Cyber Law at Kyrgyzstan
Kyrgyzstan has established a legal framework to address cybersecurity, data protection, and cybercrime, aligning with international standards and regional initiatives.
Cybersecurity and Data Protection
The primary legislation governing personal data in Kyrgyzstan is the Law on Personal Information (No. 58, April 14, 2008), amended in 2017 and 2021. This law regulates the collection, processing, and use of personal data to protect individuals' rights and freedoms. Key provisions include:
Scope and Definitions: The law applies to all personal data processing activities, including those using information technology. It defines personal data as recorded information about an identified or identifiable individual, encompassing biographical, financial, health, and other personal details.
Principles of Processing: Personal data must be processed lawfully, for specified purposes, and with the individual's consent. Data should be accurate, up-to-date, and stored no longer than necessary.
Rights of Data Subjects: Individuals have the right to access their personal data, request corrections, and object to processing. They can also seek legal remedies for violations of their rights.
Cross-Border Data Transfers: Transfers of personal data to other countries are permitted if the receiving country ensures an adequate level of protection or if the individual consents.
Security Measures: Data holders must implement legal, organizational, and technical measures to protect personal data from unauthorized access, alteration, or destruction.
The State Agency for Protection of Personal Data oversees compliance with this law and has collaborated with the Ministry of Internal Affairs to enhance personal data protection and cybersecurity efforts
Cybercrime Legislation
Kyrgyzstan's Criminal Code includes provisions addressing cybercrime:
Article 289: Criminalizes unauthorized access to computer information, including destruction, modification, or copying of data, or disruption of computer systems. Penalties range from fines to imprisonment, depending on the severity and circumstances.
Article 290: Addresses the creation, use, and dissemination of harmful computer viruses that cause unauthorized changes to programs, leading to data destruction or system disruption. Offenders may face imprisonment and fines, with more severe penalties for negligent acts causing significant harm.
International Cooperation
Kyrgyzstan participates in international initiatives to combat cybercrime. For instance, in February 2025, the Organization for Security and Co-operation in Europe (OSCE) conducted a workshop in Bishkek to enhance the capabilities of Kyrgyz law enforcement in investigating cybercrimes and handling electronic evidence
Conclusion
Kyrgyzstan's legal framework for cybersecurity and data protection aims to safeguard personal information and address cybercrimes effectively. Ongoing efforts to strengthen enforcement and international cooperation are crucial for adapting to the evolving digital landscape.
RELATED Blog
0 comments