Private laboratories in Kyrgyzstan investigated for violations in the handling of personal data

The State Agency for Personal Data Protection inspected 17 private laboratories and diagnostic centers for compliance with the Law on Personal Information. Violations were found in a number of institutions, ranging from the absence of responsible persons and clear regulations to unrestricted access to patients' personal information and failure to comply with data retention periods.

The inspection found violations in some institutions related to the lack of adequate measures to protect personal data and identified the following typical violations:

• No distinction between access rights to processed data;
• Uncertainty regarding the official responsible for organizing the processing and protection of personal data;
• Unspecified or excessive personal data storage periods;
• Non-compliance of the form and content of personal data subjects' consent with legal requirements, including when transferring data to third parties;
• No list of current threats to personal data security;
• Unapproved or absent personal data processing policy;
• Unclear level of information system security;
• No proper mechanisms for logging actions involving personal data.

On May 19, 2025, amendments to the Code of Offenses came into force, increasing liability for violations of personal data processing procedures. The authorities are calling on all organizations working with personal information to bring their processes into compliance with the law in order to protect the rights of citizens and maintain patient trust.