Kyrgyzstan. Comprehensive data protection. Code
Digital CodeDigital Code of the Kyrgyz Republic (No. 178)
Partly verified
Medium confidence.Breach notification, DPO and localisation rules under the Code not verified. Authority URL not verified.
§1Summary
- Synopsis
Consolidated code regulating the digital environment, including a modernised personal data regime that replaced the 2008 Law on Personal Information. It sets processing principles, rights, DPIA duties and transfer rules, and abolishes the old registration requirement for personal data holders.
- Key themes
- Unique features
Mandatory DPIA for special-category data on more than 1,000 people or systematic monitoring of public spaces (art 82); security measures scale by information system protection level.
- SaaS relevance
SaaS processing Kyrgyz residents' data must apply the Code's processing and transfer rules; unlawful cross-border transfer is separately fined.
§2Obligations
- Cross-border transfers
- Adequacy list of countries; transfers elsewhere need a legal basis or safeguards
- Maximum penalty
- Legal entities up to 1,200 calculation units for repeat unlawful processing (Code on Offences)
§3Dates
- Key dates
- Adopted
- In force
- Signed 2025-07-31; in force six months after publication (2026-02-05; ICNL note gives 2026-02-08); Code on Offences amendments (Law No. 95 of 2025-05-19) with data protection fines from 2025-11-23; Cabinet Resolutions No. 347 (2026-05-18, accredited inspections) and No. 384 (2026-06-02, security levels).
§4Text and authority
- Text
- Authoritative text cbd.minjust.gov.kg
- Authority
- State Agency for Personal Data Protection under the Cabinet of Ministers
§5Where it applies
- Domestic law of
- Kyrgyzstan
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Breach notification, DPO and localisation rules under the Code not verified. Authority URL not verified.