14. Personal Data

DATA

14.1. Legal Framework

The Digital Code of the Kyrgyz Republic is a comprehensive regulatory act governing relations in the digital environment, including the processing of personal data, digital services, digital platforms, digital ecosystems, and cross-border data exchange. In terms of personal data protection, the code establishes the rights of data subjects, the obligations of organizations processing data, as well as requirements for security and cross-border data transfer.

Personal data are digital data containing personal information. This is any information that allows direct or indirect identification of a person. For example, full name, biometric data, personal identification number, marital status, email address, phone number, bank details, health status, nationality.

A data subject is recognized as a natural person to whom the personal data relate. Companies that collect and use personal data of employees, clients, and other natural persons generally act as owners of personal data records and bear primary responsibility for compliance with personal data protection legislation.

Such companies are obliged to implement a set of organizational and technical measures:

• implement privacy by design, i.e., consider users' interests and the data lifecycle already at the stage of designing digital systems;

• maintain records of operations with personal data in accordance with the regulator's recommendations;

• appoint a person responsible for personal data processing for organizations with more than ten employees;

• organize employee training on data handling rules.

The Digital Code establishes an exhaustive list of lawful grounds for personal data processing. Processing is permitted if it is necessary for at least one of the following purposes:

performance of a contract to which the data subject is a party, or preparation for its conclusion at the initiative of the data subject

performance by the record owner of obligations established by law or regulatory legal acts

protection of the vital interests of the data subject or another natural person; implementation of public or socially beneficial tasks (protection of human life, humanitarian, environmental objectives)

realization of the legitimate interests of the record owner or a third party provided that the rights and freedoms of the data subject are not violated

In the absence of the listed grounds, processing is possible only based on the consent of the data subject, and exclusively for those purposes for which consent has been obtained. The legislation establishes strict requirements for consent. It must be voluntary, specific, informed, and conscious.

Data subjects are endowed with rights subject to protection, including:

• the right to receive information about processing;

• the right to access their personal data;

• the right to correct and supplement data;

• the right to data portability;

• the right to data deletion;

• the right to object to processing;

• the right to restrict processing.

The Digital Code also regulates cross-border transfer of personal data. Data transfer to foreign states is permitted subject to compliance with the legislation of the Kyrgyz Republic, including the presence of the data subject's consent, an international treaty, or other grounds provided by law.