What Is Digital Code of the Kyrgyz Republic?
Kyrgyzstan’s current principal privacy instrument is the Digital Code of the Kyrgyz Republic, enacted on 31 July 2025 as No. 178. Law No. 179 repealed the former 2008 Law on Personal Information, and the Digital Code began applying in February 2026 after the repeal law was officially published on 5 August 2025. No later amending text was located in the current-edition materials reviewed, so the framework should be refreshed against the live CBD edition before publication. The Digital Code provides a detailed rights framework, including mostly seven-working-day deadlines for access information, correction notices, and reasoned decisions on objections. The State Agency for Personal Data Protection may receive complaints, inspect, order correction, blocking, or deletion, suspend unlawful processing, and issue binding decisions. However, Article 90 does not specify a fixed deadline for complaint acknowledgment, investigation, or final decision, and no GDPR-style extraterritorial-targeting clause was located.
At a glance
- Full name
- Digital Code of the Kyrgyz Republic
- Short code
- Digital Code
- Jurisdiction
- Kyrgyzstan
- Enacted
- 2025
- Last major update
- Digital Code No. 178 enacted 31 July 2025 and operative from February 2026 after Law No. 179 repealed the 2008 law; no later amending text was located
- Regulator
- State Agency for Personal Data Protection under the Cabinet of Ministers
- Private right of action
- Limited
- Statutory citation
- Digital Code of the Kyrgyz Republic, No. 178, 31 July 2025
Scope, who Digital Code covers
Protected data
Data subject rights
Right to information before collection or within 7 working days when data came from another source
Right of access and to receive a copy, generally within 7 working days
Right to correction or completion, with notice to the data subject within 7 working days
Right to portable transfer or supply for contract- or consent-based data
Right to withdraw consent, subject to other applicable Article 79 grounds
Right to immediate deletion where the data is no longer needed, the basis has ended, consent is withdrawn without another basis, or objection grounds require deletion, subject to retention exceptions
Right to object to automated decisions, unfair or discriminatory processing, and certain digital-community processing, with a reasoned decision within 7 working days where applicable
Right to restriction while an objection is reviewed, a regulator order is pending, or correction or deletion is pending
Right to demand that qualifying automated decisions with legal or similarly significant effects stop and receive human review
Right to complain to the State Agency for Personal Data Protection or proceed to court
Notable features
The Digital Code is a wholesale replacement of the repealed 2008 framework and has applied only since February 2026. It combines detailed rights and several seven-working-day subject-request deadlines with an adequate-protection country list and multiple legal bases or safeguards for transfers to non-listed countries. Official materials are in Kyrgyz and Russian; any English translation is a reference aid only.
Enforcement & penalties
Regulator: State Agency for Personal Data Protection under the Cabinet of Ministers
Penalties: Under the Code of Offenses as amended by Law No. 95 of 19 May 2025, unlawful collection, storage, processing, protection, transmission, or dissemination may attract 75 calculation units for individuals, 100 for officials, and 650 for legal entities; repeat violations within one year may attract 250, 300, and 1,200 respectively. Incomplete or inaccurate register information or unregistered processing may attract 450 units for a legal entity. Unlawful cross-border transfer may attract 150 units for individuals, 175 for officials, and 650 for legal entities, with repeat amounts of 300, 350, and 1,000. Unjustified refusal to provide processing information may attract 250 units, or 450 for a repeat violation, and non-compliance with a lawful regulator requirement may attract 100 units for individuals, 200 for officials, and 300 for legal entities.
Private right of action: Appeals to the regulator or court and restoration, cessation, damages, and moral compensation in applicable digital-rights cases are the identified mechanisms; no general private action applying to every privacy dispute was identified.
Relevance to data brokers
No Kyrgyzstan-specific data-broker complaint or deletion route was located. The current Code contains general rules for public or open digital records, including access, attribution, metadata, and certain distribution controls, but no identified data-broker procedure or dedicated public-record deletion process. The repealed 2008 law’s public-array removal provision is historical and must not be presented as current law.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
Is Kyrgyzstan’s current privacy law the former 2008 personal-information law?+
No. The former standalone law is repealed. The Digital Code of the Kyrgyz Republic, No. 178, enacted on 31 July 2025, is the current principal instrument and began applying in February 2026.
Does Kyrgyzstan have a dedicated data-broker deletion route?+
Not located. The current Code has no identified data-broker procedure or dedicated public-record deletion process. The available route is to request deletion or other rights from the relevant owner, then complain to the Agency or proceed to court.
How quickly must a Kyrgyz data owner respond?+
Several subject-rights steps use seven-working-day periods: access is generally within 7 working days, correction notice is due within 7 working days, and a qualifying objection requires a reasoned decision within 7 working days.
Official sources & citations
Other international privacy regimes
Digital Code sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: