Where we work · Kyrgyzstan
ISO and GRC certification consulting in Kyrgyzstan
Achieve ISO and GRC certification in Kyrgyzstan with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Kyrgyzstan
Clients include
ISO and GRC certification in Kyrgyzstan at a glance
Personal data is the most active compliance topic for Kyrgyz organisations at present. The Digital Code of the Kyrgyz Republic (Law No. 178 of 31 July 2025) replaced the 2008 personal information law, and the State Agency for Personal Data Protection says on its own site that the Code has been in force since February 2026. Management system work sits beside it. The Kyrgyz Accreditation Centre (KCA), which works within the Ministry of Economy and Commerce, is the national accreditation body and appears on the ILAC register for testing, calibration and inspection. Kyrgyzstan belongs to the Eurasian Economic Union, so food producers work to its technical regulation TR CU 021/2011, which asks for HACCP-based procedures. The National Statistical Committee's figures for January to September 2026 show manufacturing, agriculture, mining, construction, trade and services all carrying weight, and the National Bank licenses banks and payment system operators. Sterling serves clients from its Dubai office, on site where the work needs it and remotely otherwise, drawing on 8,100+ client engagements in 60+ countries and 20+ years, with Effivity and Sterling Academy included. Certificates come from accredited certification bodies, never from Sterling.
ISO and GRC standards Sterling delivers in Kyrgyzstan
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Kyrgyzstan (7)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Digital Code of the Kyrgyz Republic, Law of 31 July 2025 No. 178, Chapter 11 'Processing of personal data' (Articles 77 to 91) The Code gives regulation and supervision to a sector regulator for personal data, an authorised state body whose regulation is approved by the Cabinet of Ministers (Articles 9 and 90). The State Agency for Personal Data Protection under the Cabinet of Ministers publishes the regulator documents under the Code on its site. | Applies to any processing of personal data, including inside digital records and resources, except by an individual solely for personal or family affairs. Processing needs a listed ground such as contract, vital interests, public tasks or legitimate interests, otherwise consent given in any provable form and withdrawable as easily as it was given. The owner of the records must follow principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation and security, and be able to show compliance. Processors work under a written contract or legal act. Owners protect the data, keep a record of operations and, with more than ten staff, name a person responsible. A transfer abroad requires the destination to be on the regulator's published list of states with adequate protection, or another listed basis such as consent or suitable contract terms. Incidents are notified to the regulator within 72 hours of discovery, with a processor telling the owner within 48 hours. | |
| State Agency for Personal Data Protection under the Cabinet of Ministers — documents and tools State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic, as its site names itself. | Documents are published on the Agency's own site; check current versions there before relying on them. | |
| Law of 22 May 2004 No. 67 'On the fundamentals of technical regulation in the Kyrgyz Republic' (as published on the national trade information portal, amended to 2019); the Ministry of Economy and Commerce, within which the Kyrgyz Accreditation Centre operates Manufacturers, exporters and any business confirming conformity to standards | The Law treats voluntary confirmation of conformity as the applicant's initiative under a contract, covering standards and certification systems, and says accreditation rests on voluntariness, open rules and impartiality and may not be combined with certification in one organisation. Mandatory requirements come from technical regulations. | |
| Eurasian Economic Union technical regulation TR CU 021/2011 'On the safety of food products', applied in Kyrgyzstan as a member state of the Union Food producers and processors | Article 10 requires a manufacturer to develop, implement and maintain procedures based on HACCP principles when carrying out production processes tied to food safety. | HACCP |
| National Bank of the Kyrgyz Republic Banks, payment system operators and e-money issuers | The National Bank's site publishes a register of commercial bank licences (as at 1 October 2026, with columns for permissions such as e-money issuing) and a register of payment system operator licences. It lists no ISO or PCI requirement on those pages. | |
| Sector regulator for personal data under the Digital Code Record owners and digital service providers | Article 63 on digital resilience requires an owner of records or a digital service provider to notify the sector regulator of an incident affecting digital resilience or people's rights within 72 hours of discovery, with an explanation if late, and a processor to tell the owner within 48 hours. | ISO/IEC 27001, ISO 22301 |
| Government of the Kyrgyz Republic, Resolution of 21 November 2017 No. 762 'On approval of requirements for the protection of information contained in databases of state information systems' State information systems and their suppliers | The Resolution appears on the Agency's documents list; the title shows it sets protection requirements for state information system databases. Whether it cites any ISO standard has not been established, so treat it as a security expectation for government work. |
Accreditation and recognition
- Kyrgyz Accreditation Centre (KCA): National accreditation body — KCA's own site says it is the national accreditation body authorised to carry out state accreditation policy for conformity assessment bodies, a state institution now working within the Ministry of Economy and Commerce.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Economic zones
- Free economic zone Bishkek, Bishkek: garments, construction materials and PVC, paints and coatings, lighting and solar systems
Sterling in Kyrgyzstan
Sterling delivers in Kyrgyzstan from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Kyrgyzstan clients ask
Is the 2008 Kyrgyz personal information law still the law that applies?
