Personal data protection in the Kyrgyz Republic is no longer a formality. In 2025, regulatory oversight is becoming stricter, and almost any organization working with clients, employees, contractors, or beneficiaries is legally recognized as a personal data controller.
This article provides a practical overview of what businesses must do to comply with personal data legislation and minimize legal risks.
What Is Considered Personal Data?
Personal data is any recorded information that directly or indirectly identifies an individual, including:
- full name;
- passport and identification details;
- address, phone number, e-mail;
- information about family status, income, education, employment, or health.
Importantly, personal data is not limited to passport details. Customer data in online stores, mobile apps, HR files, and CRM systems are all covered by the law.
Who Must Register as a Personal Data Controller?
Under the Law of the Kyrgyz Republic “On Personal Information”, registration of personal data controllers is mandatory.
Controllers include:
- employers;
- online stores and digital platforms;
- medical and educational institutions;
- banks and insurance companies;
- travel agencies;
- non-profit organizations and foundations;
- IT companies and startups.
Registration is carried out through:
- the website of the State Agency for Personal Data Protection;
- exclusively via the national digital identification system “Tunduk”.
Failure to register is treated as a direct violation of the law.
Liability and Fines in 2025
Starting from November 2025, increased administrative sanctions apply:
- up to 65,000 KGS for legal entities for collecting, storing, or processing personal data without registration;
- fines also apply for submitting incomplete or inaccurate information to the official register.
For businesses, this means that non-compliance is no longer a theoretical risk but a real financial exposure.