Personal data processing policy of the State Personal Data Protection Agency under the Cabinet of Ministers of the Kyrgyz Republic
1. General Provisions
1. This Personal Data Processing Policy (hereinafter referred to as the Policy) was developed in pursuance of the requirements of Part 2 of Article 4 of the Law of the Kyrgyz Republic “On Personal Information” and determines the legal and organizational grounds for the processing of personal data in the State Agency for the Protection of Personal Data under the Cabinet of Ministers of the Kyrgyz Republic (hereinafter referred to as the Holder).
2. This Policy is aimed at ensuring the protection of the rights and freedoms of the subject of personal data during the processing of his/her personal data and applies to all operations with personal data performed by the Holder, both in an automated mode and without it.
3. Basic rights and obligations of personal data subjects:
1) Subjects of personal data have the right:
to complete information about their personal data processed by the Holder;
to access their personal data, including the right to receive a copy of any record containing their personal data, except as provided by the Law of the Kyrgyz Republic “On Personal Information”;
to clarify their personal data, their blocking or destruction in cases where personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing;
to take measures prescribed by law to protect their rights, including application to the authorized state body for personal data;
to exercise other rights provided for by the legislation of the Kyrgyz Republic.
2) Subjects of personal data are required:
provide the Holder with only reliable data about himself/herself;
provide documents containing personal data to the extent necessary for the purpose of processing;
inform the Holder about the clarification (updating, changing) of their personal data.
4. Basic rights and obligations of the Holder.
1) The holder has the right to:
receive reliable information and / or documents containing personal data from the subject of personal data;
clarify the personal data provided by the subject.
2) The holder is obliged to:
process personal data in the manner prescribed by the Law of the Kyrgyz Republic "On Personal Information";
consider the appeals of the subject of personal data on the processing of personal data and give answers within a period not exceeding 7 days from the date of submission of the application;
provide the subject of personal data with the opportunity of free access to his\her personal data;
take measures to update personal data in connection with the request of the subject of personal data;
organize the protection of personal data in accordance with the requirements of the legislation of the Kyrgyz Republic
5. The Holder collects, uses and protects personal data provided by the subject of personal data in accordance with this Policy and the legislation of the Kyrgyz Republic.
2. Scope and categories of personal data processed, categories of personal data subjects
6. The Holder processes personal data of the following categories of personal data subjects:
- Citizen (applicant);
- Contractor/supplier/counterparty;
- State civil servant;
- Technical service personnel;
- Citizens participating in an open competition for the enrollment to the personnel reserve;
- Trainee;
- A person directly responsible for working with personal data of other Holders (IS "Register of Holders (Owners) of Personal Data Arrays").
7. Personal data processed by the Holder include:
residential address;
year of birth;
birthday;
personal identification number;
income;
place of birth;
phone number;
education;
passport data (series, passport number, by whom and when issued);
military rank;
profession;
family status;
surname;
name;
surname;
email;
job title;
signature;
checking account;
salary;
salary;
length of service;
class rank;
disease code;
the amount of accrued insurance premiums;
number of the certificate of advanced training;
photo (size 3x4sm);
government and departmental awards.
7.1. Special categories of personal data processed by the Holder include:
nationality;
political views;
medical information.
8. The holder ensures that the content and scope of the processed personal data correspond to the stated purposes of processing and, if necessary, takes measures to eliminate their redundancy in relation to the stated purposes of processing
9. The processing of special categories of personal data that reveal racial or ethnic origin, nationality, political opinions, religious or philosophical beliefs, as well as those relating to the state of health and intimate life, is carried out by the Holder solely on the basis of the requirements of regulatory legal acts and in strict accordance with Article 8 Law of the Kyrgyz Republic "On Personal Information"
10. The lists of personal data and categories of personal data subjects can be revised by the Holder with the obligatory consolidation of changes in this Policy and notification of personal data subjects in any available way (official website, announcement, push notification, sending a message by e-mail, etc.)