No. The Ministry of Justice database marks the Law of 14 April 2008 No. 58 as having lost force under Law No. 179 of 31 July 2025, which introduced the Digital Code. Chapter 11 of the Code now governs personal data, and the State Agency for Personal Data Protection says on its site that the Code has applied since February 2026. Check the current text with your counsel or the Agency.
Can personal data about people in Kyrgyzstan be sent abroad?
Yes, within limits. The regulator publishes a list of foreign states with adequate protection; transfers to listed states cannot be barred, and the owner must confirm the destination is listed first. For other states a transfer needs a basis such as the person's consent, a contract with them or suitable contract terms between owner and processor. Confirm the current list with the regulator.
Which body accredits laboratories and certification bodies in Kyrgyzstan?
The Kyrgyz Accreditation Centre (KCA) is the national accreditation body and works within the Ministry of Economy and Commerce. The ILAC register lists it as a signatory for testing, calibration and inspection. For a management system certificate, ask the certification body for its accreditation certificate and scope, because a signatory entry for laboratories does not describe that scope.
Does Kyrgyzstan's membership of the Eurasian Economic Union affect food safety certification?
Yes, for food manufacturers. The Union's technical regulation TR CU 021/2011 applies, and its Article 10 requires a manufacturer to develop, implement and maintain procedures based on HACCP principles. That makes HACCP a duty for producers, while a third-party scheme such as ISO 22000 remains a commercial choice. Confirm product-specific rules with the competent authority.
In which language is a certification audit run in Kyrgyzstan?
The language is agreed with the certification body when you apply. Kyrgyz and Russian both appear on the legal database, the accreditation centre's site and the data protection agency's site, so neither is assumed. Say early which language shop-floor interviews will use, whether an interpreter is needed and in which language controlled documents are kept.
Is ISO certification compulsory for Kyrgyz companies?
Not as a general rule. Law No. 67 on technical regulation treats voluntary confirmation of conformity to standards as the applicant's initiative under a contract, while mandatory requirements sit in technical regulations. Buyers, banks and tenders may still ask for a certificate and set their own conditions. Confirm any sector duty with your counsel or the regulator.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Digital Code of the Kyrgyz Republic, Law of 31 July 2025 No. 178, Chapter 11 'Processing of personal data' (Articles 77 to 91) — cbd.minjust.gov.kg; dpa.gov.kg (accessed 18 Oct 2026)
- State Agency for Personal Data Protection under the Cabinet of Ministers — documents and tools — dpa.gov.kg (accessed 18 Oct 2026)
- The Law treats voluntary confirmation of conformity as the applicant's initiative under a contract, covering standards and certification systems, and says accreditation rests on voluntariness, open rules and impartiality and may not be combined with certification in one organisation. Mandatory requirements come from technical regulations. — info.trade.kg; kca.gov.kg (accessed 18 Oct 2026)
- Article 10 requires a manufacturer to develop, implement and maintain procedures based on HACCP principles when carrying out production processes tied to food safety. — eec.eaeunion.org; eaeunion.org (accessed 18 Oct 2026)
- The National Bank's site publishes a register of commercial bank licences (as at 1 October 2026, with columns for permissions such as e-money issuing) and a register of payment system operator licences. It lists no ISO or PCI requirement on those pages. — nbkr.kg (accessed 18 Oct 2026)
- Article 63 on digital resilience requires an owner of records or a digital service provider to notify the sector regulator of an incident affecting digital resilience or people's rights within 72 hours of discovery, with an explanation if late, and a processor to tell the owner within 48 hours. — cbd.minjust.gov.kg (accessed 18 Oct 2026)
- The Resolution appears on the Agency's documents list; the title shows it sets protection requirements for state information system databases. Whether it cites any ISO standard has not been established, so treat it as a security expectation for government work. — dpa.gov.kg (accessed 18 Oct 2026)
- Kyrgyz Accreditation Centre (KCA) — kca.gov.kg; ilac.org (accessed 18 Oct 2026)
- Free economic zone Bishkek, Bishkek — sez.kg (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice