LexLint

Know the law where your app runs.

Law / Kyrgyzstan

Digital Code, digital resilience baseline security measures

Digital Code, Law No. 178, Art. 63(1)-(4)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force 7 months, effective 6 February 2026.

A security baseline statutes rule binding public and private bodies.

As of 18 September 2026.

What it requires

  • This binds any subject of a digital-environment legal relationship whose record, resource, service, or technological system reaches a user in Kyrgyzstan, with no exemption for size or sector.
  • Maintain the integrity and availability of your digital systems and the confidentiality of the digital data you process, monitor for and help prevent incidents in the digital environment, manage the resulting risk under a risk-management system, and dedicate the resources your continuity of operation and recovery from an incident require.
  • If you operate critical information infrastructure, Kyrgyzstan's separate cybersecurity legislation, not analyzed in this instrument, sets the specific procedure you must follow for these measures and for incident monitoring and data exchange.
  • Follow any measure the sectoral regulator for your sector directs you to take to prevent an incident in the digital environment or reduce its negative consequences; the regulator may issue binding instructions to that effect.

Who enforces it

Enforcement body

Sectoral regulators, each within its own jurisdiction over the participant's sector (Art. 63(4)); the Digital Code names no single authority for the general Art. 63(1)-(2) duty, and no penalty specific to it is stated in the primary text.

Settledness

As of
18 September 2026
Open questions
  • What is the citation of the separate cybersecurity legislation Art. 63(3) defers to for the detailed procedure governing critical information infrastructure, and has it been enacted?
  • Does the National Bank of the Kyrgyz Republic administer its own binding cybersecurity or IT-risk directive for a licensed financial institution under Art. 63(4)'s sectoral-regulator mechanism?

What it reaches

Obligation class

Security, Governance

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 63(1) states that state regulation of digital resilience exists to ensure the continuity of operation of the subjects and objects of the digital environment and their recovery after an incident there, expressly recognizing the practical impossibility of fully protecting against one.

Article 63(2) requires every subject of a digital-environment legal relationship to achieve digital resilience by ensuring the integrity and availability of the objects of that relationship and the confidentiality of the digital data it processes. The same provision also requires monitoring for and helping prevent incidents in the digital environment and exchanging data about them, managing risk under a risk-management system, and managing the resources continuity of operation requires.

Article 63(3) reserves the specific procedure for integrity, availability, and confidentiality measures over critical information infrastructure, and for monitoring and exchanging data about incidents affecting it, to Kyrgyzstan's cybersecurity legislation, a body of law not described here. Article 63(4) lets a sectoral regulator direct measures a digital-environment participant must implement to prevent an incident or reduce its negative consequences, and binds the participant to follow them.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach
  • high_risk_decisions
  • processes_voice
  • processes_biometrics
  • serves_minors
  • operates_social_platform
  • ships_mobile_app
  • distributes_software_product

Read the law

Official government portal
Centralized Bank of Legal Information of the Kyrgyz Republic (cbd.minjust.gov.kg), whose page at this URL serves only a JavaScript shell to a standard web request and required a browser render to read the full text confirmed directly against this URL

Back to the example  ·  Lint your app