Published
10/13/2026, 11:23Customer databases, staff records or information about children may give rise to financial penalties if they are collected, stored or transferred in breach of the law. New fines for the handling of personal data have been introduced in Kyrgyzstan. The highest penalty for legal entities – 140,000 KGS – applies to repeat offences involving children’s data or special categories of personal data.
President Sadyr Zhaparov signed the amendments to the Code of Administrative Offences on 9 October. The law covers the entire data lifecycle, from collection and storage to transmission, modification and destruction. Liability applies both to the unauthorised dissemination of data and to failure to comply with requirements regarding its processing and protection.
For companies, the cost of a breach will depend on the nature of the data and whether they have been held liable previously.
| Breach | First fine for a legal entity | In the event of a repeat offence |
|---|---|---|
| Failure to comply with data processing and protection requirements, unauthorised dissemination of data | 65,000 KGS | 120,000 KGS |
| Breaches involving children’s data or special categories of data | 80,000 KGS | 140,000 KGS |
| Transfer of data abroad in breach of established requirements | 65,000 KGS | 120,000 KGS |
A breach is considered a repeat offence if it is committed within one year of a penalty being imposed. In normal cases, the fine for a legal entity is almost doubled in such instances — from 65,000 KGS to 120,000 KGS.
Liability is also provided for individuals and public officials. The maximum fines under the new article for them will be 15,000 KGS and 40,000 KGS respectively — for a repeat infringement relating to children’s data or special categories of data.
