Regulations on the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic

(As amended by Resolution No. 103 of the Cabinet of Ministers of the Kyrgyz Republic dated March 4, 2022)

1. General provisions

1. The State Agency for the Protection of Personal Data under the Cabinet of Ministers of the Kyrgyz Republic (hereinafter referred to as the Agency) is a state executive authority that develops and implements a unified state policy in the field of personal information, performs functions to ensure the protection of the rights of personal data subjects (subjects), registration of holders (holders) of personal data arrays, maintaining a Register holders of arrays of personal data.

2. The Agency in its activities is guided by the Constitution of the Kyrgyz Republic, laws of the Kyrgyz Republic, resolutions of the Jogorku Kenesh of the Kyrgyz Republic, decrees and orders of the President of the Kyrgyz Republic, resolutions and orders of the Cabinet of Ministers of the Kyrgyz Republic, international treaties that have entered into force in accordance with the legislation of the Kyrgyz Republic, as well as this Regulation.

3. The Agency carries out its activities in cooperation with state bodies, local self-government bodies, international organizations, the business community, public associations, scientific and other organizations.

4. The Agency is a legal entity, has a seal with the image of the State Emblem of the Kyrgyz Republic and its name in the state and official languages, stamps and forms of the established sample, as well as settlement, current and other accounts in the Treasury system and in agent banks of the Central Treasury of the Ministry of Finance of the Kyrgyz Republic.

5. Full name of the Agency:

- - in the state language: "Kyrgyz Respublicasynyn Ministerler Kabinetine karashtuu Zheke maalymattardy korgoo boyuncha mamlekttik agenttik";";

- in the official language: "State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic".

6. This Regulation defines the organizational and legal status of the Agency, its goals and objectives, functions and rights, as well as the organization of the Agency's activities.

2. The purpose of the Agency's activities

7. The purpose of the Agency's activities is to ensure the protection of human and civil rights and freedoms related to the collection, processing and use of personal data, regardless of the means used to process this information, including the use of information technologies.

3. Tasks of the Agency

8. The objectives of the Agency are:

1) ensuring control over the compliance of personal data processing with the requirements of the legislation of the Kyrgyz Republic in the field of personal information by state bodies, local self-government bodies, state and municipal institutions and enterprises, as well as legal entities and individuals, regardless of the form of ownership;

2) protection of the rights of personal data subjects;

3) providing the public with information about the situation with the protection of personal data in the Kyrgyz Republic;

4) implementation of other tasks assigned to the Agency in accordance with the legislation of the Kyrgyz Republic.

4. Agency Functions

9. The Agency performs the following functions:

1) in the field of sectoral policy:

- assistance in the development and implementation of the state policy in the field of personal data within its competence;

- development of a unified state policy in the field of personal data protection;

- implementation of the function of the state customer of scientific, technical and investment programs and projects in the field of personal data protection;

- ensuring the fulfillment of obligations assumed under international agreements in the field of personal data that have entered into force in accordance with the legislation of the Kyrgyz Republic;

- ensuring the coherence of the activities of state bodies on the implementation and protection of the rights of personal data subjects, including security, when processing personal data;

- development of bill regulatory legal acts and decisions of the Cabinet of Ministers of the Kyrgyz Republic in the field of legal regulation of work with personal data, protection of the rights of personal data subjects, ensuring safe processing of personal data, industry standards, technical specifications, instructions in the field of personal data, as well as technical acts regulating activities in the field of personal data;

2) in the field of regulation, coordination, supervision and control:

- control by conducting inspections of compliance with the requirements of the legislation of the Kyrgyz Republic on the protection of personal data and the rights of personal data subjects;

- record keeping and registration of personal data arrays and their holders (holders);

- formation and maintenance of the Register of holders (holders) of personal data arrays;

- coordination of lists of personal data of holders (holders) of personal data arrays;

- control over the use of personal data received by state bodies, local state administrations and local self-government bodies from other state holders (holders) of personal data;

- coordination of the use by state bodies, local state administrations and local self-government bodies in their activities of personal data held by other holders (holders) of personal data;

- giving recommendations on controversial issues arising between participants of information interaction during the processing, storage and transfer of personal data, including with the use of electronic control elements;

- monitoring the enforcement of the requirements of the legislation of the Kyrgyz Republic on the content and processing of personal data in personal data information systems, as well as the protection of personal data;

- monitoring the practice of ensuring the security of personal data during their processing, summarizing and publishing the best practices and standards for ensuring the security of personal data during their processing;

- assistance to personal data subjects in the implementation and protection of their rights;

- consideration of appeals of personal data subjects on violations of legislation in the field of personal data and making conclusions;

- sending to law enforcement agencies materials related to the violation of the rights of personal data subjects provided for by the legislation of the Kyrgyz Republic in the field of personal data, for taking appropriate measures to comply with the legislation of the Kyrgyz Republic;

- implementation of methodological assistance in the organization of personal data protection.