3. Purposes of collecting personal data
11. Personal data is processed by the Holder for the following predetermined and legitimate purposes:
informing the User by sending e-mails;
preparation of responses within the framework of the implementation of the Law of the Kyrgyz Republic "On the procedure for considering citizens' appeals";
conducting office work in accordance with regulatory legal acts;
maintaining personnel records and records of employees and interns of the Holder in the manner prescribed by regulatory legal acts;
remuneration of employees of the Holder;
compensation for expenses related to temporary disability of the Holder's employees;
implementation of the execution of contractual rights and obligations within the framework of civil law transactions and the payment for services rendered, works and delivered goods;
keeping records of the Holder's visitors, as well as entities receiving oral consultations from the Holder within the framework of the legislation of the Kyrgyz Republic on personal information;
4. Legal grounds for the processing of personal data
12. The legal grounds for the processing of personal data by the Holder are:
Constitution of the Kyrgyz Republic;
Labor Code of the Kyrgyz Republic;
Civil Code of the Kyrgyz Republic;
Budget Code of the Kyrgyz Republic;
Tax Code of the Kyrgyz Republic;
Law of the Kyrgyz Republic "On Public Procurement"
Law of the Kyrgyz Republic "On information of a personal nature";
Law of the Kyrgyz Republic "On the Procedure for Considering Citizens' Appeals";
Law of the Kyrgyz Republic "On the State Civil Service and Municipal Service"
Сonsent of personal data subjects to the processing of personal data (in accordance with Decree of the Government of the Kyrgyz Republic No. 759 dated November 21, 2017);
Order of the Ministry of Finance of the Kyrgyz Republic “On Approval of the Regulation on Accounting and Financial Reporting in the Public Administration Sector” dated December 25, 2018 No. 137-P.
5. The procedure and conditions for the processing of personal data
13. The processing of personal data by the Holder is carried out in the following ways:
automated;
without the use of automation tools.
14. The processing of personal data by the Holder includes any operations or a set of operations performed regardless of the methods, by automatic means or without them, for the purpose of collecting, recording, storing, updating, grouping, blocking, erasing and destroying personal data.
15. The processing of personal data is carried out by the Holder subject to the consent of the subject of personal data (hereinafter referred to as the Consent), except for the cases established by law when the processing of personal data can be carried out without such Consent.
16. The subject of personal data makes a decision to provide his\her personal data and gives it in writing on paper, or in the form of an electronic document signed in accordance with the legislation of the Kyrgyz Republic with an electronic signature.
17. The condition for terminating the processing of personal data may be the achievement of the goals of processing personal data, updating personal data, as well as the identification of unlawful processing of personal data identified on the basis of an application from the subject of personal data or a judicial act.
18. The holder, in order to achieve the purposes of processing, with the consent of the subject of personal data, has the right to transfer personal data to third parties, provided that the recipient of the data is obliged to maintain the confidentiality of these data.
19. When processing personal data, the holder takes or ensures that the necessary legal, organizational and technical measures are taken to protect personal data from unauthorized or accidental access to them, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions regarding personal data.
20. Personal data should not be kept longer than is necessary to fulfill the purposes for which it was collected. Storage periods can be extended only in the interests of the subject of personal data or if it is provided for by the legislation of the Kyrgyz Republic.
6. Updating, correcting, deleting and destroying personal data, responses to requests from personal data subjects for access to personal data
21. In case of confirmation of the fact of unreliability of personal data or illegality of their processing, personal data shall be updated, blocked or destroyed depending on the legality of their collection, storage and processing of such personal data by the Holder, or their processing shall be terminated accordingly.
22. On the facts of inaccuracy of personal data or the illegality of their processing, the subject of personal data has the right to apply directly to the address of the Holder, or to the Authorized state body for personal data.
23. At the written request of the subject of personal data, the Holder is obliged to provide information on the processing of personal data carried out by him/her, reflecting the following information:
confirmation of the fact of personal data processing by the holder (owner) of the personal data array;
legal grounds and purposes of personal data processing;
the purposes and methods of processing personal data used by the holder (owner) of the array of personal data;
name and location of the holder (owner) of the array of personal data, information about persons (with the exception of employees of the holder (owner) who have access to personal data or to whom personal data may be transferred on the basis of an agreement with the holder (owner) of the array of personal data or on the basis of the law;
processed personal data relating to the respective subject of personal data, the source of their receipt;
terms of processing personal data, including the terms of their storage;
the procedure for the exercise by the subject of personal data of their rights provided for by this Law;
information about the performed or proposed cross-border data transfer;
other information provided for by this Law and (or) other regulatory legal acts.
24. If the subject does not have access rights to the requested information, then a reasoned refusal is sent to him.
25. After the expiration of the storage period and the achievement of the purposes of collecting personal data, they are subject to destruction within two weeks. Destruction is confirmed by an act, a copy of which can be handed over to the subject of personal data upon his\her written request.
7. Final provisions
26. All relations related to the processing of personal data that are not reflected in this Policy are regulated in accordance with the provisions of the Law of the Kyrgyz Republic "On Personal Information".
27. The Holder has the right to make changes to this Policy. When making changes in the current version, the date of the last update is indicated. The new version of the Policy comes into force from the moment it is posted in the public domain so that one can familiarize oneself with the condition of the mandatory preliminary announcement of planned changes at least 14 working days before the date of publication of the new version of the Policy.