formally registered on 10 January 2022. It conducts compliance inspections, registers data-array holders, and coordinates lists of personal data with holders.

Under Article 30 of the law, all holders of personal-data arrays must register with the State Agency. Administrative liability for operating without registration was activated from November 2025, with fines up to 120,000 KGS for legal entities.

Individuals hold rights to access, rectification, erasure, and blocking of inaccurate data, and may object to processing. Data holders must notify subjects of any third-party transfer of their personal data within one week.

Parliament adopted the Digital Code on 18 June 2025; President Japarov signed it and it entered into force approximately six months later (~December 2025). The Code consolidates rules on personal-data processing in digital services, AI systems, and telecommunications networks into a single legal instrument.

Violations of data-protection obligations carry administrative fines from 10,000 to 1,000,000 KGS (~USD 110–11,000) depending on severity, with additional ongoing daily fines until the non-compliance is remedied.