According to Article 17 of the Law of the Kyrgyz Republic "On Personal Information", the holder of an array of personal data is obliged to:

a)    receive personal data directly from the subject of personal data or his/her authorized representatives;

b)    ensure the confidentiality of personal data in cases provided by the legislation of the Kyrgyz Republic and this Law;

c)    determine the processor for the processing of personal data, providing guarantees regarding technical security measures and organizational measures governing the processing of personal data, unless the holder independently assumes the functions and obligations of the processor;

d)    ensure the safety and reliability of personal data, as well as the statutory access regime to them;

e)    provide personal data within a week after receiving a request from the subject;

f)    in case of refusal to provide the subject at his/her request with information about the availability of personal data about him/her, as well as the personal data themselves, issue a written reasoned response containing a reference to the relevant paragraph of Article 15 of this Law, within a period not exceeding one week from the date of the subject's application;

g)    at the request of the authorized state body or the Ombudsman (Akyikatchy) of the Kyrgyz Republic, within a week submit the information necessary for the exercise of their powers.

Persons who have become aware of personal data due to their official position assume obligations and are responsible for ensuring the confidentiality of these personal data. Such obligations remain in force after the end of the work of these persons with personal data during the period of maintaining the confidentiality regime in accordance with Article 6 of the Law "On Personal Information"