Law:  Law of the Kyrgyz Republic of 14 April 2008 No. 58 on Personal Information as amended by the Law of the Kyrgyz Republic of 20 July 2017 No. 129 (only available in Kyrgyz here and Russian here) ('the Law on Personal Data')

Regulator: There is no general data protection authority.

Summary: At present, the Law on Personal Data provides general requirements on both data controllers and processors, as well as data subject rights and data transfers. However, the Law on Personal Data does not address either data protection officers or data breach notifications requirements. In addition to the above, other laws such as the Constitution of the Kyrgyz Republic (only available in Kyrgyz here and Russian here) and the Criminal Code of the Kyrgyz Republic (only available in Russian here and Kyrgyz here) still apply in respect to violations of the right to private life. Notably, an authority to regulate the Law on Personal Data has yet to be announced and thus there has yet to be any enforcement action related to the data protection or further guidance on compliance.