Kyrgyzstan signs personal data law with fines up to 140,000 soms

President Sadyr Japarov has signed a law setting fines of up to 140,000 soms for violating requirements on processing and protecting personal data in Kyrgyzstan. Higher liability applies to repeat violations and to breaches involving children's data and special categories of personal data. The law, No. 150, is dated 9 October 2026.

For general violations, fines are 2,500 soms for individuals, 10,000 for officials and 65,000 for legal entities. For violations involving children's data, they are 7,500, 20,000 and 80,000 soms. Repeat violations within a year carry higher amounts.

Fines for transferring personal data abroad in breach of requirements are 7,500 soms for individuals, 17,500 for officials and 65,000 for legal entities. The law takes effect 10 days after official publication. Parliament adopted the amendments in third reading on 16 September, and they align the Code on Offences with the Digital Code of Kyrgyzstan.