All organizations and institutions that collect, store and process personal data must undergo mandatory registration in the Registry of Holders (Owners) of Personal Data Arrays.
As the State Agency for Personal Data Protection under the Cabinet of Ministers reported, from the beginning of 2026, administrative liability will be applied for processing personal data without registration in the registry. According to the agency, the corresponding changes were made to the Code of Offenses on May 19.
Registration in the registry is carried out entirely online through the official website of the state agency. To register, the holder must log in through the Unified Identification System (USI) using the cloud electronic signature of a legal entity.
The state agency strongly recommends that all entities processing personal data register in the registry in the prescribed manner in order to avoid legal consequences.
On May 19, President Sadyr Japarov signed amendments to the Code of the Kyrgyz Republic on Offenses, which introduce liability for:
- Violation of personal data protection requirements;
- Cross-border transfer of personal data in violation of the procedure established by law;
- Unreasonable refusal by the holder (owner) of a personal data array to provide the subject with his or her personal data;
- Failure to comply with the legal requirements of the authorized state body for personal data.
Fines range from 30,000 to 65,000 soms.
