Русский 
From November 23, 2025, new requirements on personal data registration take effect in the Kyrgyz Republic
Starting from November 23, 2025, organizations and institutions that work with personal data will be required to register in the Register of Personal Data Holders.
This requirement applies to all entities that collect, store, and process citizens’ personal information — including government bodies, banks, IT companies, educational and medical institutions, as well as private organizations.
Why is the Register needed?
According to the State Agency for Personal Data Protection, the key objectives of the Register are to:
- safeguard the rights of personal data subjects,
- maintain records of data holders and data sets,
- ensure transparency of data processing,
- prevent unlawful use of information.
Thus, registration is not a formality but an important step toward building citizens’ trust and creating a secure digital environment.
Liability for violations
Under the Law of the Kyrgyz Republic “On Personal Information”, from November 2025, administrative liability will apply for handling personal data without registration:
- For individuals — fines (amount specified in secondary legislation).
- For officials — higher financial penalties.
- For legal entities — up to 120,000 KGS.
What qualifies as personal data?
Personal data includes:
- full name,
- passport details,
- contact information (phone, email, address),
- financial information,
- health records, and other data that can identify an individual.
Conclusion
The introduction of mandatory registration for personal data holders is a step towards strengthening digital trust and improving cybersecurity in Kyrgyzstan.
The Digital Resilience Association recommends that all organizations verify their registration status in advance and align their data handling processes with the legislation.
For consultations and clarifications, please contact the State Agency for Personal Data Protection.