Status
In force
Consent model
Opt-in
Primary law
Law on Personal Information (2008, amended 2021)
Year
2008
Authority
State Personal Data Protection Agency
Marketing consent
Consent-based; 2021 amendments added localization and a supervisory agency.
Transfers
Transfers are restricted, and a localization rule keeps certain data in the country.
Penalties
The authority can impose administrative fines.
The framework
The operative statute in Kyrgyzstan is the Law on Personal Information (2008), enforced by the State Personal Data Protection Agency.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
Law on Personal Information (2008, amended 2021)
2008 · In force
The 2021 amendments gave Kyrgyzstan a supervisory agency and Russian-style localization duties on top of its 2008 consent framework.
Marketing and advertising
Consent-based; 2021 amendments added localization and a supervisory agency. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
Transfers are restricted, and a localization rule keeps certain data in the country.
Enforcement and penalties
The authority can impose administrative fines. How often the authority actually enforces sets the real price.
Cite this page: "Kyrgyzstan Data Privacy Laws." Digital Privacy Regulations, September 28, 2026, https://digitalprivacyregs.com/kyrgyzstan.html. Accessed [date].