The Law on Personal Data obliges Holders (Owners) of Personal Data Arrays to register with the competent state authority, however, to the best of our knowledge, none of Holders (Owners) of Personal Data Array has been registered to date, in particular, due to the fact that such regulator does not exist.

According to the Law on Personal Data within the registration procedure the following must be provided:

• Name and details of Holders (Owners) of Personal Data Arrays (ie. data controller);
• Purposes and procedures of collection and processing of personal data;
• Retention and terms of storage;
• List of collected personal data;
• Categories or groups of personal data bearers;
• A source of collecting of personal data;
• Procedure of notification of data subjects on collecting and possible transfer of personal data;
• List of measures regarding the regime of confidentiality and safety of personal data;
• Authorized person responsible for working with personal data;
• Receiving party or category of receiving parties of personal data;
• Proposed transfer of personal data outside of the Kyrgyz Republic.

With regards to the registration obligation the procedure for registering holders (owners) of personal data arrays was approved. 

Registration in the Register consists of three stages. During the first two stages, the holder fills in electronic forms to obtain a registration number in the Registry. During the third stage, the holder goes through the procedure for agreeing and registering lists of personal data for their collection, processing and storage as part of the implementation of their functions and purposes. 

Registration of holders in the Register is carried out after authorization in the Register through the Unified Identification System through a cloud-based electronic signature of a legal entity. After filing the application, the holder receives a unique registration number in the Registry. Based on the results of registration in the Register, the holder receives the right to collect, process and store personal data in accordance with the legislation of the Kyrgyz Republic in the field of personal data.¹