Skip to content
World Watch

Data protection & privacy law in Kyrgyzstan (2026)

Data protection in Kyrgyzstan: comprehensive law.

Kyrgyzstan enacted its foundational personal-data statute in 2008 (Law No. 58 'On Personal Information'), with significant amendments in 2021-2022 that strengthened rights and obligations. A dedicated supervisory body, the State Agency for Personal Data Protection, was established in January 2022 to enforce compliance and maintain a mandatory registry of data-array holders. In 2025, President Japarov signed a comprehensive Digital Code into law, adding consolidated rules on personal-data processing in digital environments, artificial intelligence systems, and telecommunications, which entered into force approximately December 2025.

Last verified Official sources first · MethodologyCompare Kyrgyzstan with other countries

Legal framework

Law of the Kyrgyz Republic 'On Personal Information' (No. 58, 2008, as amended 2021/2022); supplemented by the Digital Code (signed 2025, in force ~December 2025). Supervised by the State Agency for Personal Data Protection under the Cabinet of Ministers (dpa.gov.kg), established January 2022.

Key points: data & privacy in Kyrgyzstan

  1. Primary legislation

    Law of the Kyrgyz Republic No. 58 'On Personal Information' (enacted 14 April 2008, most recently amended November 2021/July 2022) is the cornerstone data-protection statute, governing collection, processing, storage, and transfer of personal data by both public and private entities.

    dpa.gov.kg

  2. Supervisory authority

    The State Agency for Personal Data Protection under the Cabinet of Ministers (dpa.gov.kg) was created by Presidential Decree of 14 September 2021 and formally registered on 10 January 2022. It conducts compliance inspections, registers data-array holders, and coordinates lists of personal data with holders.

    dpa.gov.kg dpa.gov.kg

  3. Mandatory registration

    Under Article 30 of the law, all holders of personal-data arrays must register with the State Agency. Administrative liability for operating without registration was activated from November 2025, with fines up to 120,000 KGS for legal entities.

    dresilience.org dpa.gov.kg

  4. Data-subject rights

    Individuals hold rights to access, rectification, erasure, and blocking of inaccurate data, and may object to processing. Data holders must notify subjects of any third-party transfer of their personal data within one week.

    dpa.gov.kg dpa.gov.kg

  5. Digital Code (2025, in force)

    Parliament adopted the Digital Code on 18 June 2025; President Japarov signed it and it entered into force approximately six months later (~December 2025). The Code consolidates rules on personal-data processing in digital services, AI systems, and telecommunications networks into a single legal instrument.

    caspianpost.com akchabar.kg

  6. Penalties

    Violations of data-protection obligations carry administrative fines from 10,000 to 1,000,000 KGS (~USD 110-11,000) depending on severity, with additional ongoing daily fines until the non-compliance is remedied.

    dlapiperdataprotection.com dresilience.org

Sources

  1. dpa.gov.kg/en/npa/4
  2. dpa.gov.kg/en/about
  3. dpa.gov.kg/en/npa/13
  4. dpa.gov.kg/en/question/7
  5. dresilience.org/en/2025/09/12/mandatory-registration-of-personal-data-array-holders-w
  6. caspianpost.com/kyrgyzstan/kyrgyzstan-s-president-sadyr-japarov-signs-digital-code-in
  7. akchabar.kg/en/news/prezident-podpisal-tsifrovoj-kodeks-kak-on-povliyaet-na-zhizn
  8. dlapiperdataprotection.com/?t=law&c=KG

Next for Kyrgyzstan: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026