DataGuidance confirmed with Chynara Esengeldieva, Managing Director of Lorenz Law Firm, on 18 July 2017, that a Draft Law on Amending the Law of the Kyrgyz Republic on Personal Information ('the Draft Law') had been passed by the Parliament of Kyrgyzstan. The Draft Law amends the Law of the Kyrgyz Republic of 14 April 2008 No. 51 on Personal Information, to provide new rights for data subjects and create data security obligations on holders of personal data.

Esengeldieva outlined, "[P]ursuant to the draft Law, a personal data holder, if requested, should provide a [data subject] with information related to processing of their personal data, containing the legal grounds and objectives of the personal data processing; the terms for personal data processing and its storage; the procedure for exercising the personal data owner’s rights; and, on executed or planned personal data transfers, among other information."

Additionally, Esengeldieva explained, "The Draft Law stipulates that the personal data holder and data processor shall implement and/or ensure the implementation of necessary legal, organisational and technical measures [to prevent] the illegal or accidental access, change, blocking, copying, providing, and distribution of the personal data, as well as other illegal actions related to the personal data."

The Draft Law must now be signed by the President of Kyrgyzstan.

You can view the Parliament's announcement here, track the progress of the Draft Law here and view the Draft Law here, all only available in Russian.