Art. 15.13 of the Law on Licensing-Permitting System of the Kyrgyz Republic establishes that licenses are required for activities related to data transfers, including the identification, authenticity of the international unique identification code of mobile communication devices and devices used for data transmission operating and imported into the territory of the Kyrgyz Republic.

It is reported that the Law on Protection from Inaccurate (False) Information has been abused to block commercial web content. Art. 3 of the this law enables individuals or companies to file a complaint about false or defamatory information to a unit in the Ministry of Culture, which has two days to respond to these complaints. If the content meets the criteria, websites or social media platforms must remove it within 24 hours. If the content is not removed, the individual or company who filed the complaint can then request the suspension of the website or the social media account that posted the information. The department can then issue a request to the ISPs to shut down the website or webpage for a period of up to two months. As of May 2023, 459 websites are reported to be blocked, similar to 2022. However, there was an increase in the number of blocked websites from 2021, when 77 were reportedly blocked. Some of the websites being blocked are media outlets including 24.kg, Res Publica, and Radio Azattyk’s website.

It is reported that there is a mandatory requirement for all advertisements to be in the Kyrgyz language. Due to the widespread use of the Russian language, however, companies usually advertise in both languages.

According to Art. 5.2 of the Law about Protection from Inaccurate (False) Information, ISPs, mobile operators, and owners of public Wi-Fi hotspots are required to identify their subscribers.

Rule 34.5 of the Rules for Provision of Mobile Radiotelephone Communication Services states that the contract signed at the time of SIM purchase must contain the following information about the subscriber: surname, first name, patronymic, and ID card details. In case the subscriber is a legal entity, the information to be provided includes the name of the organisation, surname, first name, patronymic of the manager, location of the headquarters, and bank details.

Section 15 of the "Instruction on the Procedure for Interaction of Telecommunication Operators and Mobile Cellular Operators with State Bodies of the Kyrgyz Republic Carrying Out Operational-Search Activities" requires ISPs and mobile service providers to allow authorities direct, real-time access to their communications networks without notification and oversight. Every ISP and mobile service provider is obliged to install equipment compliant with the System for Operational Investigative Activities (SORM) in their ICT infrastructure to allow the authorities unfettered access to internet traffic and subscribers’ information (Section 7). It is reported that these requirements could enable mass surveillance without judicial oversight.

A basic legal framework on intermediary liability for copyright infringement is absent in Kyrgyz Republic's law and jurisprudence.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Kyrgyz Republic's law and jurisprudence.

Law No. 58 on Personal Information provides a comprehensive regime of data protection in the Kyrgyz Republic. The Law provides general requirements for data controllers and processors. There is not yet a data protection authority and thus there has yet to be any enforcement action related to the data protection or further guidance on compliance.

Section 15 of the "Instruction on the Procedure for Interaction of Telecommunication Operators and Mobile Cellular Operators with State Bodies of the Kyrgyz Republic Carrying Out Operational-Search Activities" requires ISPs and mobile service providers to store subscribers’ metadata for up to three years.

Pursuant to Art. 25 of the Law No. 58 on Personal Information, the cross-border transfer of personal data is permitted in the case where a personal data holder located within the Kyrgyz jurisdiction transfers such databases on the basis of an international agreement between the parties, according to which the receiving party provides an adequate level of protection of the rights and freedoms of personal data subjects. If a certain country does not provide an adequate level of protection of personal data, personal data may be transferred in the following cases:
- with the consent of a data subject for such transfer;
- where such a transfer is necessary for the protection of a data subject's interest; or
- where personal data is contained in a publicly available array of personal data.
It should be emphasized that in the case of transferring personal data via the internet, the personal data holder transferring such data shall ensure that data is transferred with the necessary means of protection.

The Kyrgyz Republic has not joined any agreement with binding commitments to open transfers of data across borders.

The Ministry of Digital Development's Service for the Regulation and Supervision of the Communications Sector is the telecommunications authority of the Kyrgyz Republic. It is reported that its decision-making process is not independent of the government.

The Kyrgyz Republic does not mandate functional or accounting separation for operators with significant market power (SMP) in the telecom market.

The Regulation on Licensing of Activities in the Field of Electric and Postal Communications governs the procedure for issuance, reissuance, suspension, renewal and cancellation of licenses for activities in the field of electronic communications. The regime is generally non-discriminatory although the licensing regime for Kyrgyztelecom Open Joint Stock Company (Kyrgyz Telecom OJSC) has some potentially restrictive obligations contained in Law No. 31 on Electric Communication. Art. 13 of this law designates Kyrgyz Telecom OJSC as a national telecommunications operator and provider of public telecommunications services and defines obligations and rights that Kyrgyz Telecom's licence must contain. Among these are the obligation to: (i) provide public telecommunications services to any person in any part of the Kyrgyz Republic where it is technically or economically possible and to justify the refusal or inability to provide services; (ii) develop a public telecommunications network; and (iii) manage national long-distance and international telecommunications services. The licence must also establish a procedure for regulating prices for the use of networks and services provided by Kyrgyz Telecom on an exclusive basis. While Kyrgyz Telecom is currently a state-owned enterprise, Art. 16 extends these obligations also to private entities that would participate in the privatisation of Kyrgyz Telecom or other public telecommunications network operator or public telecommunications service provider owned or controlled by the state.