10. The functions in the sphere of regulation, coordination, supervision and control do not apply to personal data obtained as a result of the activities of the Prosecutor's Office of the Kyrgyz Republic, law enforcement agencies and bodies engaged in operational search, intelligence and counterintelligence activities, the production of official statistics, the legal regime of which is established in accordance with the laws of the Kyrgyz Republic  "On operational investigative activities" and "On the Protection of State Secrets of the Kyrgyz Republic".

5. Agency Rights

11. The Agency, in accordance with the functions assigned to it, has the right to:

1) within the limits of its competence, adopt in accordance with the established procedure departmental acts that are mandatory for the Agency's employees;

2) implement national strategies and programs in the information sphere in order to create conditions for the effective implementation and protection of the rights of personal data subjects, ensuring the safe processing of personal data;

3) analyze and summarize the practice of applying national legislation in the field of personal information;

31 )preparation of a conclusion with comments and recommendations on the results of the inspections carried out;

4) cooperate with the authorities authorized in the field of personal data protection of foreign states, as well as international organizations on issues related to personal data protection;

5) organize and conduct conferences, seminars and other events aimed at the implementation and protection of the rights of personal data subjects, ensuring the safe processing of personal data, exchange of experience on these issues;

6) organize scientific and other research on the effective implementation and protection of the rights of personal data subjects, ensuring the safe processing of personal data;

7) conclude contracts with legal entities and/or individuals in accordance with the civil legislation of the Kyrgyz Republic;

8) to establish in accordance with the established procedure and take part in the work of councils, commissions, technical committees and working groups to resolve issues within the competence of the Agency, with the involvement of the necessary specialists and experts, employees of state bodies and local self-government bodies (as agreed);

9) request from the holders (owners) of personal data arrays the necessary information in accordance with the Law of the Kyrgyz Republic "On Personal Information" for the performance of their powers;

9/1) require the holders (owners) of personal data to clarify, block or destroy false or illegally obtained personal data, take appropriate measures to ensure the protection and security of personal data;

10) represent the interests of the Agency in judicial bodies, state bodies of the Kyrgyz Republic and other organizations;

11) exercise other rights arising from the legislation of the Kyrgyz Republic in the field of personal information.

(As amended by Resolution No. 103 of the Cabinet of Ministers of the Kyrgyz Republic dated March 4, 2022)

6. Organization of the Agency's activities

12. The Agency is headed by a director who is appointed and dismissed by the President of the Kyrgyz Republic.

13. The Agency provides for the position of Deputy Director, who is appointed and dismissed by the Chairman of the Cabinet of Ministers of the Kyrgyz Republic on the recommendation of the Director of the Agency. The Deputy Director reports directly to the Director and organizes the Agency's activities within the limits of the powers assigned to him in accordance with the distribution of responsibilities.

14. Director of the Agency:

1) carries out the general management of the Agency's activities and is personally responsible for the fulfillment of the tasks and functions assigned to the Agency;

2) defines the duties of the Deputy Director of the Agency;

3) approves the Agency's structure, which can be changed only in connection with changes in the tasks and functions of the Agency. At the same time, the appointment of the Director of the Agency is not the basis for changing the structure of the Agency;

4) in accordance with the procedure provided for by the legislation of the Kyrgyz Republic, appoints and dismisses employees of the Agency;

5) submits proposals to the Cabinet of Ministers of the Kyrgyz Republic on the maximum number of civil servants of the Agency;

6) signs orders, regulations, protocols, Agency decisions, collective agreement;

7) applies incentive and disciplinary measures against Agency employees.

8) approves the Agency's staffing table;

9) approves regulations on structural divisions, job descriptions and duties of Agency employees.

(As amended by Resolution No. 103 of the Cabinet of Ministers of the Kyrgyz Republic dated March 4, 2022)

15. Reports on the Agency's activities are compiled annually and published on the Agency's official website no later than March 1 of the year following the reporting year.

7. Property and financing of the Agency

16. Property (movable and immovable) The Agency is state property transferred to the Agency on the right of operational management.

17. Financing of the Agency's activities is carried out at the expense of the republican budget, special funds and other sources of financing that do not contradict the legislation of the Kyrgyz Republic.

18. Funds are spent on the basis of estimates approved by the Director of the Agency, as well as in accordance with the terms of the collective agreement, within the funds provided for the current financial year.

8. Final provisions

19. The reorganization and liquidation of the Agency shall be carried out in accordance with the civil legislation of the Kyrgyz Republic.

20. Upon termination of the Agency's activity, the Agency's documents are stored and used in accordance with the Law of the Kyrgyz Republic "On the National Archival Fund of the Kyrgyz Republic".